The ongoing pandemic has created fresh challenges for many businesses with remote working becoming the new norm. Due to companies accelerating their digital transformation, cybersecurity has become cause for major concern. Neglecting the risks of cybersecurity issues presents companies with various operational, legal and compliance implications.

Despite this rise in the need for technology, it is evident that many organisations still do not provide a remote-working environment that is safe from cybercrime. Where business meetings have traditionally been held in-person, most now take place virtually. In Switzerland, cyberattacks more than doubled during April of 2020 compared to the previous year. This may be seen across many countries and a major cause for this increase is that individuals working at home do not enjoy the same level of inherent protection/deterrent measures from a working environment. A recent study by Tessian shows that 47% of individuals fall for a phishing attack while working remotely.

Cyber-attackers have been perceiving this pandemic as simply an opportunity to increase their criminal activities by exploiting the vulnerability of employees working from home and capitalizing on people’s strong interest in coronavirus-related news, such as malicious fake coronavirus related websites. In fact, since January 2020 more than £11 million have been lost due to COVID-19 scams.

Another interesting fact is that from February till May 2020 more than half a million people globally were affected by breaches in which the personal data of video conferencing users was stolen and sold on the dark web. To execute such attacks, they use the technique known as ‘OpenBullet’ to steal user credentials and gain access to confidential data which is then sold to other cybercriminals. Such information may be used to demand a sort of ransom from the companies, or else be released to the public in order to damage the company’s reputation.

Moreover, many small and medium sized companies have adopted a Bring Your Own Device (BYOD) approach whereby employees use their personal devices to access corporate information. This results in users being much more exposed to cyberattacks and is another reason for the recent spike in cybercrime. Even with the security of Mobile Device Management (MDM) solution, accessing corporate files and data from personal devices remotely does not guarantee the same level of cybersecurity as an office environment. For example, employees may not run an antivirus or anti-malware scan regularly, if at all. One reason for this is that a home working environment does not have sophisticated enterprise prevention and detection measures. Additionally, home Wi-Fi networks are much easier to attack.

In 2020, the percentage of previously unseen malware and cyberattack methods increased to 35%, up from an average of 20% in pre-pandemic times. Some of the new attacks now also use a form of machine learning which adapts to its environment and remains undetected. Phishing attacks are also becoming more sophisticated and using different channels such as SMS and voice (vishing). A lot of these attacks are also exploiting news about vaccine developments. On the other hand, ransomware attacks are becoming more sophisticated, with hackers combining data leakage attacks with ransomware to persuade victims to pay the ransom.

Most small businesses are not equipped to deal with the risks of such cybercrime, since cybersecurity was not always a key priority in the fast deployment of remote working capabilities. However, there are various ways in which companies can implement essential cybercrime mitigation measures. To begin with, employees should be provided with a licence for antivirus and malware software to be used on all their personal devices. Employees must also be trained on the best practices and procedures when sending and receiving emails or uploading data to the cloud. Moreover, Virtual Private Networks (VPNs) also add an extra layer of protection when using home internet, while setting up a home WIFI network with a strong password also helps.

Furthermore, businesses should run frequent tests to identify any weak spots and patch the most critical vulnerabilities. Continuously reviewing all systems and IT procedures is vital to evaluate exposure to cybersecurity risk and determine whether existing controls are sufficient.