In this pandemic, the urgent need for businesses to maintain productivity and continuity became top priorities, while security took a backseat. However, not many realize that cybersecurity readiness is actually a form of business continuity that is just as critical, more so as we make our homes the new workplace and collaborate over residential Wi-Fi networks.
Just last year, a month before the pandemic lockdown was put into place, cybersecurity firm Kaspersky reported that the Philippines topped Southeast Asia for two years straight in terms of internet-based threats. Months later, a series of cyberattacks targeted toward different private and public entities ensued, from a Telco giant's social media account to several student portals and government agency sites, risking and compromising sensitive personal information.
"At the end of the day, in our transition to remote work, it is critical not to let our guard down and sacrifice our security and privacy. This is why, we at HP, continues to deliver on the best-in-class security technologies to empower the Filipino workforce so that they can work and collaborate securely," said Christian Edmond Reyes, Philippines Managing Director, HP Inc. "As more company devices leave the protection of the company network, sustainable recovery and success has become a security decision."
The threat to small businesses
According to Verizon’s 2020 Data Breach Investigations Report, more than a quarter of all data breaches perpetrated this year targeted SMBs, which often are less prepared to prevent or respond to an attack than large enterprises. Within two months of the outbreak, 13% of small businesses reported that they had been victims of an attack.
Hackers have discovered that they can often penetrate an SMB’s network more easily. According to Matthew Gardiner, principal security strategist for the cloud-based security provider Mimecast, a few years ago, SMBs were not as targeted, but as security got better at big companies, attack patterns shifted to small and medium-size businesses.
He added that the primary avenue of attack against SMBs is in the form of malicious emails that often contain harmful links or attachments. While some of these emails are generic, poorly written, and easy to spot, others leverage real information to mimic trusted senders requesting sensitive data.
The recent study by Mimecast revealed that impersonation attacks grew by 24% between January and June. The study, which analyzed more than 195 billion emails, found that these attacks typically use subject lines containing words like “invoice,” “order,” “PO,” or the names of well-known courier or shipping companies.
“Some of these can look very convincing because they can, in an automated fashion, pull graphics off your website, so the email that comes through might have your company logo on it and look superficially quite legitimate,” explains Ian Pratt, HP’s global head of Security.
Preventing cyberattack in a remote workplace
The new work-from-home environment not only makes it more difficult for companies to respond to suspicious activities, it also expands the attack surface into the home.
Internet of Things (IoT) devices in the home — which range from smart appliances to social or gaming devices to wireless printers — can provide a less-secure avenue for hackers seeking to gain access to the home network, which is often shared with workplace laptops, explains Shivaun Albright, HP’s chief technologist of Printing Security.
“Unfortunately, IoT devices commonly found in the home are not as secure because they are often missing key security features such as firmware updates,” she says. As soon as a single employee’s laptop is compromised, the corporate network can be at risk, threatening the entire business.
It’s for these reasons that HP printers come equipped with the highest-possible security settings in place right out of the box. “We’re shipping small-business and home printing products with unique passwords,” she says.
HP printers can also proactively detect and thwart a malware attack from outbound DNS network packets on those printers equipped with the HP Connection Inspector. Once an attack is detected, the device initiates Sure Start, a process that returns the device to a safe and secure state.
Mixing work devices and home environments
Gardiner says that there are a number of steps individuals can take to prevent phishing or impersonation attacks, and simple education on best practices from employers is key.
“The list is fairly long on basics, but certainly includes multifactor authentication and more sophisticated and automated anti-phishing, and then behind your technical controls you need to have your people and your processes resilient to cyberattacks,” he says. “Just very simple things can help, like looking closely at the full email address in the ‘From’ line rather than just the name of the sender, to check that the domain is the correct one for your organization,” adds Pratt. “Although these, too, can be forged or compromised, in most cases the scammers don’t bother, so it’s a useful check.”
Keeping software up to date, enabling two-factor authentication, choosing strong passwords, and using a password manager can also go a long way in protecting small businesses from hackers.
Pratt adds that choosing technology designed with security in mind can significantly mitigate the risks and reduce the potential damage caused by an attack. For example, HP PCs come standard with HP Essential Security, a suite of security features including HP Sure Sense and HP Sure Click, which proactively prevent threats and ensure fast recovery if an attack does happen. SMBs can upgrade to HP Pro Security for advanced protection against malware and phishing attacks.
“Sure Sense is a next-generation approach to spotting malware that uses machine learning and artificial intelligence to stay ahead of attackers,” Pratt says. “When the user clicks on a potential phishing site that is trying to steal their credentials, we can alert them that they shouldn’t enter any passwords or other details.”
HP Sure Click provides an added layer of protection without relying on detection. “Basically, for any potentially risky activity — like opening an email attachment or clicking on a link — it’s going to create a virtual machine in the background, a disposable computer, to perform that particular task,” Pratt explains. “That disposable computer is going to live just for the life of the task, and only have the access and resources required for that task, no more. When the task finishes, that virtual machine is automatically thrown away.”
While many small businesses equip their staff with generic cybersecurity software, Pratt warns that such services are often insufficient to protect them against increasingly sophisticated attacks, especially in a remote workplace setting.
“Just using anti-virus software isn’t enough these days,” he says. “Now everybody has to take this stuff more seriously and use more sophisticated approaches to security.”
For more information on how you can optimize your learning and working experiences from home and remote work sites, please visit the official HP flagship store at Lazada and Shopee or visit HP.com.