Businesses re-opening in the UK could be at risk of cyberattacks as they attempt to get back to work. Organisations need to be prepared and implement proactive, not reactive, cybersecurity processes.

Cyber criminals will almost certainly try to capitalise on weaknesses in both a company’s technology and the way in which it operates, especially in companies that have been forced to suspend operations for a period of time. Businesses will be under pressure to get back to normal and to begin regenerating revenue, but they need to make sure that the necessary measures are put in place to avoid falling victim to a cyberattack.

Current Threats

We have detailed below common threats that companies need to be wary of when they start to resume normal workingpractices.

Phishing and Ransomware

Research has shown that there has been a 600% rise in the number of phishing emails worldwide, usingCoronavirus-related themes to target individuals and businesses by exploiting concerns over the pandemic.

There is also evidence that ransomware attacks have increased due a higher likelihood of users clicking onCOVID-19 themed ransomware emails given levels of anxiety.

HMRC / Government Scams

Emails and text messages telling taxpayers that they can claim tax refunds and goodwill payments or areeligible to pay a fine are becoming more frequent. HMRC, and other Government bodies, do not communicatewith individuals by email or by SMS, unless you have signed up to the relevant protocol with them.

Certainly, payments that can be claimed by taxpayers, refunds or fines are not dealt with in this way.

Video Conferencing

The use of video conferencing platforms has increased significantly within a business environmentthroughout the pandemic, largely due to businesses adapting to remote working and relying on videoconferencing platforms to conduct meetings.

While these platforms are useful in aiding business continuity, the rapid uptake has given rise tocertain data protection concerns and several of the platforms have been subject to security attacksaffecting many users.

Post COVID-19, it is expected that video conferencing will continue to play an important role inbusiness, enabling associates to hold meetings, saving extensive travel.

Cost cutting

An organisation’s Post COVID-19 pandemic strategy might include reducing money spent on operationsconsidered as non-critical which may include cybersecurity. This short-term plan might however proveto be detrimental to the business in the long run as this could increase the impact of attacks onthe organisation.

Steps businesses should take before employees return to work

• Now is a good time to map the entire I.T. infrastructure to find security holes. For example, servers and ports can be left unintentionally open to the internet and therefore are open to attack. Cybercriminals often rely on businesses not knowing their entire I.T. estate and these access points
• Ensure detection and alerting capabilities are functional
• Educate employees on how to spot suspicious emails and messages to ensure they do not open attachments, reply to emails or texts, click on links or call phone numbers that may be fraudulent
• Advise employees that they should never provide any personal or financial details via text, email or phone unless they are 100% sure of the recipient
• Be more cautious in the configuration of email phishing controls. Flag emails that are external to the organisation to make it easy for employees to report suspicious emails
• Ransomware can overwrite incremental and other online backups. Take regular, full system backups of your servers, databases and make sure you confirm the validity of those backups
• Consider an additional archive copy of key servers and data sets that are stored off-line or in a form that cannot be tampered with by a criminal who acquires domain administrator rights
• Encourage separation between personal and corporate devices; employees can use their own devices for personal email and browsing activity
• Follow the Tips for Video Conferencing, recently published by the Data Protection Commission (DPC), which sets out how businesses should seek to comply with the EU General Data Protection Regulation (GDPR) when utilising video conferencing services
• Physical security devices like CCTV and biometric scanners which are used to protect the office should be monitored and checked more closely than before for anomalies and tampering.

Businesses and individuals now have to be vigilant to protect their organisation as lockdown eases and they gradually get back to business as usual; taking the Government’s “Stay Alert” advice from an I.T. perspective.

For more information, please contact us on contact@claritas-solutions.com.