Cyber Threats Ramp up During COVID-19 Crisis

Cyber Threats Ramp up During COVID-19 Crisis 

Written by Chandra Majumdar, EY Canada

*Editors Note: Happening through October, Cyber Security Awareness Month is an internationally recognized campaign that aims to ensure Canadians are more secure online, by being informed and knowing the simple steps to take to protect themselves, their families, their workplace, and their devices.

The middle of a crisis is the last place you want to learn you have a cyber security problem.  This unfortunate reality happens to be when a company and its employees are often most vulnerable.  Online workforces and rapidly implemented digital tools are exposing mining and metals companies to greater cyber risks, and opportunistic attackers are using the current landscape to ramp up their efforts to exploit fear and confusion.  Knowing what to look for and how to prepare for this new wave of threats is the first line of defence. 

How are Threats Evolving? 

Cyber security was a growing threat for miners long before the pandemic – it was listed among the top 10 business risks and opportunities facing mining and metals for the last two years.  And the EY 2020 Global Information Security Survey shows that across the country, 66 per cent of Canadian security leaders have seen an increase in destructive cyber attacks over the last 12 months.

The outset of the pandemic saw an evolution of cyber threats that many didn’t see coming – threat actors began capitalizing on quarantine measures compromising companies’ incident response effectiveness and crisis management resources.  Phishing and targeted spear-phishing campaigns quickly rose as attackers used the pandemic as click-bait to gain access to information through employees.  

The Centers for Disease Control and Prevention (CDC) in the United States, for example, was a target for this kind of activity.  Attacks seek to “spoof” – or closely mirror – the CDC’s email address and trick receivers into believing they’re clicking through to a trusted source.  Similarly, emails containing links, such as cdc.org or cdcgov.org, are popping up and redirecting users to fake login pages for Microsoft, Facebook, and Google, where attackers can steal user credentials. 

While countries progressive deploy business reopening plans, many employees will still continue to work remotely online.  These individuals are likely to store corporate data to personal cloud accounts, sync corporate passwords to personal browsers or keychains, enable print from home devices, store sensitive information on open team rooms – and the list goes on.  Such unsafe practices leave valuable information open and unsecure, increasing the potential attack surface. 

How Can you Protect Yourself and Your Business?

Mining and metals companies – and their employees – aren’t immune to the recent uptick in attacks.  Companies need to ensure their data, communications, and interactions are safe and that virtual infrastructure is secure at the enterprise level and with third parties such as suppliers, customers, and contractors.  Having the appropriate measures in place to secure the organization and properly detect and respond to threats can allow companies to decrease exposure to potential cyber attacks. 

Companies should consider these tips to help protect the business: 

• Centrally manage and administer robust tele-working solutions to empower and enable employees, customers, and third parties.
• Ensure all systems are patched and the latest updates are installed. 
• Update security policies and educate employees on how to expunge information that has inadvertently been stored to personal accounts.
• Leverage role-based rather than location-based identity and access management solutions, analytics, and controls.
• Establish second-factor authentication for formerly in-person processes, such as manual phone calls, a system of shared secrets, or other authentication controls.
• Conduct mock phishing exercises and educate employees on the dangers of phishing. 
• Provide links to official resources for pandemic-related information to avoid the spread of disinformation within your organization. 

Readying for Recovery 

The pandemic’s impact on the workforce, operations, and supply chains has highlighted the need for mining and metals companies to continue their digital acceleration and investments in technologies, such as automation, artificial intelligence, and blockchain to ensure worker safety, profitability, productivity, and – ultimately – business continuity and resilience.  In fact, nearly all responses in a recent EY mining industry webcast indicated that they’re increasing their focus on digital transformation in light of COVID-19. 

With greater investments in digital and data optimization on the horizon, now is an opportune time for companies to embed security considerations into their business processes.  Security needs to be embedded within business processes from the get-go to reduce risks, cut costs, and build a more secure working environment for all.

While the current landscape of the pandemic will eventually stabilize, companies can’t lose sight of the fact that cyber threats will follow them into the recovery phase of COVID-19.  Thinking long-term and big picture can help organizations strengthen their defences during this current extraordinary situation.  Demonstrating a commitment to building greater cyber resiliency can help to maintain stakeholder trust and business reputation in an era of heightened scrutiny.

About the Author

As EY Canada’s Cyber Threat Management Leader, Chandra Majumdar is responsible for building a cyber threat management practice that offers managed threat detection and response; threat and vulnerability management; and threat intelligence, security assessments, and adversary simulation.  He has extensive experience in managing CERT, leading incident response, threat detection, penetration testing, and vulnerability management for IT, OT and IoT systems.  For more insights on navigating these unprecedented times, visit www.ey.com/en_ca/covid-19

About EY

EY is a global leader in assurance, tax, strategy and transactions and consulting services. The insights and quality services we deliver help build trust and confidence in the capital markets and in economies the world over. We develop outstanding leaders who team to deliver on our promises to all of our stakeholders. In so doing, we play a critical role in building a better working world for our people, for our clients and for our communities.

For more information, please visit ey.com/ca. Follow us on Twitter @EYCanada.