CFOtech New Zealand logo
Technology news for Kiwi CFOs and financial decision-makers
Story image

Security threats endanger tens of millions working from home

By Contributor
Thu 9 Jul 2020
FYI, this story is more than a year old

Article by Radware's Pascal Geenens.

Working life has changed for tens of millions of professional people around the world.   According to CNBC, 70%  of professionals work remotely at least one day a week, while 53%  do so at least half of the week.  

As working from home has rolled out at pace, communication platforms and collaborative tools are being embraced worldwide, helped by introductory offers.
Early on, network capacity was considered at risk due to the volume of people working and using services like online gaming all at once. The Austrian regulatory authority, RTR, was one of the first to impose throttling of certain services like video streaming, and companies like Netflix have also taken action to reduce congestion by reducing video quality so that capacity isn’t squandered.

Managing the load on the network is causing CTOs to scratch their heads, too. As they rapidly roll out enterprise VPNs and remote desktop solutions to give employees access to sensitive resources and internal applications, they must find ways to balance the volume on the network. Plus, they need to keep it secure.

So, what should CTOs be doing first?

Taking measures to prevent disruption to critical servers is paramount. Distributed Denial of Service attacks are high on the list of threats. We know that such attacks create large volumes of ‘garbage’ traffic to saturate the pipe, but they can also be used for more insidious reasons, such as attacking the intricacies of the VPN protocol. A flow as little as 1Mbps can knock a VPN service offline.

Load balancing

Balancing the volume on the network is also more complex now as more people remotely access the desktop, files, emails and services like Office365 and cloud apps like Salesforce and Workday. This can be managed with load balancing, software defined wide area networks, and web performance optimisation.

Putting on-demand applications into the cloud so they can be accessed remotely is also a smart move. Load balancing can then scale up applications regardless of where they are located.
But this strategy is greatly undermined if the network and the applications are not secure. It’s therefore imperative there is authentication to validate a user before is accessed. People on the network have to be trusted. No one wants a data breach and GDPR fine on top of everything else.

VPN security

At the start of 2020, VPN security was in the spotlight as multiple vulnerabilities in enterprise VPN products from Pulse Secure, Fortinet, Palo Alto Networks, and Citrix were exploited by malicious actors and nation states alike. Companies responded by patching or withdrawing the remote access and the problem of attacks died back.

However, introducing home working at pace and on a much larger scale, is likely to entice unscrupulous actors into action. Every company needs to undertake special care to ensure the patches are applied before switching any new or extended service on.

But more than this, they must commit to maintaining updates and patches during this period of flux. That’s because remote desktop protocol (RDP) has been for the most part of 2019, and continues to be by a fair margin, the most important attack vector for ransomware.

CIOs need to acknowledge that in introducing/extending RDP, they are broadening the attack surface. And that the temporary solutions they are putting in place (that could become permanent) have to be secure at all times.

So it’s really important to adapt risk models. It’s possible that some companies won’t be able to think about this right now such is the urgency to keep the business operating. But they must return to it. It would be foolish to roll out new services with emphasis on access and usability and neglect security.

Passwords

From the numerous breaches we have seen in the past, it’s evident that strong passwords or some form of multi-factor authentication (MFA) is an absolute requirement when providing remote desktop access to home workers. Best practice would be to get all employees to reset their passwords as they connect remotely and prompt them to choose a new password that complies within a strong password complexity guideline.

As we know, people have a habit of reusing their passwords for one or more online services – services that might have fallen victim to a breach. Hackers will happily leverage these breach batches and go to town.

Social engineering

Fear of the virus and a continuous need for up-to-date information provides a great breeding ground for abuse too. CIOs need to remind their teams of the risks posed by weblinks and the infodemic/fake news that’s all around.

A good example of this is the abundant phishing campaigns that are luring people in with the promise of important or breaking information on COVID-19. They are designed to entice them to click malicious links or open infected attachments

It’s a sad reflection of the cybersecurity world – some people have no ethics and will exploit the horrendous humanitarian disaster we face. In January, malicious actors started leveraging public fear of coronavirus to spread the notorious Emotet malware. These scams are continuing and we’ll see more invented in the coming months.

Bad bots

While the world has yet to see reports of fake news generated by machines there’s a high probability it will happen. Spambots are already creating pharmaceutical spam campaigns thriving on the need for information about the virus so it’s only a matter to time before more sophisticated methods are used.

