As we all adjust to working remotely, security teams across the world are grappling with a very serious challenge. Almost overnight our companies have changed. Well established procedures are being rewritten, best practices quickly rethought, and policies stretched to breaking point.
Business transformation is always a security risk. New technology and working practices need new security measures; but normally this risk is managed carefully, and over time. COVID-19 has not afforded us that luxury. For some businesses the scale and speed of this change will be unprecedented. It is also very public; attackers are aware of the situation and already exploiting it. Below are some of the most serious threats that security teams will face over the coming weeks.
1. Email scams
Change brings novelty, and novelty brings opportunity for scammers. In the last 48 hours, internal security teams will have been racing to roll out essential remote working tools. Links to download new software, changes to how we authenticate services. When you do not know what to expect, employee training on spotting social engineering goes out the window. Both employees and IT departments should be wary of unexpected calls and requests:
“Hi, I’m calling from IT, can you please read out your 2FA code to me to confirm that you have been transitioned to the new Duo system?”
“Hi, I’ve forgotten my O365 password, can you please email a reset code to my personal Gmail?”
Such requests may be legitimate and may need to be resolved outside normal channels. The onus will be on individuals to be cautious, apply common sense and validate as appropriate.
There will also be ample opportunity for spear phishers to impersonate third-parties and clients:
“Hi John, I need to reschedule our meeting next week to be remote. Please see the link below for an invite to the Zoom call.”
These risks will be exacerbated by the simultaneous relaxing of security controls in order to facilitate the use of non-standard web conferencing software and the sharing of files by email. Attackers will have both the opportunity and the means.
2. Weakened security controls
The weakening of security controls goes far beyond relaxing firewall rules and email policy. Many existing layers of security will not apply to remote workers. Employees suddenly taking their work computer home with them will find themselves stripped of protection as they trade the office network for their home Wi-Fi. Without internet proxy, NAC, IDS and NGFW, client devices will now be sitting exposed on potentially unsecured networks amongst potentially compromised devices. Endpoint security will have to bear the full brunt of protection.
Internal network security may be compromised as well; employees might need access to resources previously only accessible on a wired network in one location. To make it reachable over VPN, internal segmentation might need to be flattened. This will open the door to malware spread and lateral movement. Client certificate authentication protecting web services might need to be turned off to enable BYOD working for employees that don’t have a company laptop.
These changes must be scrupulously logged, and dependencies understood. The extra weight will have to be carried elsewhere: perhaps host AV policies can be tightened to compensate for lack of network protection, perhaps employee devices can be reconfigured to use a secure external DNS provider instead of the on-prem DNS server.
3. Attacks on remote-working infrastructure
Beyond the weakening of existing controls, spinning up new infrastructure will bring fresh risks. In January we saw a spate of attacks on web-facing Citrix infrastructure. Companies will be rapidly deploying VPN gateways, transitioning to Sharepoint and expanding their internet-facing perimeter. This rapidly increased attack surface will need monitoring and protecting. Security teams should be on heightened alert for brute force and server-side attacks. DDoS protection will also become more important than ever; for many companies this will be the first time that a DDoS attack could cripple their business by preventing remote workers from accessing services over the internet. We should expect to see a sharp rise in both of these forms of attack immediately.
4. Errors and creative solutions
“Put it in an S3 bucket.”
“Let’s use join.me instead.”
“I’ll send it to you over WeTransfer.”
Both IT, and individual employees, will face blockers. There won’t be an authorized solution for their needs, and those needs may well be extremely urgent. At a time when businesses are extremely worried about their financial position and ability to operate, there will be pressure to throw caution to the wind and protect ‘business as usual’. This pressure may even come from the top. Security leadership must do the best they can to both push back against rash decisions and provide creative solutions.
Well-meaning employees will get creative, and responsibility will be delegated to team leaders to “do what it takes”. It may be impossible for security to police this centrally but monitoring vigilance will be required to spot risky behavior and non-compliance. This is easier said than done; the SOC will be asked to monitor for incidents in a sea of change. Existing use-cases and rules will not apply, and companies will need a more proactive and dynamic approach to detection and response.
5. Malicious insiders and malicious housemates
Unfortunately, there will be some within our companies that want to kick us while we are down. Sudden remote working is a godsend to malicious insiders. Data can now be easily taken from a company device over USB within the privacy of their own home. Security monitoring may be crippled or disabled entirely. This risk is harder to address. It may not be eliminable, but it can be balanced against the need for productivity and access to data.
We should also be wary of those around us. We all hope we can trust the people we live with. But from a company perspective, employee homes are zero-trust environments. Confidential conversations will now be conducted within range of eavesdroppers. Intellectual property will be visible on screens and monitors in living rooms around the world. This risk is greater for younger demographics likely to be house-sharing, but it remains for all workers; delivery personnel, visitors to the house – they could all potentially steal a company laptop from the kitchen room table. Education of employees in particular risk groups will be key.
Finding direction in a sea of digital change
All of the above changes and risks create a monitoring nightmare for SOCs. We are entering into a period of digital unknown, where change will be the new normal. Data flows and topology will change. New technology and services will be deployed. Logging formats will be different. The SIEM use-cases that took 12 months to develop will need to be scrapped overnight. For the next few weeks, business practice will shift rapidly.
Static defenses and rules will not be able to keep up, no matter how diligently and rapidly we rewrite them. How will you spot a malicious login attempt to O365 in your audit logs now that connections are coming from thousands of different locations around the world? Companies need to leverage technology that can allow them to continue to operate amidst uncertainty without choking productivity at this critical time. More critical still, containing those threats is of paramount importance – it won’t be feasible to entirely quarantine an infected machine if it cannot be re-imaged or replaced for days.
AI systems that can continuously evolve and adapt to change will provide the best chance of detecting misconfigurations, attacks, and risky behavior – when you don’t know what to look for, you need technology that is able to identify patterns and quantify risks for you. Autonomous Response technology can also surgically intervene to halt malicious activity when teams can’t be there to stop it, protecting devices and systems whilst allowing essential operations to continue unaffected.
Evolutions: Meeting the challenge head-on
Confronting these threats will not be easy. It will require a mixture of hard work, creativity, and new technology, alongside an openness to new ways of working and a willingness to embrace dynamic, proactive defense, instead of traditional rigid policies. However, placing trust in defensive systems to autonomously protect employees will be the single most effective way of maintaining resilience and security when our static defenses have failed us.
At Darktrace we are working hard to help our customers get even more value from their Cyber AI platform throughout this difficult time, and ease workloads of busy security teams. We know that with the right tools and technologies – from Autonomous Response and Cyber AI Analyst, through to the Darktrace Mobile App – these teams will be able to navigate these stormy waters. In this unprecedented period of uncertainty, the need for security that evolves in step with your changing digital business has never been greater.
![The process line referencing weiss.neighb0rrol1[.]ru, as observed by Darktrace / ENDPOINT.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/697c82e78da2d2ce709ae48c_unknown.png)
![Example of a fake CAPTCHA on the compromised site www.allstarsuae[.]com.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/697c8366f0bb2cc1b6d45b83_unknown.png)
![JavaScript hosted on the compromised site www.allstaruae[.]com.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/697c86643749feb018e9c675_161%208361%2C.png)
![Darktrace’s detection of the POST request to bsc-testnet.drpc[.]org.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/697c86886decd09446e998af_unknown.png)
