To say that the pandemic ushered in a much more complicated cybersecurity landscape for organizations would be a serious understatement. Three years ago, IT teams enjoyed a relatively simple existence: monitor an office’s attack surface and regularly update company laptops, smartphones, tablets and other devices. Now that hybrid and remote work environments have become more prevalent, a new set of challenges has emerged. According to Deloitte, “companies are accelerating their digital transformation, and … the reputational, operational, legal and compliance implications could be considerable if cybersecurity risks are neglected.”
Millions of people are using their own personal devices to conduct business these days, and organizations are scrambling to safeguard themselves from all sorts of nefarious cyber schemes that can infiltrate their systems. Phishing attacks, impersonation scams and ransomware strikes are on the rise, as cybercriminals are taking full advantage of this scattershot security landscape where individuals are unaware of threats and often fail to update vulnerable devices.
The various array of devices that employees are using for work and play in particular can lead to some serious trouble. Cybersecurity company Kaspersky reports that 400,000 malicious files are distributed every day in 2022, a 5% increase from the previous year. Ransomware attacks increased 181%.
So what can concerned companies and IT teams do to mitigate the increased amount of possible threats? Where should they focus their efforts for the best protection for remote and hybrid workers?
The Numbers Aren’t Pretty
As previously implied, connecting to networks with non-secured devices can lead to employees unwittingly falling victim to phishing attacks, which is when attackers trick users into divulging passwords with what seem like legitimate requests from superiors or other seemingly trustworthy sources. These types of attacks are quite common, with more than 80% of organizations falling victim to at least one in 2021, according to Proofpoint’s most recent State of the Phish Report. Phishing scams are a preferred attack of cybercriminals because of their relative ease: They don’t need to infiltrate an organization’s systems or uncover vulnerabilities in the infrastructure; all that’s necessary is one person opening an email, clicking on a nefarious link or downloading a malicious attachment. They’re in, and now you’re exposed.
People simply aren’t careful enough when it comes to their personal mobile devices such as smartphones. The same Proofpoint survey found that a majority (56%) of people who use an employer-issued laptop, smartphone or tablet let friends and family members use their device for online activities such as playing games or shopping. Such risky behavior is like sending a personal invitation to a hacker, as sneaking into an organization’s network via malicious apps is low-hanging fruit for experienced cybercriminals.
But it’s not just phishing that worries IT teams. With more people working remotely, it’s increasingly likely we may find ourselves working in teams where we don’t know each other very well — and are therefore at risk of falling for impersonation schemes. Since 2018, the Federal Trade Commission’s Consumer Sentinel Network has received approximately 3 million reports of impersonation scams which resulted in losses of $6 billion. It’s an effective, elusive cybercriminal tactic that works.
Ransomware attacks are also on the rise. This occurs when software is injected into networks that erase valuable data unless users pay a ransom to attackers. We’ve all read accounts of companies, brands and even municipal governments paying ransoms to hackers who demanded money for the release of valuable data. According to research from Statistica, there were 236.1 million ransomware attacks around the world in the first half of 2022 alone. Damage from these events is expected to exceed $265 billion by 2031, a 10-fold increase compared to today.
Thankfully, there are steps you can take to prevent these types of scenarios from harming your company.
The Solutions Are Plenty
Before the pandemic when most employees still worked in a physical office, security agents within IT departments could regularly check and update company devices to ensure they were free of malicious spyware and were running the latest versions of anti-virus software and other preventative measures. Now that everyone is decentralized, more creative solutions are required to shore up the overall cyber defenses of an organization. Here are a few suggestions:
1. Require two-factor authentication. Also known as 2FA, this is an easy — and critical — first step to instantly beef up an organization’s security posture. Most people have experience with this practice, which requires users to verify their identities by using another device or code after entering their email username and password.
2. Provide ongoing cybersecurity training. The threat landscape is always evolving, and technology continues to improve at break-neck speed. Because of this, it’s vital that employees have access to training sessions on cybersecurity best practices at a consistent cadence.
3. Eliminate unlimited employee access. Too often, organizations automatically grant access and permissions to every employee as a default setting to save time, but that’s a big mistake. When it comes to allowing people to use certain systems and applications, always segment permissions and give the green light to only those who truly need it. You’ll seal up a lot of potential cybercriminal entry points when you control and protect accessibility.
4. Invest in Endpoint Detection and Response (EDR) tools. It’s wise to require EDR technology on all assets that access an internal environment. These tools and processes help security teams protect the digital perimeter of an organization. The best EDR solutions collect and categorize endpoint event data, detect suspicious activity, and flag down mitigators. These tools are instrumental because they can instantly block additional attempts by malware or hackers once an endpoint threat has been identified.
5. Re-examine your third-party relationships. While your company and its employees may follow cybersecurity best practices carefully, can you say the same about your vendors and other third-party relationships? Hackers can get into your systems in many ways, and these partnerships are an increasingly vulnerable weak spot for companies of all sizes. Make sure you vet your third parties closely and have a policy in place where regular security posture audits take place.
When all else fails, enlist the help of an industry-leading cybersecurity expert to develop a comprehensive plan that keeps the entire organization and its workforce protected. Let us know how we can help you achieve your cybersecurity goals today.