Brad Gray, Senior Vice President APAC at Exclusive Networks shares how a mix of internet-connected devices and increased working from home could present cybersecurity headaches for firms
By: Qinthara Fasya, DigitalCFO Asia | 15 July 2021
Prior to the pandemic, nearly every employee would work on the corporate server in the workplace. Employees at home, on the other hand, have been working from their own personal networks, sometimes with no firewall and using outdated devices with unpatched software, providing gaps for hackers to exploit. Furthermore, the rising usage of the Internet of Things means that even seemingly benign equipment such as refrigerators, lights, fish tanks, and air conditioning units provide entry points for thieves to infiltrate the home network and ultimately the company’s networks. DigitalCFO Asia spoke with Brad Gray, Senior Vice President APAC at Exclusive Networks, on the importance of cybersecurity in enterprises’ digital transformation.
Do you believe it is critical for businesses to increase their cybersecurity activities, particularly in the Covid-19 era?
Cybersecurity has become more crucial than ever, especially in the Covid-19 era. Businesses’ operational risks are more diversified as their workforce started working from home amid lockdowns globally. The distributed workforce brought on additional problems for IT professionals as they had to figure out how to manage and support the digital transition for remote working, while tackling the problem of increasing cyber threats as criminals take advantage of the constantly changing situation surrounding the pandemic to launch attacks.
According to Crowdstrike’s 2021 Global Threat Report, more than half of organizations surveyed experienced a rise in ransomware attacks, or data extortion attempts, during the pandemic. Threat actors have been exploiting the panic and disruptions surrounding Covid-19 to launch social engineering attacks and targeted intrusions. These attacks are also increasing in scale as cyber criminals coordinate their attempts on high-value organizations in more organized manners.
As the pandemic drags on, companies are considering more flexible approaches to working and exploring the next wave of tech options for doing business. They will need to take on a more proactive approach to cybersecurity in order to protect their hybrid workforce who can work from anywhere and at any time.
With working from home now becoming the norm for many businesses, what are some of the vulnerabilities that are being overlooked?
As the popularity of smart devices increases, so is the prevalence of Internet of Things (IoT) hacking, where cybercriminals exploit vulnerabilities in unsecured devices to launch attacks. Smart home appliances such as fridges, air-conditioning units and security cameras are often pushed to the market with little security in mind or are not installed with proper security procedures in place. According to Palo Alto Networks’ report, 98% of all IoT device traffic are unencrypted.
As a result, these unsecured smart appliances provide ideal entry points for hackers, where they can easily jump from device to machines that are connected to corporate networks. Once they have gained access, they can quickly infiltrate entire networks at scale and put companies and their confidential data at risk.
These days, Bring Your Device (BYOD) programs are becoming popular with companies looking to save on expensive equipment while employees work from home. These policies assume that personal devices connected to Virtual Private Networks (VPN) will be secure. However, not all VPNs offer the same level of security and may leak logins, passwords and other credentials.
Human error is also one of the biggest vulnerabilities in cybersecurity. Social isolation during the work from home era has increased restlessness and emotional exhaustion among employees, according to the Harvard Business Review.
These employees become susceptible targets of hackers, who tailor their social engineering attempts to exploit the uncertainties surrounding the Covid-19 pandemic as well as the increased dependencies on the internet for work, play and shopping. The aim of cybercriminals is to gain low-level insider entry from which they can escalate to higher privileged access in the wider corporate network later on.
Disgruntled employees may pose a significant risk to companies as well as an insider threat. Driven by personal agendas, they misuse access to networks, applications and databases to steal sensitive information. They may also exploit their fellow workers, who can become unsuspecting participants in these phishing exploits, unintentionally causing damage to the company.
How can CFOs keep an eye on current hackers who try to break into a company’s network from the comfort of their own homes?
Cybersecurity is not just the responsibility of the IT department; CFOs need to be involved as well as the loss of confidential and sensitive data and other critical assets may pose huge financial and reputational risks for the company.
The key to cyber resilience is a risk management strategy before and after an attack. Proper identification and remediation of attacks are important as threats continue to evolve.
Given that a large proportion of cyber-related breaches occur as a result of human error, developing a set of cybersecurity standards with expected security protocols will help companies in detecting, controlling and minimizing damages from a cyber incident. This could include best practices such as getting risk assessments done, regularly backing up data as well as conducting simulation exercises to gauge preparedness.
Alongside these standards, companies should set up training programs to educate and encourage employees, who are companies’ first line of defense in any cybersecurity measure, to observe and implement basic cyber hygiene. This includes not reusing passwords across multiple sites and changing them regularly, and not opening every e-mail and attachment that they receive.
Advanced cybersecurity tools in the market which use artificial intelligence and machine learning are also available to help companies detect threats before they even occur. Security Orchestration, Automation and Response (SOAR) tools use data collected throughout the network to help organizations predict, monitor and contain these attacks, allowing companies to respond to security events in a timely manner without human assistance.
Why is it critical for CFOs to recognise the dangers of working from home without access to a corporate server, and what are some of the ways this may be avoided?
During the overnight transition to work from home as lockdowns around the world were implemented, many businesses have allowed their employees to access company information from their personal devices and home networks.
While this might be a quick and convenient solution during the rapid shift to remote working, it is not ideal for the long-term as these personal devices on home Wi-Fi networks often have weak to no security in place, or have security systems that are not regularly updated, resulting in network security gaps that leave organizations exposed to cyber attacks.
As the Covid-19 pandemic extends into the foreseeable future, companies will need to think of a long-term strategy to protect their distributed workforce. As business transformation and digitalization continue, companies should invest more in cybersecurity and not leave it as an afterthought. By having the right cybersecurity tools, as were mentioned earlier, and implementing proactive risk management strategies, CFOs can tackle cybersecurity risks and threats more efficiently and effectively.
How can businesses ensure the security of a distributed and remote workforce?
Protecting endpoint devices here is key. However, as cybercriminals become more sophisticated in their attempts, the typical anti-virus software alone is not enough to guard against the growing number of threats. This becomes even more challenging for businesses with a large and distributed workforce across the cloud.
What organizations can do to protect their employees effectively and efficiently is to use integrated solutions that will help reduce complexities and cost, while securing their remote and on-premises workforce at scale.
For example, the Spectra Alliance, a first-of-its-kind partnership between security companies CrowdStrike, Netskope, Okta and Proofpoint, provides a joint solution that protects all web, cloud and on-premises enterprise activities, enabling companies to adopt a Zero Trust security posture. These solutions not only improve the efficiency of businesses’ physical and digital security systems but also enable them to stay one step ahead of modern-day attacks.
COVID-19 has posed a variety of problems for Asian businesses, ranging from decreased sales to higher cleanliness and employee safety standards. Among all of this commotion, cybersecurity has begun to emerge as a significant concern in a variety of unexpected ways. According to the CrowdStrike Work Security Index, harmful assaults have increased 100X during the COVID-19 epidemic, with hackers and fraudsters – using hacking tools as cheap as $20 – taking advantage of the uncertainty to send phishing e-mails, malware, and other attacks. However, the widespread adoption of working from home has generated a number of new risks for businesses.
