Cyberattacks hit the news again this week as Twitter suffered a massive hack aimed at some of the country’s most recognized and wealthiest figures, including Jeff Bezos, Kanye West and Elon Musk.
According to a statement from Twitter, the hacked accounts urged followers to send money to a Bitcoin link and was “a coordinated social engineering attack by people who successfully targeted some of our employees with access to internal systems and tools.[i]”
Individuals and organizations of all kinds are at increased risk of cyber fraud during the COVID-19 crisis. When the pandemic crisis hit the U.S. in March of this year, CO-OP transitioned 80% of our workforce to remote work in a matter of days. This enabled staff to continue serving our credit union clients without a hitch.
That doesn’t mean the move was without risk. In fact, cybersecurity concerns were top of mind for Paul Love, CO-OP’s Chief Information Security and Privacy Officer. Paradoxically, he viewed it as more of a “people opportunity” than a technological challenge.
“If people feel stressed, they may not be thinking through their actions, whether it’s a business process or clicking on a link in an email,” Love says. “If they’re stressed out, they’re thinking about other things.”
But thanks to CO-OP’s culture of open communication and a strong focus on security, the team was well-prepared to handle the switch.
“I commend our organization for that,” Love says. “Our management was very good at openly and honestly communicating and showing they cared – it was very genuine. By taking care of employees and reducing their stress through open communications about the status of initiatives supporting COVID 19 , CO-OP took care of our credit unions.”
CO-OP keeps cybersecurity top of mind through annual security training, regular articles in the weekly employee newsletter and monthly “phishing” tests. Love’s team even educated staff on how to protect themselves online at home, in the hope they would then bring those positive behaviors to work. As it turned out, this level of preparedness helped ready the organization for the rapid transition to remote work.
“We’ve been working with our employees for the last three years to build a comprehensive security awareness program,” Love says. “Our people understand that security is everyone’s responsibility.”
CO-OP did have to make some technological adjustments to support the new remote working environment- these measures included increasing system capacity in the areas of virtual private networking (VPN), increases in software licenses and other capacity adjustments. However, CO-OP was well positioned for this as part of our overall technology transformation that began back in 2017.
COVID brings new threats and challenges
Love warns of several new and emerging cybersecurity threats that have arisen since the start of the pandemic. He’s seen an uptick in phishing emails, particularly those that capitalize on current news and fears of catching the virus.
“These types of attacks generally increase during disasters, significant company changes (mergers, leadership changes, etc) or other disruptive events, Love says. “The attackers know that during chaotic or stressful times, people will lose their focus and are more susceptible to attacks that would not normally work during less stressful times.”
Security teams are also seeing increased probe perimeter and cloud server attacks by cybercriminals hoping to take advantage of understaffed departments.
Credit unions should prepare for increased social engineering spoofing attacks on call centers, as criminals try to access member accounts during a time of higher call volumes and situationally-modified verification processes.
“The fraudsters are contacting credit union call centers pretending to be a member, because they know that right now call centers are probably overwhelmed and may even be understaffed, or that protocols for verifying account holders may have been relaxed to support increased call volumes,” Love says. “Making sure to verify your credit union members when they call in is very important.”
CO-OP has maintained best practices in security and member authentication throughout the crisis, and will continue to do so to protect our clients and their members from potential account attacks.
Navigating a return to “normal”
For credit unions that are supporting a remote staff for the first time, or are now beginning to reopen and transition staff back into the office, Love has some tips for managing the process securely and safely:
- Educate staff on threat awareness: With the recent rise in phishing scams and other cyber-threats, team preparedness is critical. Make cybersecurity topics a regular part of your staff meetings and internal communications.
“Ensure your staff understand their roles and the threats they’re facing,” Love recommends.
- Encourage timely reporting of incidents: Staff shouldn’t be afraid to make mistakes, or to report security breaches when they occur. Cultivate a healthy atmosphere of open and honest communication, treating every incident as a learning opportunity and offering additional training when necessary.
“If someone accidentally clicks on a phishing email, make sure they know who they can contact and that they should,” Love says. “The more punitive you make your program, the less likely people are going to tell you when they’ve been targeted. Instead, have a process in place for educating and discussing issues with repeat offenders.”
- Track all changes to security protocols: This one is critical. As branches and back offices shut down and employees began working from home, many credit unions had to adjust their standard security protocols to accommodate member and staff needs.
“Before you transition staff back to the office environment, take stock of all adjustments that were made, with an eye toward determining if they are still needed. As soon as practical, consider reinstating best practices like system logging, data backup and redundancy, and member authentication and verification procedures. If you envision long term remote work, take an inventory of the changes you made, even if you aren’t reverting back to normal operations and evaluate whether the changes are appropriate for your current situation.”
- Bring your security team into the loop: Now more than ever, credit unions must rely on a skilled and experienced information security team, Love advises.
“Having the security team involved in the business continuity resumption and the return to normal operations is absolutely critical because they are constantly thinking about security and are able to provide expert guidance.”
As you begin to transition your workforce back to the office, leverage CO-OP’s industry-leading Fraud Mitigation Tools to help you address today’s cybersecurity and fraud risks.
Sources:
[i] “Twitter says hacking of high-profile Twitter accounts was a ‘coordinated social engineering attack’,” CBS News, July 16, 2020. https://www.cbsnews.com/news/twitter-hack-verified-accounts-social-engineering-bitcoin-scam/
The original article Cybersecurity for a Remote Workforce: How to Protect Your CU Against COVID Threats can be found on Insight Vault.
