Coronavirus (COVID-19) continues to escalate and is increasingly wreaking havoc on daily life. Where China and South Korea are starting to get back to normalcy. Regions like Europe, India and the USA are being progressively locked-down. The main precaution that is required to flatten the infected rate curve is to implement social distancing techniques. This essentially requires people to remain isolated from others as much as possible, and for those that can, this means working from home (WFH). For several years, the ability to use smart devices and the widespread availability of broadband and Wi-Fi has made it easy for many to carry out regular tasks from home or points of Wi-Fi presence such as coffee shops. Progressive enterprises have adopted the potential for workers to access enterprise networks remotely – whether on an occasional or even permanent basis. However, many organisations have not taken this step, rightly concerned about the sensitivity and security of enterprise data. In the midst of the coronavirus lockdown, many companies are rushing to implement WFH policies. Having many employees suddenly working remotely is a major challenge for an organization and presents numerous cybersecurity issues. Threats to WFH: 

• Unsecured Wi-Fi networks: Most workers will be using local Internet providers’ routers – many of which are secured neither at the hardware nor at the network level. Every time an employee connects to their corporate network from an unsecured Wi-Fi network, they’re creating possible access points for cybercriminals to exploit.
• Device security: As WFH has not been a conventional working culture in many organizations, most employees will have to use their own devices. These personal devices lack security tools, antivirus software and customized firewalls, which can increase the risk of malware and ransomware injection both on personal devices and corporate servers/cloud.
• A rapid increase in cybercriminal activity: The world’s priority is now focusing on personal safety and maintaining continuous business operations where possible. Consequently, attention on maximising cybersecurity can become a second-order priority. WFH leads to opening new attack vectors. Cybercriminals are leveraging the global panic and are increasing cyber scams and hacking attempts:

• • COVID-19 that is ransomware: An app that promises Android users can track coronavirus live cases and get alerts when someone nearby is diagnosed with the virus is tempting information. However, after installation a ransom note pops up on the screen “YOUR DEVICE IS ENCRYPTED: YOU HAVE 48 HOURS TO PAY 100$ in BITCOIN OR EVERYTHING WILL BE ERASED.”
  • COVID-19 map infected with ransomware: Cybercriminals are selling COVID-19 live interactive map as part of a Java-based malware deployment. The kit costs $200 to $700 (depending on the signing certificate). The user will likely share it with friends and family transmitting the ransomware.
  • Phishing attacks with coronavirus awareness: Cybercriminals keep track of the latest news to exploit it through phishing attacks. In the COVID-19 pandemic, a phishing attack was conducted on medical professionals. A link was sent through an email to join a mandatory seminar which was used to phish or capture the username and password of those working in hospitals.

Cybercriminals are on alert for vulnerable users, if they can target medical professionals, they will target anyone. There are no new lows that cybercriminals won’t stoop to.

 Solutions and Precautionary measures: 

• Two-factor authentication (2FA) and two-step verification (2SV): A strong password is not enough. Additional steps need to be used to provide an extra layer of security. This could be an email or text message confirmation, a biometric method such as facial recognition or a fingerprint scan, or something physical, such as a USB fob.
• Virtual Private Network (VPN): VPNs are sometimes used to bypass geographic restrictions on streaming sites and other location-specific content. They can also be used to improve online security as its unreadable to intercepts.
• Anti-virus Software and firewalls: In addition to enabling built-in firewalls in internet routers and within devices’ own operating system, additional anti-virus software and third-party firewalls offer extra layers of security.
• Secure Home router: Ideally, home owners should use a router with embedded hardware security. But even changing the default password can be a good first step, followed by enabling encryption to WPA2 or WPA3.
• Update and Patches: regularly update operating systems, anti-virus, and other software. These updates often include patches for vulnerabilities that have been uncovered.
• Data Backup: Ideally, hardware backups will be the solution. However, opting for cloud back up services can also work.

The WFH demands a more diligent and disciplined working culture from both employers and employees. Thinking twice before opening suspicious emails, regular system scanning when off duty and keeping an alert attitude can help this transition. Protecting data is the priority for every organization and adding strong security may be able to thwart most attacks. But securing every vulnerability fully is almost impossible. As cyber-crime is also a business, criminals will always take the line of least resistance, applying multiple security layers will make it more time consuming and costly for hackers meaning they’re more likely to move on to those that are less well protected.