That’s why CIOs need to educate employees on the most popular and obvious bot techniques for infiltrating a network – clickbait and comment spamming. Bots inject popular and frequently searched keywords into comments on spam sites to increase the visibility and ranking of the site in search results. ‘Coronavirus’ is a trending search term in Google and using it on a page will ensure the sites come up favourably in search algorithms. People have to understand the mentality of hackers, and the tactics they use, so they can avoid falling in the trap.

All these issues highlight the battles CIOs face. They are challenging but not insurmountable. It will require a ‘more speed, less haste’ approach when it comes to rolling out, scaling up and integrating technologies. That’s easier said than done when there are pressures to stay trading, but it is imperative to ensure that actions taken now don’t encourage security disasters in the future.

Related stories
Top stories
Story image
Employment
Tech job moves - Forcepoint, Malwarebytes, SolarWinds & VMware
We round up all job appointments from May 13-20, 2022, in one place to keep you updated with the latest from across the tech industries.
Story image
Vectra AI
Understanding the weight on security leader’s shoulders, and how to shift it
Millions of dollars of government funding and internal budgets are being funnelled into cybersecurity to build resilience against sophisticated threats, indicating how serious this issue has become.
Story image
Cybersecurity
More than 40% of banks worried about cloud security - report
Publicis Sapient's new report finds security and the lack of cloud skills and internal understanding of business benefits are big obstacles for banks moving to the cloud.
Story image
SaaS
Maintaining secure systems with expectations of flexible work
Most office workers feel they've proved they can work successfully from home, and as much as employers try, things aren't going back to the way they were anytime soon.
Story image
Remote Working
How organisations can meet employees' changing expectations
The global employment market has shifted dramatically in favour of employees, sparking the so-called great resignation, in which people are leaving unsatisfying roles in search of greener pastures.
Story image
Data Protection
Barracuda launches new capabilities for API Protection
"Every business needs this type of critical protection against API vulnerabilities and automated bot attacks," Barracuda says.
Story image
Commerce Commission
ComCom appeals $2.25 million fine in Vodafone FibreX case
The Commerce Commission has filed an appeal in the High Court against a $2.25 million fine imposed on Vodafone NZ for its offending under the Fair Trading Act.
Story image
Artificial Intelligence
SAS unveils AI experience to improve kids' batting abilities
SAS has created The Batting Lab, an interactive experience using AI, computer vision and IoT analytics to help kids improve their baseball and softball swings.
Story image
Remote Working
IT teams deploy powerful technologies to enable remote work
"We found that IT teams mastered the challenges of remote work last year in large part by employing powerful yet easy-to-use technologies."
Story image
Artificial Intelligence
Clear Dynamics closes $35M funding round, invests in global growth
The funding is a major milestone and speaks to Clear Dynamics’ vision for AI-enabled ‘composable’ enterprise software, the company states.
Story image
Microsoft
Microsoft backing Māori and Pacific wāhine in tech industry
A new initiative focused on getting Māori and Pacific wāhine into the tech industry and backed by Microsoft, NZTech and the government is calling for tech companies to get involved.
Story image
Cybersecurity
Hard numbers: Why ambiguity in cybersecurity no longer adds up
As cybersecurity costs and risks continue to escalate, CEOs continue to struggle with what their investment in cyber protection buys. Getting rid of ambiguity becomes necessary.
Story image
Kodari Securities (KOSEC)
NFT trends and opportunities: expert reveals all
The NFT market is growing at an exponential rate, with unprecedented liquidity. Here we explore how businesses can profit.
Story image
Attain
Revenue operations is taking centre stage
As the business world continues to evolve, new demands need to be met to keep up with the ever-changing landscape. 
Story image
Cybersecurity
NCSC advisory highlights poor security configurations
The GCSB's National Cyber Security Centre (NCSC) has released a cyber security advisory identifying commonly exploited controls and practices.
Story image
Mobility
Hands-on review: STM laptop bags
The advent of hybrid working has meant we need laptop bags. We got our hands on two of the most popular laptop bags from STM.
Story image
Digital Transformation
Why enterprise records management should be part of any digital transformation strategy
Modern organisations create and rely upon an enormous volume of content, and digital records make up a significant proportion of that content.
Story image
Infrastructure
Nutanix study reveals financial services sector lagging with multicloud adoption
Nutanix has released new research that reveals the financial services sector is lagging behind when it comes to multicloud adoption.
Story image
Digital Transformation
The Huawei APAC conference kicks off with digital transformation
More than 1500 people from across APAC have gathered for the Huawei APAC Digital Innovation Congress to explore the future of digital innovation.
