Things Keeping CISOs Up at Night During the COVID-19 Pandemic

Every cybersecurity professional knows that crisis often breeds threats. That said, the anecdotes we're seeing during the COVID-19 pandemic are uniquely frightening: health agencies getting attacked, growth in mass phishing operations, and the discovery of security flaws in leading communications platforms are just a few worth highlighting.  

As an IT professional myself, I set out to discover what was unique about the current threat landscape through discussions with cybersecurity professionals on the battlefield's front lines. After discussions with more than 20 CISOs, CEOs, CTOs, and security leaders, I found six recurring core themes worth highlighting. Some are obvious, some less so.

1. Lack of security at remote access sites. This is the most obvious. Nearly everyone who was working in an office is now working from home, which means there are many more endpoints to secure from potential attack, and exponentially more loose ends. Dr. Anton Chuvakin (security strategy leader at Google) puts it best: "A lot more access from a lot more places, a lot more BYOD, a lot more VPN, a whole lot of new permissions created and rules loosened." Policies, procedures, and new technologies must be rolled out at lightning speed to enable things like multifactor authentication, remote device monitoring, and rule sets for application utilization and email management. 

2. Safe access to on-premises infrastructure. For most of the enterprise universe that was not born in the cloud, the biggest industry worry has been around providing secure access to on-premises infrastructure, typically involving some type of remote VPN. However, most VPN solutions deployed were not designed for a 100% remote workforce, forcing many companies to increase bandwidth and get clever with network design. Bhargav Acharya (of Schellman & Co.) notes that he's seen "local VPN servers get overloaded with the sheer amount of traffic and network connections required for supporting such a large workforce."

3. Overly speedy digitization. Companies are cramming years of digitization capex into months, at times forcing them to overlook potential security risks. Cloudsine CEO Matthias Chin stated that this could "lead to higher chances of threats like DDoS, defacements, data breaches happening." When things are built quickly, it's more likely that holes exist.

4. Phishing. Lots of it. This is the most expected security issue to arise during any period of panic, and it's compounded by the fact that employees are working from home with fewer potential safeguards in place. Although phishing activity is always a threat that's constantly evolving, there has been a massive increase in COVID-19-specific phishing activity, and a period of panic can make people more susceptible to fraud or social engineering. Dr. Salvatore Stolfo of Allure Security has seen "a dramatic uptick in the number of COVID-19 scams, largely phishing campaigns and an onslaught of fake emails trying to trick people to click on links sending them to malicious sites to steal their credit card information and their credentials."

5. Increased cybersecurity vulnerabilities. Cybercriminals are most likely to attack when a firm's guard is down. Ron Abisi of Tala Security notes that his company is seeing "a 20% to 30% increase in Magecart and XSS attacks across the board," primarily targeting retail and e-commerce.

6. Issues with third-party applications. Everyone has read about the security issues that have been brought to light regarding Zoom. The unfortunate reality is that companies are scrambling to deploy third-party, cloud-based productivity tools, and are in turn exposing themselves to the same set of risks that exist within these applications. Companies may also not take into account the impact that third-party applications may have on their broader on-premises or hybrid network if deployed quickly, as many of these productivity tools can integrate with users' personal accounts and allow them to transmit private company data with ease.

The threat landscape is expansive and ever-changing, so this list is meant to function as a list of common themes rather than an exhaustive list of threats. If you'd like to read full, unabridged quotes from 11 professionals who shared on-record statements with us, check them out here.

Related Content:

A listing of free products and services compiled for Dark Reading by Omdia analysts to help meet the challenges of COVID-19.