Are you concerned about these 10 coronavirus cybersecurity challenges?

Covid-19, or as it is otherwise known, the coronavirus forced us to live and do business in a new way which may quickly become ‘the new normal’. Are you ready to handle the new coronavirus cybersecurity issues?

In this article we will share the challenges our clients face and how we helped them solve them, so that they would not only survive the coronavirus, but use it to improve their cybersecurity significantly. 

Here are the biggest cybersecurity issues, created by the virus:

1. Everyone had to or has to work from home. Eventually this will shift the majority of the workforce to work from home more often than they did before. This created a dramatic shift in how information is to be protected from now on. 
2. Because of the coronavirus, we will fly much less – which is probably one of the good things coming out of it, but for some it might be a problem. 
3. Due to working from home, many employees have to use personal devices to access work-related resources. This presents serious cybersecurity issues, because their personal computers might be infected with a virus. 
4. While being with their families people spend less time working. Without any monitoring in place and with no direct supervision, performance can suffer and this has a direct business impact. 
5. No centrally managed updates and security – while the corporate IT and cybersecurity measures in the office pushed certain security policies and updates to user computers, when at home, these don’t exist. Users have to update everything themselves. 
6. The security of your team’s home wifi network is definitely weaker than the one at the office. 
7. The IT department has to find new ways to support people when they work from home. The ways they choose may not necessarily be the most secure ones. How are you going to ensure nobody else accesses your team’s computers in the same way? For example, if Teamviewer is used with a weak password, anyone globally can connect to the machine with the weak password. 
8. People will browse from home, and they will browse more and visit more risky websites from their work computers. This one is also a major security risk. While larger corporations can implement measures to control this risk, smaller companies usually don’t know the solutions to this problem and remain vulnerable. 
9. People will be more susceptible to attacks such as phishing, password stealing, credential theft and even when using 2-factor authentication, they may fall to 2-factor authentication bypass attacks. 
10. And the biggest risk: Your IT team is working from home – and that means that now your entire infrastructure’s cybersecurity is at risk, because if one of your IT administrators gets hacked, your whole company will get compromised. 

Solutions to the 10 coronavirus cybersecurity challenges:

1. The first one is a major change. People worked from home in the past, too – but many companies did not allow remote work with the fake perception of security in their own networks. We always told such companies that while any hacker could work in their network from any country, they denied their own employees the chance to be productive from home. On the other hand, as you saw from the other 9 challenges in the list above, work from home – with or without the coronavirus – creates a whole lot of other issues, too. Protecting information in the ‘new normal’ should use the Zero Trust principle. 
2. Flying less is actually a good thing in our book. Less visits to airports infested with suspicious or fake wireless access points, less chances for someone to oversee critical confidential documents on your team’s screens in crowded places, more productivity due to less time spent in airports. 
3. Using personal devices for business should be brought to a minimum, if not stopped altogether. A personal device is guaranteed to be less secure and perhaps even infected with a virus. An infected device is under the control of someone else, often from another country. You have no visibility what is happening on a personal device, your clients and partners likely would not be happy to find out that their critically confidential data has been lying around on your team’s personal computers.
4. Enabling activity monitoring and work reporting can be a ‘gestapo’ gesture if you do it wrong. There are positive, usable solutions which users will accept and be happy (or at least not unhappy) to use, so be careful with this one. 
5. There are ways to centrally manage computers while the same are not in the corporate network. Task your IT department to find them and implement them – even better, contact us and we will find the most secure solution to this challenge, the 9 other challenges and perhaps many more not listed in this article. 
6. You can distribute a memo to all employees with ideas and suggestions on how to improve the security of their home WiFi network. The most important settings to take care of: 
   1. Disable WDS
   2. Disable WEP, enable only WPA2 as a wireless security protocol
   3. Set a complex password – preferably longer than 16 characters. 
7. Managing remote computers is part of the IT operations now. There are many open-source and commercial tools to enable that. What you should be looking for when selecting a vendor is the ability to remotely wipe, remotely administer, remotely monitor, remotely install software and prevent the user from making any changes to the apps, OS or configuration of their device. 
8. Enable browser security hardening by following the Google Chrome STIG. You could also install browser security plugins and other security software to prevent browser exploitation, but that goes beyond the scope of a single article. 
9. We have enabled passwordless authentication, biometric authentication and physical token authentication for our clients and suggest you do the same in your network or call us to implement these for you. If your users are not using passwords anymore, how will someone steal their password?
10. Protecting your IT administrators while they work from home might seem counter-intuitive: after all, aren’t they IT experts? Yes they are. And often overconfident ones. But are they Cybersecurity experts? They may think they are, but in reality they are nowhere near there – else we would not have seen so many companies getting hacked in the past 3 years. So enable mandatory 2-factor authentication, as a minimum measure, to anything that an IT admin can administer remotely and enable extra monitoring and alerting whenever possible to detect anomalies before it is too late. Once a hacker obtains an admin credential, they control your whole network within just 24 hours.