Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

4/30/2020
03:00 PM
Connect Directly
LinkedIn
RSS
E-Mail vvv
100%
0%

Things Keeping CISOs Up at Night During the COVID-19 Pandemic

Insights from discussions with more than 20 CISOs, CEOs, CTOs, and security leaders.

Every cybersecurity professional knows that crisis often breeds threats. That said, the anecdotes we're seeing during the COVID-19 pandemic are uniquely frightening: health agencies getting attacked, growth in mass phishing operations, and the discovery of security flaws in leading communications platforms are just a few worth highlighting.  

As an IT professional myself, I set out to discover what was unique about the current threat landscape through discussions with cybersecurity professionals on the battlefield's front lines. After discussions with more than 20 CISOs, CEOs, CTOs, and security leaders, I found six recurring core themes worth highlighting. Some are obvious, some less so.

1. Lack of security at remote access sites. This is the most obvious. Nearly everyone who was working in an office is now working from home, which means there are many more endpoints to secure from potential attack, and exponentially more loose ends. Dr. Anton Chuvakin (security strategy leader at Google) puts it best: "A lot more access from a lot more places, a lot more BYOD, a lot more VPN, a whole lot of new permissions created and rules loosened." Policies, procedures, and new technologies must be rolled out at lightning speed to enable things like multifactor authentication, remote device monitoring, and rule sets for application utilization and email management. 

2. Safe access to on-premises infrastructure. For most of the enterprise universe that was not born in the cloud, the biggest industry worry has been around providing secure access to on-premises infrastructure, typically involving some type of remote VPN. However, most VPN solutions deployed were not designed for a 100% remote workforce, forcing many companies to increase bandwidth and get clever with network design. Bhargav Acharya (of Schellman & Co.) notes that he's seen "local VPN servers get overloaded with the sheer amount of traffic and network connections required for supporting such a large workforce."

3. Overly speedy digitization. Companies are cramming years of digitization capex into months, at times forcing them to overlook potential security risks. Cloudsine CEO Matthias Chin stated that this could "lead to higher chances of threats like DDoS, defacements, data breaches happening." When things are built quickly, it's more likely that holes exist.

4. Phishing. Lots of it. This is the most expected security issue to arise during any period of panic, and it's compounded by the fact that employees are working from home with fewer potential safeguards in place. Although phishing activity is always a threat that's constantly evolving, there has been a massive increase in COVID-19-specific phishing activity, and a period of panic can make people more susceptible to fraud or social engineering. Dr. Salvatore Stolfo of Allure Security has seen "a dramatic uptick in the number of COVID-19 scams, largely phishing campaigns and an onslaught of fake emails trying to trick people to click on links sending them to malicious sites to steal their credit card information and their credentials."

5. Increased cybersecurity vulnerabilities. Cybercriminals are most likely to attack when a firm's guard is down. Ron Abisi of Tala Security notes that his company is seeing "a 20% to 30% increase in Magecart and XSS attacks across the board," primarily targeting retail and e-commerce.

6. Issues with third-party applications. Everyone has read about the security issues that have been brought to light regarding Zoom. The unfortunate reality is that companies are scrambling to deploy third-party, cloud-based productivity tools, and are in turn exposing themselves to the same set of risks that exist within these applications. Companies may also not take into account the impact that third-party applications may have on their broader on-premises or hybrid network if deployed quickly, as many of these productivity tools can integrate with users' personal accounts and allow them to transmit private company data with ease.

The threat landscape is expansive and ever-changing, so this list is meant to function as a list of common themes rather than an exhaustive list of threats. If you'd like to read full, unabridged quotes from 11 professionals who shared on-record statements with us, check them out here.

Related Content:

A listing of free products and services compiled for Dark Reading by Omdia analysts to help meet the challenges of COVID-19. 

Dennis Thankachan is the founder and CEO of Lightyear, a web platform that helps businesses comparison shop for IT infrastructure services (internet access, VoIP, managed services, etc.). He regularly writes on various IT infrastructure and telecom topics here. Dennis is ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
RyanSepe
100%
0%
RyanSepe,
User Rank: Ninja
4/30/2020 | 6:14:46 PM
Theoretical vs. Applied
This pandemic has highlighted many shortcomings that we have been aware of for quite some time. Technology has paved the landscape to the point where you do not need to be located in the same state as your company or be in the office 24x7. There are many financial benefits for the company to have a remote workforce as well as security benefits with VDI and other remote access mechanisms.

The reason we are experiencing detriments is because the pandemic has forced us to go all in before we were ready and it is due to a lack of proactivity. Similar to when "the cloud" first came out. Companies were hesitant, decided to make the change and go for 100% cloud failed and complained about it. We need to start planning more effectively. Operating under an idea that its not a matter of if but when certain events will happen. We would be much better off.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 6/4/2020
Abandoned Apps May Pose Security Risk to Mobile Devices
Robert Lemos, Contributing Writer,  5/29/2020
How AI and Automation Can Help Bridge the Cybersecurity Talent Gap
Peter Barker, Chief Product Officer at ForgeRock,  6/1/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: What? IT said I needed virus protection!
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-13768
PUBLISHED: 2020-06-04
In MiniShare before 1.4.2, there is a stack-based buffer overflow via an HTTP PUT request, which allows an attacker to achieve arbitrary code execution, a similar issue to CVE-2018-19861, CVE-2018-19862, and CVE-2019-17601. NOTE: this product is discontinued.
CVE-2020-13849
PUBLISHED: 2020-06-04
The MQTT protocol 3.1.1 requires a server to set a timeout value of 1.5 times the Keep-Alive value specified by a client, which allows remote attackers to cause a denial of service (loss of the ability to establish new connections), as demonstrated by SlowITe.
CVE-2020-13848
PUBLISHED: 2020-06-04
Portable UPnP SDK (aka libupnp) 1.12.1 and earlier allows remote attackers to cause a denial of service (crash) via a crafted SSDP message due to a NULL pointer dereference in the functions FindServiceControlURLPath and FindServiceEventURLPath in genlib/service_table/service_table.c.
CVE-2020-11682
PUBLISHED: 2020-06-04
Castel NextGen DVR v1.0.0 is vulnerable to CSRF in all state-changing request. A __RequestVerificationToken is set by the web interface, and included in requests sent by web interface. However, this token is not verified by the application: the token can be removed from all requests and the request ...
CVE-2020-12847
PUBLISHED: 2020-06-04
Pydio Cells 2.0.4 web application offers an administrative console named “Cells Console� that is available to users with an administrator role. This console provides an administrator user with the possibility of changing several settings, including the applicat...