International authorities warn of COVID-19 cybersecurity threats | News and Events

Two high-level international cybersecurity authorities have teamed up to warn the world of cybercriminals exploiting the remote workforce.

The Cybersecurity and Infrastructure Security Agency (CISA) of the United States Department of Homeland Security and the National Cyber ​​Security Center (NCSC) of the United Kingdom issued a joint alert last week warn individuals and organizations of the types of scams used by cyber criminals. It also provides role-specific mitigation strategies and advice on how to avoid being victimized during these periods of vulnerability.

The joint alert warns that cybercriminals should continue to use various ransomware and other malware in the weeks and months to come to exploit the pandemic. The threats observed by the organizations include all the typical modes of compromise, but using COVID-19 as “decoy”. These include phishing (targeting both messaging and text messaging platforms), distributing malware by various means, and registering new domain names using linked words. to COVID-19. Threats also include targeted attacks against newly created and expanded remote access and telework infrastructures – including the exploitation of popular online meeting platforms like Zoom and Microsoft Teams.

The Alert offers the following tips for tracking phishing communications from cybercriminals:

• Criminals often pretend to be someone important to you. Does the sender of the email / text have authority they claim to have them? Are they really your bank, doctor, lawyer or government agency?
• Criminals Often Threaten Fines Or Negative Consequences And Want You To Act With emergency. Are you told that you have a limited time to respond?
• Criminals will try to evoke emotion by making false statements against you or by trying to pique your curiosity. Does the message cause you some level of panic or prompt you to take action?
• Criminals know there is scarcity certain resources and that we are sometimes afraid of missing. Does the message offer something limited?

The alert also offers the following tips for defending yourself against online meeting hacking:

• Do not make online meetings “public” – rather, request a meeting password and use the “waiting room” function (for Zoom).
• Do not share a link to the meeting on social media.
• Change the settings for these platforms to allow only the host to share their screen.
• Make sure you are only using the most recent versions of the meeting software.
• Make sure that the use of these platforms meets the requirements of your organization’s policies and obligations (contractual and regulatory) regarding information security.

The joint alert also provides information technology professionals with access to resources related to COVID-19 malicious cyber activity, including summaries of “compromise indicators” and general counter-threat advice and tips . In addition to ensuring that non-technical employees are aware of the threats and trained in defense against these attacks, the joint alert reminds these professionals of their responsibility to adopt a four-level approach in their mitigation strategies:

• It is technically difficult for criminals to reach individual users.
• Help individual users identify and report phishing communications.
• Protect the organization from phishing emails that individual users will be victimized.
• Respond quickly to incidents.

The joint alert stresses that the cyber threats posed by COVID-19 are evolving rapidly. Therefore, organizations and their employees must remain alert to increased activity and take proactive steps to protect themselves and their organizations.

If anyone has any questions about cybersecurity during this remote work period, contact me or any member of the Barley Snyder cybersecurity service team.

WARNING: As we go through an unprecedented period of legal and business uncertainty, we strive to provide updates on the status of important legal news related to COVID-19. It is important to note that the situation is evolving rapidly and that the information provided in our alerts is not intended to create a lawyer-client relationship. The information in our alerts is for informational purposes only and should not be construed as legal advice or a substitute for legal advice. If you have any questions about your legal situation or how to apply the information contained in this alert to your situation or how any other information found on our website may affect your business, you should contact one of our lawyers. We assume no responsibility for the accuracy or currency of the information provided here or by any linked site. As information changes quickly, users are strongly advised to verify any information before relying on it.