Cybersecurity in the COVID-19 Era: Remote Work Threats

The Current Situation and Its Impact on Cybersecurity

The number of COVID-19 cases and the death toll attributable to the virus steadily increased across the country in the months following the pandemic's onset, and companies of all sizes and types were hammered by a combination of a turbulent presidential election, an unrelenting economic downturn, growing civil unrest, and increasingly severe climate-related events that produced some of the worst unemployment rates in the country's history. While the situation remained highly dynamic and global case numbers continued to swell, at the time of this writing more than 40 million people worldwide had been infected by the virus and more than 1.5 million had died from it, based on statistical data compiled daily by Johns Hopkins University. From a strictly pragmatic perspective, one of the few bright spots on the economic horizon had been the growing demand for the accelerated domestic manufacture of personal protective equipment and therapeutic drugs by local, state, and federal government agencies (Meredith, 2020).

Against this grim backdrop, it is not surprising that the situation for cybersecurity also became increasingly challenging and threatening. According to Martinelli and Friedman (2020), "There have been several reports from the [information technology] community that there have been more attacks against cybersecurity infrastructures than in the past few years. Indeed, cybersecurity was a persistent threat before COVID-19, and not surprisingly, organizations continue to face increasing risks in this area" (p. 60). Unfortunately, although the risks associated with IT resources continued to accelerate, there was not generally a corresponding response on the part of the information security community.

A growing body of research confirms that nature imbues many predators with the ability to detect fear, and the current situation is analogous with respect to hackers sensing opportunity among their traditional prey. This sense of opportunity may help account for the increased cyberattacks experienced by the private and public sectors, but the threat had always been present — it simply became more intensified. One mainstream newspaper warned its readers that:

"The COVID-19 pandemic has changed our daily lives and routines dramatically. However, it seems that hackers remain undaunted and are still up to their old tricks, as the number of coronavirus-themed scams and security incidents related to it has been increasing steadily since January [2020]. Hackers are preying on people's fears by spreading disinformation and monetizing panic." (COVID-19 pandemic has hackers working OT, 2020, p. 13)

Given the enormous mental health burden exacted by the ongoing pandemic, these cautions are well timed and on point. Hackers and other malevolent actors — commonly referred to as "advanced persistent threat actors" — are also specifically targeting essential workers. National security authorities in the United Kingdom and the United States issued alerts warning public and private sector leaders that "actors are actively targeting organizations involved in both national and international COVID-19 responses [including] healthcare bodies, pharmaceutical companies, academia, medical research organizations, and local governments. Advanced persistent threat actors frequently target organizations to collect bulk personal information, intellectual property, and intelligence" (Martinelli & Friedman, 2020, p. 60).

What is known with certainty is that IT risk managers are confronted with many of the same cyber threats that emerged in recent years, together with novel applications that are successfully exploiting COVID-19-related fears and anxieties. In this regard, Martinelli and Friedman (2020) report that, "Despite the global pandemic, threat-actors continue to pose threats that require an internal audit to assess the organization's risk management program" (p. 60). Unfortunately, internal audits represent only part of the overall strategy needed to counter the growing threat from hackers and other state and non-state actors (Martinelli & Friedman, 2020).

In response to these emerging threats, the U.S. Department of Homeland Security Cybersecurity and Infrastructure Security Agency (CISA) and the United Kingdom's National Cyber Security Centre (NCSC) collaborated to formulate an appropriate strategy. The joint CISA-NCSC Alert (hereinafter "the Alert") was released in early April 2020 as reports of cybersecurity threats began to surge following the onset of the pandemic. The Alert provides the following timely guidance concerning malicious cyber activity specifically related to COVID-19:

• APT actors are actively targeting organizations involved in both national and international COVID-19 responses, including healthcare bodies, pharmaceutical companies, academia, medical research organizations, and local governments.
• Advanced persistent threat (APT) actors frequently target organizations in order to collect bulk personal information, intellectual property, and intelligence that aligns with national priorities.
• The pandemic has likely raised additional interest for APT actors to gather information related to COVID-19 — for example, to obtain intelligence on national and international healthcare policy or to acquire sensitive data on COVID-19-related research.
• CISA and NCSC are currently investigating a number of incidents in which threat actors are targeting pharmaceutical companies, medical research organizations, and universities. APT groups frequently target such organizations to steal sensitive research data and intellectual property for commercial and state benefit.
• These organizations' global reach and international supply chains increase their exposure to malicious cyber actors. Actors view supply chains as a weak link that can be exploited to gain access to better-protected targets. Many supply chain elements have also been affected by the shift to remote working and the new vulnerabilities that have resulted.
• CISA and NCSC have seen APT actors scanning the external websites of targeted companies and looking for vulnerabilities in unpatched software. Actors are known to take advantage of Citrix vulnerability CVE-2019-1978 and vulnerabilities in virtual private network (VPN) products from Pulse Secure, Fortinet, and Palo Alto.
• CISA and NCSC are actively investigating large-scale password spraying campaigns conducted by APT groups targeting healthcare entities in multiple countries, including the United Kingdom and the United States, as well as international healthcare organizations.
• Previously, APT groups have used password spraying to target a range of organizations across sectors — including government, emergency services, law enforcement, academia, financial institutions, and telecommunications and retail companies (Alert AA20-126A, 2020).

