8 Tips for Cybersecurity Diligence in the Time of COVID-19

Most of the recent novel coronavirus (COVID-19) notifications that have gone out via email, websites, blogs, social media and the news are focused on the health, safety and well-being of people. However, with many businesses rapidly changing work habits, one thing that may not be understood is how the changes may affect their IT security.

For example, the use of remote access can create issues like split-tunnel VPNs and the use of personal devices on corporate VPN networks can expose customers to new attack vectors and vulnerabilities. Furthermore, businesses with compliance requirements such as the Health Insurance Portability and Accountability Act (HIPAA), Payment Card Industry Data Security Standard (PCI DSS) or General Data Protection Regulation (GDPR) must keep in mind that all of these laws still apply for remote workers during this pandemic.

With this in mind, businesses may need to review the changes to how employees are accessing and managing sensitive data. For instance, PCI DSS compliance has specific requirements for remote employees who are accessing cardholder data environments.

Now is the time for increased cybersecurity diligence in addition to the personal safety measures we are all taking. With more staff working remotely than ever before, here are some tips for IT professionals to secure their business' environment:

1. Ensure that users are protected against email-based threats through systems that scan links and attachments.
2. Ensure that any web-filtering technology is extended to remote users through endpoint protection solutions or full tunneling, rather than split-tunneling VPNs.
3. Ensure that all antimalware and antivirus software is up to date and that a solution is available that can enforce policies for remote access users.
4. Use strong authentication, including appropriate encryption, two-factor and single-sign-on methods.
5. Review user accounts for cases where passwords are set to not expire and implement systems to detect credential compromises for users on the dark web.
6. Engage in routine reviews of cybersecurity risk, compliance status and penetration testing of critical systems.
7. Perform external vulnerability scans to identify risks.
8. Review incident response plans to ensure that they account for remote workers accessing data from devices and internet connections that are not as secure as the corporate infrastructure.

Often users are the weak link in security, so here are some tips that IT leaders can share with them:

1. As always, don’t click on links from sources you don’t know. Doing so could download a virus onto your computer or device. The best practice is to type in URLs manually or search yourself, rather than to click on a link in an email.
2. Watch for emails claiming to be from the Centers for Disease Control and Prevention (CDC) or experts saying they have information about the virus. For the most up-to-date information about COVID-19, visit the CDC and the World Health Organization (WHO) websites.
3. Ignore online offers for vaccinations. If you see ads touting prevention, treatment or cure claims for COVID-19, ask yourself: If there’s been a medical breakthrough, would you be hearing about it for the first time through an ad or sales pitch?
4. Do your homework when it comes to donations, whether through charities or crowdfunding sites. Don’t let anyone rush you into making a donation. If someone wants donations in cash, by gift card or by wiring money, don’t do it.
5. Be alert to “investment opportunities.” The U.S. Securities and Exchange Commission (SEC) and Federal Trade Commission (FTC) are warning people about online promotions, including on social media, claiming that the products or services of publicly traded companies can prevent, detect or cure COVID-19, and that the stock of these companies will dramatically increase in value as a result of the current pandemic.

As we all face these challenging times together, it is unclear what the future holds, but with proactive measures we can make it a bit better. Our team remains available throughout this crisis to assist with cybersecurity, compliance and incident response needs. We hope that you and your organization stay healthy, safe and secure.