During the Covid-19 Pandemic, there has been a 600% increase in Email Phishing attacks.
This is another clear sign that fraudsters are extremely opportunistic, using whatever means possible to attack businesses. Since lockdown began, they have been taking advantage of the increased security risks that comes with huge numbers of people working from home, away from the full safety of the office environment.
Opening up a VPN tunnel to the office protects the traffic inside that tunnel from the outside world. Every time an employee does this, they are opening up a tunnel between their home and the business infrastructure. It’s likely that this weakness accounts for a large amount of this rise in cyber-attacks.
As we gradually move back into the office environment, staff will probably be moving back and forth from the office to homeworking. It’s therefore crucial to make sure that your security procedures and disaster recovery plans are up to date.
By now, your IT Department or provider should have carried out, or at least offered to carry out, an audit of anyone’s home PC if they aren’t using one provided by and built in line with the business and its IT policy.
Ask yourself the following:
- Has the employee’s PC got good anti-virus installed?
- If so, have the signatures been updated regularly and are they currently up to date?
- Is that PC used exclusively by the employee or do the rest of the family use it? (Gaming sites can be a regular source of malware and virus attacks).
- Is the PC on Windows 10? (Windows XP, Vista, 7 and 8.1 are all now unsupported by Microsoft and are therefore security risks).
REMEMBER: BACK UP YOUR DATA!
In the event of a cyber-attack, do you know for certain that your data is securely, regularly and (definitely worth double checking) successfully backed up? This is fundamental to being able to recover from certain types of attack. The most common malware attack is Ransomware, making up around 80-85% of all attacks. This type of attack usually emanates from an employee opening an Email attachment which then spreads to the internal company shared drives, encrypting all files and demanding a payment to enable you to unlock the files.
It is key to understand that Cyber Attacks are NOT just technology issues, they are business issues and need your attention.
Checklist
- Do I have a documented, regularly tested Business Continuity Plan?
- Do I know when that was last tested?
- Is my business reliant on any human intervention to work correctly (Tape loading, manual start process?)
- Do I know what my Recovery Time Objective (RTO) and Recovery Point Objective (RPO) is?
- When was the last time I had to recover anything from my backup solution, and was that recovery successful?
- Do I have an absolute guarantee that my backups are working correctly and are regularly checked?