COVID-19 and cyberattacks

I got a call from my mom a couple of days ago about an email she had just received that said a friend of hers had just tested positive for COVID -19 and she was on their list of recently visited people. The email explained that she needed to download the attached form and head immediately to the hospital. By age, my mom is in the high risk group, as are her friends. Needless to say, the panicked phone call I received was frustrating. Fortunately, she’s been well schooled on how to respond to anything out of the ordinary that happens on her computer, so she called tech support – me. 

That’s just one example of the flurry of cyberattacks hitting businesses and individuals right now. When I say flurry, that itself may be an understatement. Cyber criminals know the best time to strike is when we are psychologically vulnerable. Those times include times of high stress or high excitement. Add to that the recent movement of businesses to work from home (WFH) environments, and you have an ideal scenario for hackers to have success. The attacks include old ones and new ones. Let’s consider some of the concerns.

First, the move towards a home-based office is rife with vulnerabilities. Not only are your home networks polluted with issues caused by others in your household (like your children’s streaming game services, for example), but you’re also unlikely to have commercial grade defenses at your home. Remember our old friend from last year known as VPNFilter? We warned last year that this attack was going to be around for a long time, and it’s being exploited in a big way right now. VPNFilter is a malware attack that exploits vulnerabilities in home network devices that haven’t been patched. Since few people are able to update their home router or firewall, this hole remains open, and now that you’re working from home, hackers are able to exploit your local devices and penetrate your corporate network. This is just one example of many weaknesses organizations are facing with a WFH configuration. Your risk can be helped by replacing your home firewall with a new one that allows for automatic updates, but you can do better by getting a firewall that has real-time perimeter protection for an additional subscription, and enabling that. 

Second, you need to be connecting to your corporate environment through a VPN type of service. These secure and encrypted connections make it exponentially more difficult for malware to traverse from an infected home device to your company network. A VPN can make remote access as simple as clicking an icon your desktop and then logging in, hopefully with multi-factor authentication included.

Third, all of those IP cameras and devices in your home have notorious vulnerabilities we’ve discussed in the past. If this applies to you, then either get professional IT help to lock down your home or unplug those devices. Since none of us wants to do the latter, and getting into the details of doing this properly are beyond the scope of this reminder, we recommend getting help online or clicking the linked document below. 

The combined impact of WFH and reduced IT staffing is also a perfect storm for security nightmares, and hackers know this too. Right now numerous attacks are proliferating across the internet. Everything from fake invoices, shipment notifications, delivery notifications, quotes and more, all incorporating COVID-19 related subject matter, are baiting company employees into ransomware traps, among others. Even your VOIP phone isn’t safe, as we’re seeing attacks matriculate that are focused on exploiting IP based phone systems.

While there’s a lot of information available on how to avoid these new attacks and how to fortify your home, one of the best we’ve found has been published by HHS’s Cybersecurity unit. Here’s a link to the unclassified article. Although geared towards healthcare organizations, it’s universally applicable.

For all of our friends and your loved ones, we wish you safety and health in this challenging time. For our nurses and doctors on the front lines, may God’s grace protect you.

J Mongelli

If you have any questions or if you are concerned about your organization’s cybersecurity, give us a call at (800) 970-0402. We’ll be happy to help.

For more HIPAA information, download our ebook – The Ultimate HIPAA Compliance Handbook.

The HIPAA Security Rule requires the implementation of a security awareness and training program for all members of its workforce (including management). Have your team sign up for weekly HIPAA Security Reminder to help stay compliant.