A legal sector-focussed cyber security summit on Monday 30 November will flag the gaps being exploited by hackers in home working arrangements. We spoke to the managing partner of summit organiser CloudyIT, David Hall, and speaker Peter Elliot from Empiric Partners, for a sneak peek into some of the tips and information they will be sharing – including the top cause of successful attacks.
The Covid-19 crisis continues to test companies’ cyber security arrangements like never before, with a huge surge in phishing attacks and malware reported since January 2020, coinciding with a significant increase in homeworking.
While most organisations are aware of cyber-crime and have some measures to manage the threat of viruses and malware, the pandemic has seen cyber attackers exploiting new gaps, particularly from remote workforces using insecure devices and networks outside of the secured zone.
Speaking to Legal IT Insider, Hall said: “Because people are remote working there is more opportunity for social engineering and the hacks are getting bigger. Hackers are getting access and working out the structure of the company and who are the key decision makers. Without the right controls in place the average time it takes for people to work out that their system has been compromised is six months. With the correct systems and processes in place, the moment you’re hacked you’re aware, otherwise they are in your system poking around. Hackers don’t want thousands of pounds, they want millions.”
Asked why remote working increases the danger or likelihood of social engineering, Hall said: “If you’re in the office with colleagues you’re more in touch and more likely to ask questions, but when you’re socially isolated you lose the ability to fact check what’s going on within your own company and criminals play on that. They know from Facebook that someone has gone on holiday. One global company UK head thought they were having a conversation with the global director in south America but it wasn’t them: the hacker knew that the global director was on holiday and a payment of 50k was stolen.”
The right home set up is critical and Elliot said: “When people are working from home they are either logging in from their own system or on a system provided to use at home. The second is safer but nevertheless, laptops and mobile computers are inherently less secure because they have the ability to be stolen and carried around. It’s essential to encrypt the hard drive to prevent unauthorised access and ideally information should only be stored at HQ not on your own system. But inevitably when you’re working from home people download documents to work on at home, especially if the broadband is no good, and that’s where the added risks are.”
One notable change is that criminals are waiting longer and sitting within systems in order to maximise their return. Elliot said: “I’m seeing that criminals are less interested in making money immediately – they wait until they get hold of the credentials that will make them the most money.”
Hall added: “They get access to your mailbox and anything containing ‘accounts’, ‘cash’ or ‘money’ is delivered to an account that they are in charge of – as soon as an invoice comes up they jump in.”
The top cause of attack
According to Elliot, the top cause of successful cyber attacks is people reusing the same password. He said: “As soon as a hacker gets hold of one they have access to all your systems. They take those credentials and they automatically run them again all of the major platforms such as Amazon, eBay and PayPal, and when they get a hit they are into your system. The first thing a criminal will do is change your email address.
You can check whether your email address has been compromised here: https://haveibeenpwned.com/
Other than using technology such as Mimecast, one solution is to have a buddy system before any payment is made and Elliot said: “A lot can be addressed with process and policy, it’s not just about investing in technology.”
Join the free summit here: https://www.cloudyit.co.uk/cyber-security-virtual-summit/
This event is designed to help councils, legal firms and small-medium-sized enterprises.