Guest articles

COVID-19 seems to be affecting most things in life, and the on-line world is no exception. Being able to work from home, have the kids in virtual school, and connect with friends both close by and overseas have been a few of the pluses of the last weeks. My sons’ school in Dubai even managed an on-line assembly via Teams with over 900 connections! But what does this accelerated reliance on connectivity mean for our security? As countries seek to increase their resilience to cyber-attacks, recent news indicates that even the most advanced and well-protected systems can be vulnerable. So what of the less complex systems we use at home? And what should we be thinking about if we are either running a business or concerned about IT security in the workplace? And finally, should we be worried – at a national level – about how our data is taken care of?

UK cyber companies have clearly seen a rise in individuals being targeted by cyber attacks linked to COVID-19. In many ways these are not really new threats. It’s just that they are wrapped up in a form that currently catches the attention (such as offers of compensation related to COVID-19). They are mostly ‘phishing’ attacks where a recipient is encouraged (either through the offer of money, or through some kind of alarming warning) to click on a link embedded in the email which allows malicious code to be transferred. The regular advice stands: don’t trust messages from senders you don’t recognise; keep your firewalls up to date; be wary of things that are either too good to be true (or else alarming; have different, complex passwords, and don’t give them out to anyone. If you’re unsure of even the basic precautions you should be taking as an individual to safeguard yourself on-line, ‘Cyber Aware’ from the UK’s National Cyber Security Centre is a good place to start (search ‘NCSC Cyber Aware’ or visit https://www.ncsc.gov.uk/cyberaware/home).

Businesses face more sophisticated threats every day, and there is, unfortunately, a worry that the COVID-19 shift to remote working could be storing problems up for the future. A reliance on platforms like Zoom – where credentials can be harvested and sold – is troubling long term. While it’s understandable that firms will want to use free services rather than stand up a more expensive alternative like Teams or Skype, they are no substitute for a structured approach. But whilst the choice of technology is important, the best-prepared businesses realise that cyber security isn’t simply a technical problem. Most cyber risks are not caused by technology - they are caused by the way that humans interact with that technology. So businesses need to look beyond technical solutions and think about the key behaviours that will help them increase resilience:

• Create inventories of our systems and data - we cannot protect what we don’t fully understand;
• Separate critical or sensitive internal systems from public facing systems such as internet and email (or deploy solutions that make these safer from attacks such as phishing and other malware);
• Accept that we will probably all experience a cyber security incident at some point, and focus on building effective response capabilities, taking advice from industry experts, and sharing information across our sector about attacks;
• Consider the competitive advantages arising from cyber resilience;
• Look outwards at the threat landscape as well as inwards to our defences, and consider buying in ‘threat intelligence’ that tells us what problems are out there;
• Start to think like the attacker, and use security testing services that give us a view of our vulnerabilities as the attacker sees them.
So, whilst new technology presents some risks it can also contribute to protective solutions. It’s really a combination of people, process and technology working together with good information sharing that will provide the answer. For businesses that are worried about how COVID-19 fraud could affect them, there is good information being shared by the UK’s Fraud Advisory Panel, which is an industry group supported by UK law enforcement (search ‘Fraud Advisory Panel UK’ or go to https://mailchi.mp/fraudadvisorypanel/fraud-advisory-panel-covid-19-fraud-watch-group-member-update-3150845?e=92fc48cace). Again, the UK’s National Cyber Centre has excellent free advice available for small to medium-size businesses – search ’NCSC 10 Steps to Cyber Security’.

Cyber attacks at the national level are not new either, especially against the healthcare sector. Although WannaCry was not specifically targeted at the NHS, the effect on its old, unpatched systems was profound. Even countries as sophisticated as Singapore have seen their health authorities compromised (in their case losing information relating to 1.5m patients). Data is the new currency for large criminal groups. Nation States flex their muscles by accessing systems even when the strategic intent behind their actions is hard to discern. The UK has released technical detail to business and governments about sophisticated attacks linked to COVID -19 (see
https://www.ncsc.gov.uk/news/covid-19-exploited-by-cyber-actors-advisory), and is leading the way on programmes to keep citizens safe, wherever they are. This means working with partners across the Gulf, including the UAE, to strengthen collective resilience. Again, this is partly about new technology (for example the UK has opened two Cyber Innovation Centres in Cheltenham and London which support companies developing the next generation of cyber technologies) but training, skills, developing people and sharing information are just as important. The UK, both government and industry together, makes the world’s most compelling partner on national cyber security.

So just as cyber threats are in many ways old-fashioned risks like fraud and espionage in a new wrapper, so COVID-19 attacks are nothing new in themselves, but merely dangers we have always faced packaged up in a novel way. Most of the IT threats we face as individuals can be mitigated by good practice; businesses, even though at greater risk, can follows a structured process; and governments can work together to tackle the most sophisticated problems. But overall the cyber security challenge and the ways that we work together to meet it will only increase as we move even further on-line in a connected world.

About the Author:

Simon Hosking is the UK Government’s Cyber Security Industry Representative to the Gulf, and is seconded from a large UK defence prime. He advises public and private sector organisations on cyber security focussing on the strength of the UK cyber offer.

Simon is available to support UK cyber security firms, in particular by explaining to Gulf-based customers how the UK can help organisations with their cyber security challenges.

simon.hosking@fco.gov.uk