Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

03:00 PM
Connect Directly
E-Mail vvv

Things Keeping CISOs Up at Night During the COVID-19 Pandemic

Insights from discussions with more than 20 CISOs, CEOs, CTOs, and security leaders.

Every cybersecurity professional knows that crisis often breeds threats. That said, the anecdotes we're seeing during the COVID-19 pandemic are uniquely frightening: health agencies getting attacked, growth in mass phishing operations, and the discovery of security flaws in leading communications platforms are just a few worth highlighting.  

As an IT professional myself, I set out to discover what was unique about the current threat landscape through discussions with cybersecurity professionals on the battlefield's front lines. After discussions with more than 20 CISOs, CEOs, CTOs, and security leaders, I found six recurring core themes worth highlighting. Some are obvious, some less so.

1. Lack of security at remote access sites. This is the most obvious. Nearly everyone who was working in an office is now working from home, which means there are many more endpoints to secure from potential attack, and exponentially more loose ends. Dr. Anton Chuvakin (security strategy leader at Google) puts it best: "A lot more access from a lot more places, a lot more BYOD, a lot more VPN, a whole lot of new permissions created and rules loosened." Policies, procedures, and new technologies must be rolled out at lightning speed to enable things like multifactor authentication, remote device monitoring, and rule sets for application utilization and email management. 

2. Safe access to on-premises infrastructure. For most of the enterprise universe that was not born in the cloud, the biggest industry worry has been around providing secure access to on-premises infrastructure, typically involving some type of remote VPN. However, most VPN solutions deployed were not designed for a 100% remote workforce, forcing many companies to increase bandwidth and get clever with network design. Bhargav Acharya (of Schellman & Co.) notes that he's seen "local VPN servers get overloaded with the sheer amount of traffic and network connections required for supporting such a large workforce."

3. Overly speedy digitization. Companies are cramming years of digitization capex into months, at times forcing them to overlook potential security risks. Cloudsine CEO Matthias Chin stated that this could "lead to higher chances of threats like DDoS, defacements, data breaches happening." When things are built quickly, it's more likely that holes exist.

4. Phishing. Lots of it. This is the most expected security issue to arise during any period of panic, and it's compounded by the fact that employees are working from home with fewer potential safeguards in place. Although phishing activity is always a threat that's constantly evolving, there has been a massive increase in COVID-19-specific phishing activity, and a period of panic can make people more susceptible to fraud or social engineering. Dr. Salvatore Stolfo of Allure Security has seen "a dramatic uptick in the number of COVID-19 scams, largely phishing campaigns and an onslaught of fake emails trying to trick people to click on links sending them to malicious sites to steal their credit card information and their credentials."

5. Increased cybersecurity vulnerabilities. Cybercriminals are most likely to attack when a firm's guard is down. Ron Abisi of Tala Security notes that his company is seeing "a 20% to 30% increase in Magecart and XSS attacks across the board," primarily targeting retail and e-commerce.

6. Issues with third-party applications. Everyone has read about the security issues that have been brought to light regarding Zoom. The unfortunate reality is that companies are scrambling to deploy third-party, cloud-based productivity tools, and are in turn exposing themselves to the same set of risks that exist within these applications. Companies may also not take into account the impact that third-party applications may have on their broader on-premises or hybrid network if deployed quickly, as many of these productivity tools can integrate with users' personal accounts and allow them to transmit private company data with ease.

The threat landscape is expansive and ever-changing, so this list is meant to function as a list of common themes rather than an exhaustive list of threats. If you'd like to read full, unabridged quotes from 11 professionals who shared on-record statements with us, check them out here.

Related Content:

A listing of free products and services compiled for Dark Reading by Omdia analysts to help meet the challenges of COVID-19. 

Dennis Thankachan is the founder and CEO of Lightyear, a web platform that helps businesses comparison shop for IT infrastructure services (internet access, VoIP, managed services, etc.). He regularly writes on various IT infrastructure and telecom topics here. Dennis is ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Ninja
4/30/2020 | 6:14:46 PM
Theoretical vs. Applied
This pandemic has highlighted many shortcomings that we have been aware of for quite some time. Technology has paved the landscape to the point where you do not need to be located in the same state as your company or be in the office 24x7. There are many financial benefits for the company to have a remote workforce as well as security benefits with VDI and other remote access mechanisms.

The reason we are experiencing detriments is because the pandemic has forced us to go all in before we were ready and it is due to a lack of proactivity. Similar to when "the cloud" first came out. Companies were hesitant, decided to make the change and go for 100% cloud failed and complained about it. We need to start planning more effectively. Operating under an idea that its not a matter of if but when certain events will happen. We would be much better off.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/2/2020
Ripple20 Threatens Increasingly Connected Medical Devices
Kelly Sheridan, Staff Editor, Dark Reading,  6/30/2020
DDoS Attacks Jump 542% from Q4 2019 to Q1 2020
Dark Reading Staff 6/30/2020
Register for Dark Reading Newsletters
White Papers
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-07-02
Apache Guacamole 1.1.0 and older may mishandle pointers involved inprocessing data received via RDP static virtual channels. If a userconnects to a malicious or compromised RDP server, a series ofspecially-crafted PDUs could result in memory corruption, possiblyallowing arbitrary code to be executed...
PUBLISHED: 2020-07-02
A vulnerability in the web-based management interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications Manager IM & Presence Service, and Cisco Unity Connection could allow an unauthenticated, remote attack...
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, when users run the command displayed in NGINX Controller user interface (UI) to fetch the agent installer, the server TLS certificate is not verified.
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messaging services in use by the NGINX Controller do not require any form of authentication, so any successful connection would be authorized.
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller installer starts the download of Kubernetes packages from an HTTP URL On Debian/Ubuntu system.