Cyber Security: Lessons Learned from Pandemic & Industry Trends Expected in 2021

The COVID-19 pandemic is one of the worst public health crises the world has ever seen, and this made the year 2020 like none other in living memory. Furthermore, it has caused a seismic shift in the way industries work. 

Companies started embracing and implementing digital transformation capabilities in full-swing and accelerated the remote working culture. Heavy reliance on high-speed internet for communication became the new reality. And all stakeholders involved rooted for a more connected digital world. 

But amidst such uncertainty and growing digital processes, it was no surprise that cybercriminals adapted to the new dynamics and seized opportunities to pose some serious harm to businesses all around the world. In fact, cybersecurity experts estimate that data breaches increased in 2020. 

The 2020 Data Breach Investigations Report from Verizon offers some interesting details. Here is the summary of the report:

• 70% breaches caused by outsiders
• 86% of data breaches were financially motivated
• 43% of the attacks were on web applications. This type of data breach is more than twice the results from last year
• 27% of malware incidents attributed to ransomware

Thus, it suffices to say that 2020 has been a rough year for the cybersecurity industry. Risk exposure increased exponentially, breach investigations remained a challenge, and it was difficult to implement new controls. Unparalleled cyber threats have forced a rethink of strategies and approach. 

Here are a few important lessons learned from the pandemic affected year that can help the cybersecurity industry to start strong heading to 2021.

Phishing Attacks

Many companies have robust policies and risk assessment strategies to counter cyber threats inside the four walls of shared working space. But in 2020, no business was prepared to face the daunting challenge of cybersecurity when employees were connected to a network outside the safety of the organization. 

Phishing remained one of the most popular threats faced by organizations while working remotely. Email messages with malicious website links are sent to steal personal credentials and sensitive information. Therefore, employees must be alert and aware enough to recognize such phishing activities in the form of emails and links and alert the cybersecurity team about such a threat every time it occurs.

Training Employees

Many companies regard cybersecurity as a measure to protect them from external attacks. Moreover, it is a misunderstanding that cybersecurity is the job of experts alone. A robust cybersecurity measure would take into account the basic levels of an organization. Unprecedented times call for unprecedented measures. Thus, only by training and empowering employees to handle cyber threats at the outset, the risk can be mitigated.

The most recent Twitter attack that took control of eminent personalities like Joe Biden and Elon Musk was a result of user domains being attacked using spear-phishing. The malicious emails were sent to employees, and they became easy targets. Therefore, training employees about best practices, router security, VPN use and IT support features is a must. 

Tools for Virtual Communication 

Use of virtual communication tool has increased massively since lockdown and government forcing people indoors. The extensive use of applications like Zoom and the consequent Zoom bombings are well known. Security and privacy factors are at risk while using such applications. Organizers or meeting admin needs to implement features like strong password protection, waiting rooms, participants control and other security measures. Do not share meeting links publicly or accept links from non-trusted sources.

Potentially unprotected virtual communication tools and vulnerabilities show the security gaps and the need for patch management. Regular patch management for software applications and updates for all third-party software are some proactive measures which can be taken by organizations. 

Ransomware Attacks

Ransomware is often associated with encrypting data and files and withholding access until a ransom is paid. But over the years, ransomware attacks have evolved. Cybercriminals are now able to lock the entire device, and a message is displayed asking for payment. Additionally, it locks the screen and displays indecent images and demands payment. 

Education and telemedicine are the most affected sectors in 2020 due to ransomware attacks. Millions of students have joined online classes, and telemedicine demand has maximized as well. Cybercriminals have repeatedly used extortion attacks on both these sectors. Additionally, key infrastructure servers are encrypted and targeted regularly. Updating cyber risk assessment and training is important to thwart such attacks. 

Continued Vigilance 

If one has to pick a key take away from the cybersecurity lessons learned due to pandemic in 2020, it is the need for continued vigilance and keeping up with the shifting standards of cyber threats. 

Since the cyber attacks often evade existing security solutions and thwart analysis using stealth, businesses need to be on their toes and fight the cyber threat without giving any leeway. Organizations should partner with cybersecurity professionals and experts who are highly capable to secure your organization using the latest techniques, tools and updated knowledge on information security and cyber threats.

Cyber Security Trends in 2021

As we head into 2021, it begs the all-important question as to what’s in store for the cybersecurity industry. Read on as we discuss some of the prominent threats, challenges and trends expected in the coming year. 

Remote Working 

As the culture of remote working is here to stay and may even go beyond 2021, cybercriminals will continue to target and launch attacks on people using their own devices and technologies. It was a major challenge for cybersecurity experts to support remote work and prevent sensitive data from being exposed and it will continue to be so in 2021.

The COVID-19 pandemic has seen a transition from bring-your-own-device BYOD to choose-your-own-IT – CYOIT model. In the BYOD model, the security experts controlled the server-side and enforced the use of safe applications, and many lacked malware protection. While with CYOIT model, the organizations would need to focus more on the data.  

Cloud Storage

To ensure business continuity and smooth collaboration, organizations have adopted cloud storage. Even before the pandemic, the majority of businesses were migrating to cloud, but the health crisis and remote working will further push the use of cloud storage in 2021. 

Experts believe that security threats like less visibility, reduced control, incomplete deletion of data, cloud-based applications vulnerability, and misconfigured cloud storage will continue to cause damage and distress for businesses. 

 Zero Trust Cybersecurity

The year 2020 already saw great interest in zero-trust approach for cybersecurity. As businesses continue to choose multiple cloud environments, assets of a company lie beyond the general security parameters. Therefore, security parameters need to revolve around the identity of the individual and the device requesting access.

Segregation of duties is another approach which can be followed by employees. It would mean that individuals have the privilege of access to perform their respective job alone. 

5G Devices and Advanced Threats

Launch of 5G enabled devices will give extensive opportunities to cybercriminals for advanced threats. In 2020, swarm-based attacks were developed that target network and devices and share inputs as it is happening. It enables them to exploit vulnerabilities in real-time and change or upgrade their attacks to achieve their goals. It is certainly going to escalate in 2021. 

Holistic Security Approach 

In 2021, it will be difficult for organizations to protect or defend all by themselves. Cybercriminals always find new ways to target and cause heavy losses to the business in different forms. Therefore, a holistic security approach involving stakeholders like research groups, industry leaders, cybersecurity professionals and law enforcement should take the fight to cybercriminals.