Story image
Microsoft
SAS Viya on Microsoft Azure to deliver 204% return - study
The Forrester Total Economic Impact study finds SAS Viya on Microsoft Azure brings a 204% return on investment over three years.
Story image
Vodafone
Vodafone NZ buys remaining stake in retail joint venture
Vodafone New Zealand has purchased the remaining 50% stake in the specialist joint venture (JV) with private equity company Millennium Corp.
Story image
Fonterra
Fonterra to use automated guided vehicles by Dematic
New Zealand's dairy giant Fonterra is upgrading its manufacturing facility in Edendale with new automated guided vehicles (AGVs) from Dematic.
Story image
Ransomware
A third of companies paying ransom don’t recover data - report
Veeam's report finds 76% of businesses who are victims of cyberattacks paid the ransom to recover data, but a third were still unable to get their information back.
Story image
IT budget
$20m boost for digital technologies announced
The government is spending an extra $20m over four years on its plan to transform the digital technologies industry.
Story image
Digital Transformation
Unlocking the next digital frontier for educational institutions
Understanding where to invest in technology can be challenging for education institutions, especially after the COVID-19 disruptions.
Story image
Artificial Intelligence
CFOs using digital workers and AI to prevent unnecessary loss
New technology is now allowing CFOs to use digital workers to automate their accounting processes, making it easier for them to avoid unnecessary losses.
Story image
Artificial Intelligence
SAS announces new products amid cloud portfolio success
Analytics and AI company SAS is deepening its broad industry portfolio with offerings that support life sciences, energy, and martech.
Story image
Phishing
Google reveals new safety and security measures for users
Google's new measures include automatic two step verification, virtual cards and making it easier to remove contact information on Google Search results.
Story image
Tech job moves
Tech job moves - Datacom, Micro Focus, SnapLogic and VMware
We round up all job appointments from May 6-12, 2022, in one place to keep you updated with the latest from across the tech industries.
Story image
Public Cloud
Cloud adoption still a work in progress, NetApp finds
NetApp has announced the results of the annual Cloud Infrastructure Report based on a survey of public cloud business and IT decision makers.
Story image
Artificial Intelligence
Updates from Google Workspace set to ease hybrid working troubles
Google Workspace has announced a variety of new features which will utilise Google AI capabilities to help make hybrid working situations more efficient and effective.
Story image
Excel
Could your Excel practices be harming your business?
While Excel has been the de-facto standard for budgeting, planning, and forecasting, is it alone, enough to support organisations in the global marketplace that’s facing rapid changes due to digital transformation?
Story image
Cryptocurrency
Prominent cryptocurrency trader hit by 'perfect storm'
A leading local crypto currency trading platform, BitPrime, says a "perfect storm" has hit its finances, forcing it to put a halt on operations.
Story image
Talend
Talend introduces new data health solutions for businesses
Talend has announced its latest version of Talend Data Fabric, with the release of Talend Trust Score enabling data teams to establish a foundation for data health.
Booster
Booster Innovation Fund. A fund of Kiwi ingenuity – for Kiwi investors.
Link image
Story image
SAS
New SAS service overcomes subscription fatigue for media companies
SAS has launched SAS 360 Match which helps media companies move towards a AVOD model to generate revenue as subscribers cancel.
Story image
Customer experience
Research unveils precarious customer loyalty for retailers
New research has found customers are reassessing established brand loyalties as their priorities and behaviours shift.
Story image
Commerce Commission
ComCom welcomes new marketing codes for the telecom industry
The Commerce Commission is welcoming the creation of new marketing codes for the telecommunications industry.
Story image
Safety
Voxel hits total funding of $18M following ongoing wins
Since raising its seed round in September, Voxel has grown at pace, by decreasing on-site injuries by upwards of 80% and increasing operational productivity.
Story image
Microsoft
PwC NZ unveils new Cloud Security Operations Center
PwC New Zealand has unveiled its new Cloud Security Operations Center for the entire Microsoft technology stack.
Story image
Sift
Sift shares crucial advice for preventing serious ATO breaches
Are you or your business struggling with Account Takeover Fraud (ATO)? One of the latest ebooks from Sift can provide readers with the tools and expertise to help launch them into the new era of account security.
Exabeam
Find out how a behavioural analytics-driven approach can transform security operations with the new Exabeam commissioned Forrester study.
Link image
Story image
Adyen
Adyen expands partnership with Afterpay as BNPL payments increase
Adyen has expanded its partnership with AfterPay allowing more of Adyen’s merchants in more countries worldwide to use the BNPL provider.
Story image
Digital Transformation
Trading up: It's time to swap core systems for flexible digital applications
This year will see more oranisations planning and commencing high tech renovations that will shake up the way they operate.