On Wednesday, the FBI released a PSA (I-040120-PSA) on threats associated with the increased use of virtual environments (https://www.ic3.gov/media/2020/200401.aspx). With the massive increase in remote and telework, the attack surface (i.e. the available prey for hackers hunting online) has massively increased. The term “shooting fish in a barrel” is very relevant and likely underestimates the risk to businesses and governments. A few things stand out:
- Terms of Service – read them! As the recent Zoom issues highlighted, free software is not free. If you or your organization aren’t paying a license fee, then you and your data are how those companies are making their money. The data sharing economy has made this freemium model ubiquitous. As a leader in your organization, make sure your security, IT and/or risk leaders have read the terms of service for each product in use – you will be surprised how many tools claim ownership of your corporate data. Choose ones that prioritize protection of their customers and their data.
- Immature Security – while online collaboration tools have security features, most weren’t designed to protect against sophisticated Chinese or Russian attacks. With the rapid increase in the use of tools like Zoom, they have become a lucrative target for nation-state hackers. Look for tools that have supported Federal Government customers, especially the DoD, as they have usually gone through strict vetting procedures.
- Limited or Shared Resources – to keep costs low or to rapidly grow capacity, organizations regularly purchase refurbished equipment, allow Bring Your Own Device (BYOD) or, in cloud computing, share resources with other companies. In both scenarios, you are opening your company to threats from poorly maintained or recycled equipment, or from data leakage with poorly designed collaboration tools. Focus on systems that allow single tenancy (one organization per installation), comprehensive isolation (beyond browsers and applications) and leverage virtual desktop interfacing (VDI) or similar as they can mitigate the issues of poorly refurbished or employee provided computers.
Finally, many of the suggestions in the FBI letter rely on your employees and system users to be vigilant for recognizing scams and suspicious online activity. The more platforms and technology can automate these best practices, the more proactive our defenses will become and the less we will have to worry about human error.
As a Public Benefit Corporation, Grey Market Labs was created to help protect life online. If you are concerned about Data Privacy and Employee Protection (especially for your most sensitive work), please reach to us directly: info@greymarketlabs.com. We can guide you through these privacy and cybersecurity challenges and, if our products are not the best fit, recommend one of our vetted partners to best meet your needs.
