New guidance on dealing with malicious attacks as increased home working raises breach concerns

The increase in home working as a result of the Covid-19 pandemic has posed significant security-related challenges for many businesses, so there’s good news in the form of international guidance on uncovering and remediating malicious cyber-attacks.

Despite growing awareness of the threats posed by cyber criminals, data breaches are still occurring on a daily basis around the globe at alarming rates. Here are just three examples of recent breaches and the impact they are having on the organisations affected:

• Newcastle University has been held to ransom after cyber criminals hacked into its systems. The university has warned staff and students that it will take weeks to recover from the recent breach, with most university systems unavailable or restricted indefinitely. The incident happened as the university was preparing for the start of the new academic year when online services are expected to play a key part as remote students log-in to attend classes and receive assignments. It is believed that the attack was carried out by the DoppelPaymer group which has begun posting documents it claims to have stolen from the university servers
• Private details relating to more than 50,000 letters sent out by banks and local authorities were indexed by Google after a London-based outsourcing firm, Virtual Mail Room, left its system exposed to hackers. The details ranged from insolvency to final reminders of unpaid council tax and affected people in UK, US and Canada. The firm works for high profile clients including Metro Bank, the publisher Pearson and insolvency specialist Begbies Traynor, so the breach is likely to have a damaging effect on its reputation and business relationships
• BancoEstado, one of Chile’s three biggest banks, was forced to shut down all branches in early September following a ransomware attack that took place over a weekend. The bank’s internal network is reported to have been infected with the REvil (Sodinokibi) ransomware

To exacerbate matters, the post-pandemic working from home culture poses a whole range of cybersecurity challenges to organisations that are likely to result in even greater numbers of data breaches unless they are successfully addressed. 

The security challenges of the new normal

The new normal of home remote working has seen an unprecedented reliance on technology to keep us connected to employers, employees, partners and suppliers. Videoconferencing, messaging platforms and mobile devices have kept operations running for businesses of all sizes and in all sectors.

However, enabling employees to work from home has significantly increased the surface of attack for companies. It’s particularly the case for all those who are now spending far more time working on non-trusted home networks, which are not protected by corporate cybersecurity solutions. The reality is that our home networks – which include our home broadband and any personal devices we may need to use for work purposes – do not include the same, robust enterprise-grade cybersecurity we’ve come to expect in the office.

Security professionals have responded to the pandemic by quickly instituting measures to maintain business continuity and protect against new cyber threats. To manage continuity, they have been patching remote systems over virtual private networks (VPNs) that have strained under increased loads. They have been monitoring spiking threat levels, including a near-sevenfold increase in spear-phishing attacks since the pandemic began, as social engineering tactics become even more effective on a distracted and vulnerable workforce.

All of this means that critical business assets and functions are significantly more exposed to opportunistic and targeted cyber-attacks by criminals seeking to exploit vulnerabilities and plant seeds for future attacks.

To address these concerns organisations must consider ways to extend corporate network safety to employees’ homes, particularly given the increased reliance upon remote working. This can be achieved, for example, by providing access to routers and/or technology capable of detecting security threats in real-time on employees’ home networks and providing an automated way to immediately respond to threats in a way that prevents other devices on the network from being compromised.

It is inevitable, however, that many organisations will still suffer data breaches as a result of the home working culture, so the real question is how best to handle these. 

Uncovering and remediating malicious activity

The UK’s National Cyber Security Centre (NCSC) has teamed up with the US’s Cybersecurity and Infrastructure Security Agency (CISA), the Australian Cyber Security Centre, the New Zealand National Cyber Security Centre and CERT NZ, and the Canadian Communications Security Establishment to issue guidelines on how organisations can stay safe from malicious cyber-attacks.

The joint cybersecurity advisory ‘Technical Approaches to Uncovering and Remediating Malicious Activity’ contains a series of technical approaches that organisations can take to protect their most critical digital assets. The approaches, based on best practices, can help to uncover malicious activity and mitigate attacks - if followed. 

Key takeaways from the advisory include a recommendation to respond to any potential cyber-incidents by first collecting relevant artifacts, lots and data and removing them for further analysis. 

Organisations are further advised to avoid tipping off any cyber-adversaries that their presence had been detected on the network and to contemplate seeking help from a third-party IT security organisation. 

The guidance also provides general recommendations and best practices to follow prior to a security incident actually taking place, since properly implemented defensive techniques and programmes can make it more difficult for a criminal to gain access to a network and remain undetected. Educating staff on what to look out for while working from home or in the office is seen as a key plank in increasing an organisation’s resilience and preventing easily avoidable compromises.

In addition to this new guidance, cybersecurity training courses will provide you with the necessary skills and expertise to help in detecting and containing cybersecurity breaches.