The outbreak of COVID‐19 has brought many challenges to society, especially cybersecurity. It has significantly affected not only the economy, but also our lives. We can easily observe the pandemic’s impacts in the real world. However, we may be somewhat less aware of its effect on cybersecurity, which is even more important in the new era that has been ushered in by the pandemic.
In fact, COVID-19 has given rise to a new brand of cybercrime that targets both businesses and users all over the world. Cyber hackers are increasingly using COVID-19 as bait to generate phishing, malspam, and ransomware attacks1. Similarly, some have reported that there are a variety of COVID-19-related cybercrimes—including online scams and phishing, disruptive malware, data harvesting malware, malicious domains, and misinformation—that are typically used by hackers to steal data and generate profits2. Therefore, cybersecurity has become increasingly challenging during the pandemic, and enterprises need to create a robust response to COVID-19-related cyber threats.
In addition, COVID-19 has necessitated many people to work from home in accordance with government regulations, including social distancing. Telework requires the adoption of personal computers, collaborative tools, and video conferencing tools—all of which have increased users’ vulnerability to cyberattacks. Some have gathered evidence that hackers are increasingly taking advantage of teleworking and thus pose increasing cybersecurity risks3. It is clear that COVID-19 has not only increased the number of cyberattacks but also brought new cybersecurity issues.
Cybersecurity Threats Related to COVID-19
Users’ increasing susceptibility to cyber threats during the pandemic has posed both technical and organizational challenges to enterprises’ security and risk management operations. To continue successful business operations, enterprises need to make greater efforts to mitigate cybersecurity risk and prevent data breaches. Cybersecurity efforts can be a combination of both social (with a focus on people) and technical aspects to inform cybersecurity operation and deliver security, which is referred to as a sociotechnical approach4. A sociotechnical approach to cybersecurity aims to provide insight into security issues and develop appropriate security measures by looking at how social and technical components can work in harmony for optimized cybersecurity performance.
From the social perspective, enterprises are suggested to educate their employees on COVID-19-related cyber threats and foster a culture of security. Educational training is the key to increasing the awareness of cybersecurity and enhancing employees’ security actions, which are considered short-term behaviors to improve performance within enterprises. Such training prepares employees to keep cybersecurity in mind as they follow best practices for responding to potential cyberattacks related to COVID-19. For example, enterprises can educate employees to recognize email scams that use COVID-19 themes by showing attack examples5. Enterprises can also educate employees to understand the importance of cybersecurity actions by showing some typical consequences of successful cyberattacks and the benefits of best practices in the cybersecurity era.
Workplace Culture
It is also important to create a strong cybersecurity culture that can help enterprises manage cybersecurity in the long term because some of the COVID-19-related cyberattacks are likely to continue after the pandemic. Developing ongoing education and training is definitely a good approach for creating a cybersecurity culture within enterprises, and it has been proven useful. There are also some other approaches to creating a sustainable cybersecurity culture by further understanding people’s decision-making and behaviors.
From a technical perspective, enterprises are suggested to keep all relevant systems functioning well by updating and upgrading IT tools, given that cyberattacks can evolve as long as the pandemic continues6. It is also important to install some advanced IT tools to respond to the new COVID-19-related cyberattacks, which minimizes systems’ risk to cyber threats. For example, enterprises may leverage some solutions into their business email systems to better recognize COVID-19-related email spams and provide alerts to users. Enterprises can also select and deploy a multifactor authentication solution to strengthen employees’ accounts against hacking and increase security, which has become more important than ever in the widespread teleworking necessitated by the pandemic.
The COVID-19 pandemic has certainly brought new challenges to many enterprises. IT security professionals and business leaders need to make more cybersecurity efforts to mitigate users’ risk of cyber threats by investing in both employees and technology in this new era.
References:
1. https://www2.deloitte.com/ng/en/pages/risk/articles/covid-19-impact-cybersecurity.html
2. https://www.interpol.int/en/News-and-Events/News/2020/INTERPOL-report-shows-alarming-rate-of-cyberattacks-during-COVID-19
3. https://www.nationaldefensemagazine.org/articles/2020/4/16/hackers-take-advantage-of-mass-teleworking
4. https://www.ncsc.gov.uk/blog-post/a-sociotechnical-approach-to-cyber-security
5. https://home.kpmg/xx/en/home/insights/2020/05/rise-of-ransomware-during-covid-19.html
6. https://www.uschamber.com/series/above-the-fold/the-evolution-of-cybersecurity-threats-during-covid-19-and-what-you-can-do
