CM October 2021

INSIGHT
AUTHOR – Leanne Salisbury
Leanne Salisbury
By masquerading
as a trusted entity,
the threat actor can
create a sense of
authority and play on
the fear of people as
they look for security
and assurance from
trusted institutions.
Pre-pandemic awareness of phishing
(targeting via email), vishing (targeting via
voice call) and smishing (targeting via SMS
text messaging) was already on the rise, and
many companies were already providing
security awareness training on the subject
for employees. However, the fear around
COVID-19 allowed criminals to ramp up
exploitations and take advantage in cases
where perhaps previously individuals
would have paused and considered the
email more carefully. Malicious file
attachments containing malware payloads
had COVID-19-related titles and prompted
the receiver opening a file containing
malware. There were also malicious
android apps that claimed to have real-time
trackers but instead aimed to get the user
to provide administrative access to install
"CovidLock" ransomware on their device .
WEBSITE DOMAINS
Some threat actor groups went a step further
and registered new website domain names
containing wording related to COVID-19
or Coronavirus. During a six-week period
in early 2020 the United Nations Office
on Drugs and Crime (UNODC) reported
that as of the end of March 2020, more
than 9,000 domains were registered with the
Coronavirus theme. While some were set
up for legitimate reasons, many presented
information related to the pandemic only as
a lure for malicious purposes. Using these
domains, attackers could bypass the need
to obtain victim email addresses and then
send a phishing email with a malicious
attachment or link. The malicious website
could be used as a mechanism to deliver
malware and obtain credentials through
direct access by the victim landing on
the page.
Video and teaming apps also proved to
be an area of weakness. At the beginning
of the pandemic, the use of thirdparty
videoconferencing and teaming
applications grew exponentially as firms
– and individuals – used them to stay
connected. One of these in particular went
from being largely unknown to becoming
the most widely used app within weeks of
lockdown restrictions being implemented.
However, this popularity surge also made
them a target. A weakness in the application
opened the door for attackers, allowing
them to take control of certain sessions,
intercepting audio and video meetings and
injecting unsolicited content. While the
application provider has since managed to
fix the vulnerabilities, it demonstrates the
importance of firms’ system defences.
So how does a business successfully build
resilience into their operations? A good
multi-layered approach to controls and
the hardening of a system’s exterior shell
are critical for preventing attacks being
successful. Organisations must decrease
their ‘attack surface’ and make themselves
more difficult to target in the first place.
INSECURE NETWORKS
One of the most common methods
cyber criminals use to gain access to an
environment is to exploit insecure network
services, especially remote desktop
protocol (RDP). Having a comprehensive
understanding of all external-facing
systems along with implementing an
advanced Endpoint Detection and Response
(EDR) solution will enable proactive
techniques, such as machine learning and
behavioral analysis, to identify potentially
new or complex threats before they become
a critical issue.
As seen with the video conferencing
example, it is also crucial to manage thirdparty
risks. It is important to proactively
identify weaknesses in the supplier
landscape and have the ability to respond
quickly to manage incidents when they
occur. A robust due diligence process
that considers the inherent risk profile of
the supplier and service can significantly
help an organisation to identify potential
threats.
Threat actors are continually evolving
their tactics, techniques and procedures in
new and inventive ways, responding to realworld
events to capitalise on fear-based
behaviours and decision making. Ensuring
resilience is built in from the start,
including employee’s ability to respond and
react under pressure, is critical.
Leanne Salisbury is Senior Manager,
Technology Consulting, EY.
Advancing the credit profession / www.cicm.com / October 2021 / PAGE 18