By all indications, the COVID-19 pandemic has also triggered an increase in phishing and other attacks on government and other U.S. networks. Between Jan. 1 and Oct. 5, the United States had more malicious files detected by cybersecurity tools than any other country, according to McAfee.
In April, less than a month after many American workers were sent home to work, the Department of Homeland Security’s Cybersecurity and Infrastructure Agency (CISA) issued an alert warning of an increase in phishing attacks, most connected to emails about COVID-19.
Although federal workers are regularly trained to recognize these sorts of attacks, it’s human nature to think that you’re an expert in something after a few training sessions. It’s also human nature to become complacent about keeping those skills sharp when the training is over.
Combine human nature with the rapid, unexpected and unsettling change in office environments for many federal workers, plus a deeply stressful and distracting situation in the rest of the world, and staying on top of cybersecurity efforts becomes even more critical.
Maintaining a cybersecurity-focused culture that includes all employees, not just the IT staff, is one step.
Agencies must help employees remember, even as they work in sweatpants and with cats on their keyboards, that they are still on the front line of the battle against hacks and intrusions — and that their work is as critical as that of the security experts.
Cybersecurity Risks Go Up with So Many Remote Workers
Moving the workflow from a secure, contained office environment to one based on potentially nonsecure, home-based networks — expanding endpoints exponentially — increases the risk that existing cybersecurity vulnerabilities may be exacerbated, or new ones occur.
And cybersecurity vulnerabilities can remain undetected for years, often coming to light only once an organization suffers a data breach, after which the damage is already done. So agencies must evaluate their ongoing work-from-home environment, and close security gaps in ways that still allow employees to be productive.
At CDW•G, we’ve stepped up the security-related conversations we have with our federal customers, especially those with remote end users who are working in a new security environment. If they were working on a secure network on a military base, we need to make sure that they’re as secure at their dining room tables as they were in the office.
The education hasn’t changed; it’s just expanded. And the kinds of attacks haven’t changed; they’ve just increased. Malicious actors know that people are working from home and may have let their guard down or have their attention more divided than ever.
Remote workers have no doubt seen an increase in the number of emails they receive in general — those conversations that took place over the top of a cubicle divider now happen electronically. In addition, e-commerce sales have jumped by 31.8 percent this year, meaning that most inboxes now also contain a host of “Your Order Has Shipped!” missives.
The malicious actors are hoping you forget you didn’t order that jigsaw puzzle, or they want you to think the message is from the director-general of the World Health Organization with a COVID-19 update (a real tactic mentioned in the CISA alert). They’ve honed their skills enough that it might take five or six read-throughs of the email before you realize it’s fake, and even then, you still might not spot it.
Educating Users on Security Remains Key
So now that agencies are past the emergency startup phase of the work-from-home experiment, they’re well into the troubleshooting and security portion. Education remains key, no matter where the workforce is based or what tools they’re using. We undergo this education at CDW•G, and we can help our federal partners learn to use similar knowledge to protect themselves.
Widespread work-from-home is going to be an option for the foreseeable future, and agencies must ensure they don’t leave themselves open to attack in this new, possibly permanent context