There has also been a corresponding decrease in the number of IT employment opportunities available from American employers for prospective graduates and non-graduates alike. A recent editorial in The Washington Post cautioned that "the most talented scientists and computer engineers of the next generation are choosing Canada, Australia, China — anywhere but [the United States]" (Trump's America in 2024, 2020, para. 4).

Beyond these challenges, organizations with dedicated cybersecurity infrastructures are also scrambling to find ways to budget for the increased costs of maintaining order within both their organizations and their information security (InfoSec) teams. While every organization's cybersecurity situation is unique, many if not most have experienced various types of threats — including some that have only recently been deployed (Lanz & Sussman, 2020). Public and private sector organizations are thus facing not only conventional IT-related threats but also an expansion in their scope and severity, further exacerbating the current situation (Lanz & Sussman, 2020).

These trends mean that there is no room for complacency. IT security professionals must not only remain vigilant for known threats but also continuously survey the horizon for newly emerging threats. As Lanz and Sussman (2020) caution, "This understandable change in focus must still consider an environment more conducive to computer-facilitated frauds and increased cyber-threats" (p. 28). The harsh reality is that the nature of cybersecurity threats has changed and expanded substantively in recent years, and most especially in the months following the onset of the COVID-19 global pandemic.

Cybersecurity experts also warn that computer-facilitated frauds and increased cyber-threats have been further enabled by the proliferation of unstructured data of all types (Schultz, 2009). Unstructured data can refer to virtually any type of digitized document, including video files, graphic presentations, blueprints, and images. Regardless of the type of electronic information involved, these resources are highly vulnerable to unauthorized access, manipulation, and even destruction by malicious actors (Schultz, 2009). This is an especially important concern since the vast majority — over 85% — of all business information is stored in an unstructured data format. As Schultz (2009) concludes, "To make matters worse, the amount of unstructured data within companies is still growing. With email and file services being the biggest contributors, more and more information is becoming available electronically and easy to share" (p. 5). While unauthorized access to unstructured and other sensitive data cannot always be prevented, there are straightforward steps that can be taken to ensure that maximum cybersecurity controls are in place.

References

Alert AA20-126A. (2020, May 5). Cybersecurity & Infrastructure Security Agency. Retrieved from

COVID-19 Cyber threat exploitation. (2020). National Cyber Security Centre. Retrieved from

COVID-19 pandemic has hackers working OT. (2020, April). USA Today, 148(2899), 13.

Davis, S. (2010, November 25). Effective training and policy takes the fear out of social networking. Illinois Institute of Technology White Paper: Author.

Lanz, J. & Sussman, B. I. (2020, June). Information security program management in a COVID-19 world. The CPA Journal, 90(6), 28.

Martinelli, M., Friedman, A. E. & Lanz, J. (2020, June). The impact of COVID-19 on internal audits. The CPA Journal, 90(6), 60.

Meredith, S. (2020, October 22). Learn to live with the pandemic: Physicians warn that a vaccine may not prevent Covid from becoming endemic. CNBC. Retrieved from

Mookerjee, V., Mookerjee, R., Bensoussan, A. & Yue, W. T. (2011, April 8). When hackers talk: Managing information security under variable attack rates and knowledge dissemination. Information Systems Research, 22(3), 410–420.

Mutune, G. (2019, August). Ten essential cybersecurity controls. CyberExperts. Retrieved from https://cyberexperts.com/cybersecurity-controls/.

Petrick, B. (2020, September). Stymie hackers with these six steps. Journal of Accountancy, 230(3), 79–83.

Schultz, A. (2009, December 23). Controlling the emerging data dilemma: Building policy for unstructured data access. Illinois Institute of Technology White Paper: Author.

Trump's America in 2024. (2020, October 23). The Washington Post. Retrieved from https://www.washingtonpost.com/opinions/trumps-america-in-2024/2020/10/23/f7be173a-14a6-11eb-bc10-40b25382f1be_story.html.