With the change in the way we work affecting most of us, now would seem an appropriate time to revisit the topic of cybersecurity. A while ago we covered the subjects of both email scams and cybersecurity risks and their management, outlining the scale of the challenges they present and some steps to mitigate the risks.

The spread of coronavirus and the resultant enforced working from home for most of us unfortunately presents even greater opportunities for criminals. Unfamiliar processes, new software, new hardware and different ways to access systems, often combined with anxiety and fear creating the perfect storm.

Many organisations are still not using collaboration software and as a result some teams within those organisations have been left to find their own ways of collaborating. An example was the dramatic rise in the number of Zoom users. The well publicised weaknesses in security up until recently did not deter individuals from using the app, their priority at the time of first use only being to stay in touch with their colleagues.

The EU Agency for Cybersecurity could not make the current scale of the problem any clearer, with its statement on 20 March 2020:

“The coronavirus outbreak has spurred widespread anxiety and forced many people to work from home. Malign actors are actively exploiting these new challenging circumstances to target remote workers, businesses and individuals alike“

The UK National Cyber Security Centre reports a surge in the number of phishing emails using coronavirus as a lure, with criminals exploiting the pandemic to steal money or information.

In particular, emails are being sent purporting to be from the World Health Organisation (WHO) apparently containing useful information whereas they are actually designed to trick the recipient into opening attachments (which will probably contain viruses) or clicking on links that then attempt to convince a user to part with usernames and passwords. Other emails claim to be from IT support teams, again encouraging recipients to open attachments or links, often claiming authentication is required to access systems from a user’s new location.

Many new scams are aimed directly at individuals rather than organisations, now a bigger target as they are spending more time using their computers and laptops at home. In the UK, examples of the latest scams include criminals asking for donations to help the NHS buy medicines and supplies required to fight Covid-19; texts claiming to be sent by the government to individuals telling them they have been fined for leaving their homes more than once during lockdown; and job offers for key worker positions requiring a fee for background checks. By being aware of these risks, remote workers can not only protect themselves from personal loss, but also prevent the more widespread damage that results from opening attachments containing malware.

Finally, just to highlight the severity of this threat, the UK National Crime Agency, amongst many others, is drawing attention to criminals impersonating people, organisations and the police, and stressing the importance of vigilance: Stop – Challenge – Protect. In our article on email scams we also stressed that it is critical for everyone to keep a careful watch for possible danger and that employers must make their staff aware of these scams if they are to be avoided:

“Remain vigilant at all times“

 

In our previous posts we drew attention to the measures both employers and their staff should use to minimize risks. With the spread of coronavirus the number of articles with recommendations on this subject has also grown exponentially. Whilst not necessary to repeat what has already been written on the subject, we will however provide below a very short summary.

 

 

For some excellent advice we recommend visiting the EU Agency for Cybersecurity where they have a recent press release giving “Tips for cybersecurity when working from home”. The UK National Cyber Security Centre (part of GCHQ) also gives some valuable advice on preparing your organisation and staff for working from home with links inter alia to more detailed advice on setting up new accounts and access, implementing SaaS, VPNs and controlling access to systems, and protecting devices (which is particularly relevant when it’s necessary for staff to use their own equipment).

 

 

Another site well worth looking at is that of the Global Cyber Alliance. It was established in September 2015 by the Manhattan District Attorney’s Office, the City of London Police, and the Center for Internet Security. It is an international, cross-sector nonprofit organisation dedicated to confronting systemic cyber risks and improving our connected world. It has prepared a number of useful toolkits aimed at smaller businesses, offering hands-on tools rather than giving general guidance that users may be uncertain how to implement.

 

 

When working alongside colleagues there is often a tendency to call out for advice rather than call support, either because its quicker or maybe less embarrassing. Choosing apps, installing them and figuring out how to use them on your own increases the risk of subsequent security breaches. If experts are available within your organisation they should be used.

 

 

Protection of files and devices:

 

 

1. Backup files on external hard drives or the cloud

2. Ensure you have installed the latest software updates for apps, browsers and operating systems, changing update settings to automatic. This is especially important in the case of anti-virus and anti-malware software

3. Protect devices and media with passwords that are not easy to guess (random combinations of letters, numbers and characters, different for each account etc) and never leave laptops unattended. Password managers make it easy to use different passwords for each different app and their inbuilt password generators ensure only the strongest passwords are used

4. Encrypt devices that contain sensitive, personal information

5. Make sure hardware used at home is up to the job – for example, ensuring your router offers the latest encryption methods and is protected with a strong, unique password

6. When using new apps such as Zoom for the first time, make sure that the default security settings are changed. It may be that passwords are not enabled, and choosing to generate random meeting IDs, setting meetings to private, removing the ability to re-join meetings or share files are all ways that can be used to enhance security

7. Using two-step authentication to gain access to apps provides another level of protection. Google Authenticator, as an example, is free to use and, for those apps that support it, means having only a password and user name is no longer enough to gain access to an account

8. When sharing documents using Google Drive or Dropbox, for example, when given the choice between sharing a link or naming people use the latter. A link can be “re-shared” without your knowledge thereby making documents accessible to individuals outside of your control

9. Make use of software that only allows pre-defined teams access to both collaborative inboxes and associated file sharing – our own CompassAir messaging software being an example.

 

 

For an employer (see our article on cybersecurity):

 

 

• 1. Understand the risks that your organisation has, both now and potential risks in the future

  2. Have in place a plan to both protect against and respond to threats, importantly a plan that has been tested

  3. Review the current controls and security in place for each potential threat

  4. Train staff and heighten awareness, especially during the current time, and ensure that security practices are followed from wherever they happen to be

 

 

None of us know when the current lockdown conditions will be eased, other than that for each of us they will be different, depending on which country you live in and at what stage the spread of the virus has reached. However, what we do know for certain is that the threat of cybercrime was already growing month on month, year on year. This growth is now accelerating, given the opportunities presented to criminals from millions of people now working remotely. Now more than ever, it is essential that organisations and their staff are aware of the threats and that systems are in place to protect them from damage and losses that could lead to the destruction of whole organisations.

 

 

 

Creating solutions for the global maritime sector, CompassAir develops state of the art messaging and business application software designed to maximise ROI. Our software is used across the sector, including by Sale and Purchase brokers (S&P/SnP), Chartering brokers, Owners, Managers and Operators.

 

 

 

Through its shipping and shipbroking clients, ranging from recognised World leaders through to the smallest, most dynamic independent companies, CompassAir has a significant presence in the major maritime centres throughout Europe, the US and Asia.

 

 

 

Our flagship solution is designed to simplify collaboration for teams within and across continents, allowing access to group mailboxes at astounding speed using tools that remove the stress from handling thousands of emails a day. It can be cloud based or on premise. To find out more contact solutions@thinkcompass.io. If you are new to shipping, or just want to find out more about this exciting and challenging sector, the CompassAir Shipping Guide might prove to be an interesting read.

 

 

Contact us for more information on our software and find out how we can help your teams improve collaboration and increase productivity.