Recent data from the Neustar International Security Council (NISC) found that the majority (61%) of cyber security professionals reported either significant or moderate downtime or disruption in the first six months of the COVID-19 pandemic, due to the mass shift to remote work.

A certain amount of this disturbance can be linked directly back to the level of change that was necessary to accommodate staff working from home, but there are also other influencing factors.

Unfortunately, while organisations were busy ensuring their digital networks were able to continue operating across all touchpoints, cyber criminals were capitalising on the disorder for their own gain.

Although we expected to see a spike in malicious activity while businesses were getting to grips with new ways of working, it has become much more than just a pandemic problem.

NETWORK WOES

It’s now been over a year since organisations were forced to implement mass remote working models and, during that time, businesses have adapted as necessary. In contempt of initial challenges, the roll-out of numerous modern technologies has established a new standard for network security. Or so we thought.

Despite having made these enhancements to their security stack, more than half of businesses (54%) admitted to still experiencing network security issues, six months after the pandemic began. While organisations have been brushing up on their defences, cyber criminals have been doing the same – using the time to sharpen their skills and find new ways to exploit weak network links; so far this year we’ve seen some of the largest and most powerful attacks on universities, healthcare networks and national critical infrastructure.

Just a few months ago, the largest fuel pipeline in the U.S was subject to a hack that led to shortages across the East Coast. Attackers gained access to the networks of Colonial Pipeline Co. through a virtual private network account, which allowed employees to remotely access the company’s computer network. Although the VPN account was no longer in use at the time of the attack, hackers were able to breach Colonial Pipeline’s entire network using just a compromised username and password.

The Colonial Pipeline attack is just one example of how determined cyber criminals are targeting weak points in networks to cause disruption and, in some cases, demand ransom. Regardless of how businesses have already improved their security since the pandemic began, the most important realisation is that there is still more to be done. It is essential, therefore, that organisations determine the vulnerabilities in their networks today and proactively plan to strengthen them.

OUT OF OFFICE RISKS
With many businesses planning to either remain remote or implement a hybrid working model, end-to-end network security will continue to be business critical. At the beginning of the pandemic, a major hurdle appeared because many companies did not provide computers for employees working from home prior to COVID-19, instead asking that they work from their own devices. This became immediately problematic for a few key reasons.

Firstly, security controls on personal devices are not the same as those on work devices. Secondly, it leads to blurred lines between professional and personal use – there is no logical separation between using the same device to work, watch Netflix, and shop online.

Employees using personal devices also complicates the use of VPNs, as most VPN software deployed establishes a VPN only for the specific business application. A VPN that connects to the company but comes from a machine that doesn’t have an insulated virtualisation operating system can result in multiple cases of bleed over. In fact, there is a large group of malwares that benefits from crossing that membrane within a machine.

PREPARING TO GO HYBRID
The new era of work is highlighting the need for organisations to invest more in strengthening their network security, and it seems the majority are already taking action.

Recent research from the NISC revealed that 79% of organisations have enhanced the security of their corporate VPNs over the last year, while 89% of security professionals said the challenges posed by the pandemic have boosted their organisation’s network security against potential future attacks.

Nevertheless, there is still more to be done. After gaining a better understanding of the vulnerabilities in their networks, businesses must turn their attention to always-on monitoring and mitigation solutions. As cyber criminals work to spot weak links in networks, businesses need to know that they have 24/7 protection. Only then can they have true peace of mind that they are doing everything they can to protect their network, and their organisation.