In the summer heat of May 2020 during the Covid19 pandemic the General Data Protection Regulation (GDPR) marked its two-year anniversary.
At the same time the risk posed by data breaches was, arguably, higher than ever before. And, in many ways, the sudden switch to home working caused by the virus was to blame.
Remote work and cybersecurity risk
On March 23 2020, the UK entered into lockdown as offices, restaurants and shops shut and all but ‘essential’ work became home-based.
On an unparalleled scale our workforce became dispersed. In June the Office for National Statistics (ONS) announced that nearly half (49%) of all UK workers were home-based.
Remote working did not happen gradually – it happened in the blink of an eye. Although some businesses had facilities for remote access these quickly revealed their limitations as increased demands were placed upon them.
During the initial stages of the pandemic businesses had no option but to move quickly and amend existing practises or processes to enable their teams to work from home.
The alternative was a complete shutdown during lockdown.
But how thorough were checks being made to ensure privacy and prevent cybersecurity risk?
The European Data Protection Board (EDPB) has periodically released statements about GDPR and its continued – if not increased – applicability during the Covid19 outbreak.
The Information Commissioner’s Office (ICO) also published a guide to what you need to know about data protection during the pandemic. On the subject of homeworking, it says:
‘Data protection is not a barrier to increased and different types of homeworking.
During the pandemic, staff may work from home more frequently than usual and they can use their own device or communications equipment. Data protection law doesn’t prevent that, but you’ll need to consider the same kinds of security measures for homeworking that you’d use in normal circumstances.’
As difficult as this is to navigate pandemic or no pandemic – if a security breach is caused by transferring data from/to a home worker’s device or by data held on it – then it is business as usual and your business will be responsible.
It is worthwhile to compare this to the ICO’s approach to the requirement on businesses to respond to data subject access requests (DSARs).
Here it is clear that a ‘grace period’ has been initiated.
‘We understand that resources, whether they are finances or people, might be diverted away from usual compliance or information governance work.
We won’t penalise organisations that we know need to prioritise other areas or adapt their usual approach during this extraordinary period.’
Major data security risks during Covid 19
Some of the ways that businesses may have become exposed to greater risks of data breaches include:
- Unsecured networks
Home workers not connected to the secure corporate network will have used their own network which may well not have adequate filtering, firewalls and encryption available.
Staff who have not changed the default passwords on their routers are left open to eavesdropping and man-in-the-middle attacks unless they use a virtual private network (VPN).
- Unchecked devices
Many remote workers will choose to – or need to – use their own devices. This greatly decreases IT’s control and increases the risk. Not only is patch management now beyond centralised control, the fixing of security vulnerabilities is also no longer guaranteed. Staff may visit sites or download apps that would normally be blacklisted and should their device be infected by malware any information stored on the device is accessible.
- Cloud services
With the urgent need for collaborative tools and platforms many businesses will have opted for Cloud services that can potentially introduce further risk to networks.
- The human factor
The vast majority of malware – as much as 99% by Proofpoint’s estimate – is delivered via phishing campaigns. A remote workforce no longer has nearby neighbours to quickly check the status of a mail or webpage. Hackers proved to be only too aware of this as phishing attacks exploiting the coronavirus outbreak caused attempted hacks to soar during the second quarter of 2020.
Continued security risks
The ONS transport figures used to assess the return to the office suggest that most commentators agree that hybrid work or remote work will be a continued part of our office culture for a long time to come.
And therefore the security risks remain.
Businesses must actively revisit the changes that the pandemic foisted upon their working practices. The risks must be thoroughly assessed on an ongoing basis. The danger of issues with certification or costly data breaches are only too real.
How MDR can monitor your extended network
The risk of endpoint penetration has multiplied enormously as access points to networks increase exponentially.
Increasingly Managed Detection and Response services (MDR) are being deployed to ensure 24/7 monitoring of their entire, extended network and proactive reductions of risk.
As potential breach points from devices grow it is increasingly unrealistic to expect inhouse IT teams to effectively monitor threats. Especially right now, they don’t have the time, resources, technology or talent to maintain a round-the-clock monitoring, rapid detection and immediate response to increasingly sophisticated attacks on an ever-more diffuse network.
Falanx Cyber offer a UK-based Security Operations Centre staffed by security-cleared analysts that can continuously protect your entire, distributed network.
Proactively discovering vulnerabilities and weaknesses in your network, Falanx Cyber MDR also identifies potential threats from your remote users and third-party networks.
It’s not just network’s and device’s endpoints that are protected, however, as your servers, apps and cloud services are also monitored 24/7.
MDR frees up your IT team to focus on strategic matters as businesses pivot and agilely adapt to new economic circumstances.
It is both the security and freedom that MDR gives that appeals.
If you are concerned about how Covid19 has affected your GDPR-risk in 2020 we’d love to demonstrate how you can proactively monitor the risks hybrid work may have introduced
To find out more about how Falanx Cyber’s MDR can maximise your security monitoring and response whilst minimising the internal burden, call our team on +44 (0) 20 7856 9450 or email us at Salesenquiries@falanx.com.
