Staying Secure in a COVID-19 World

Last Updated on March 10, 2023

Can we all agree that this is a strange, confusing, and stressful time to be living through? That none of us really know what’s going to happen, or what the future holds? 
While restaurants, airlines, cruise ships, and countless other businesses are struggling, there’s one group of people that don’t seem to be slowing down at all, and that’s cybercriminals. 
They’re exploiting this crisis and taking full advantage of people’s fear and panic, often causing untold damage in the process. 
We at Pivot Point Security have received countless calls from customers with questions about the changes that this COVID-19 pandemic has brought on. How do they stay safe? What should they be focused on? How do they keep their companies safe during these trying times? 
While I’m usually the host of the show, on this episode I put on my Pivot Point Security CISO hat to discuss a few of the biggest challenges I see companies navigating to stay safe in this current landscape. 
 

The Remote Workforce

While most companies have some sort of remote working policy, few are equipped to handle the kind of mass migration that we’re currently experiencing. 
If you’re a company that issues your employees desktops, you are suddenly faced with a unique challenge. How do you ensure that those people trying to access work from home are doing so in a safe and secure way on their home computers.


Because let’s face it, nobody is lugging a huge desktop computer home. So you’ve got to accommodate for that. 
It might be a NAC (Network Access Control) set up, which looks at the configuration of a machine before allowing it to connect to the corporate network.
Or it might be malware tools that scan a machine and ensure that it’s not infected with malware before accessing the network (because a lot of home computers are infected with an awful lot of malware.) 
You’re looking to maximize productivity and efficiency while minimizing the risk to the security of the organization.
 

Increased Social Engineering Attacks

The bad guys are called bad guys for a reason. They don’t miss a beat, and they’re sure not going to miss out on a chance to exploit mass fear and chaos. 
Already we’re seeing several COVID-19 themed attacks pop to the surface, and most of them look very legitimate. 
One of the most clever is a 3-page COVID-19 themed MS Office document from the “CDC.” It’s not actually from the CDC, but opening it brings up a very realistic looking MS login page, drops a back door onto a victim’s machine, then forwards you to the CDC, so most people won’t’ even know they’ve been duped. 

It’s an excellent forgery, and one that’s very well executed. 
In fact, since January of 2020, 4,000+ COVID-19 themed domains have been legally registered. 3% of those were found to be malicious, with another 5% found to be suspicious.

This means that 8%, or 320 COVID-19 informational websites out there are cause for concern. Ones that are likely trying to capitalize on fear and worry, with an end goal of stealing your identity or your money. 
 

Critical Vendors & the Supply Chain

In the midst of all of this, how do you handle the closing of vendors that you rely on? If you’re trying to keep your business safe and vendors that help you do that start shutting their doors, what do you do? 
Go through your list of vendors. 
Not EVERY vendor. But the dozen or so critical vendors that you depend on. 
Ask them questions. 
Things like, “Does your company have a business continuity plan in light of COVID? What is it?”

If they’re closing offices, find out which offices are closing, when they’re closing, and which services are going to be interrupted as a result of closing.

If they provide a cloud service, ask if they can scale to the capacity that is going to be required during a time when people are working from home at an exponentially higher rate than normal. 
Yes these are uncertain times. 
Nobody knows what’s going to happen, how long this may all last, or who all will be impacted as a result.

But one thing is for certain. With some diligence, you can help keep yourself and your company secure in these days when criminals are seeking to take advantage of the fear, uncertainty, and panic that seems to be running rampant. 
 
This post is based on an episode of The Virtual CISO Podcast, featuring John Verry. To hear this episode in its entirety, and many more like it, you can subscribe to The Virtual CISO Podcast here.
If you don’t use Apple Podcasts, you can find all our episodes here.