There’s no separating the lives we live offline from our online presence anymore. Being “connected” used to mean having a cellphone in one’s pocket, and a laptop nearby, at the ready. Not today. Today, we are digitally connected to everything – from the smartwatches we wear, to the vehicles we drive, to the cities where we live, work, and visit. We are increasingly becoming not only connected to more devices, but also more persistently connected to our devices.
Of course, these trends were well underway prior to 2020, but the novel coronavirus pandemic, and the public health response to it, accelerated them. According to consumer data provider Statistica Research, the global smart home market could exceed $141 million by 2023. Increased connectivity is also happening at the office (or the remote office). Businesses are investing billions annually into digital transformation investments. These efforts include not only improving their business workflows, but also increasing mobility and Internet of Things (IoT) deployments. This way, they can create more responsive supply chains and improve customer experiences.
In theory, all this increased connectivity improves our lives, as we have better access to more people and information, and of course, to just about any type of entertainment imaginable. Unfortunately, it’s not all good news. This increased connectivity means cyber-thieves and other attackers are just a click away. Every day, bad actors find new ways to take advantage of the increased connectedness of our everyday lives and the ever-expanding attack surface created by newly-remote workers.
Our Connected Daily Life
The modern-day increase in attack surface is extensive. Each new connected device, each application that runs it, and each system in the background that supports it, all create potential points of attack. These weak spots include network vulnerabilities, configuration errors, zero-day software vulnerabilities, out-of-date software patches, poor password credentials, users who decide to click on dangerous links or download unsolicited attachments, and more.
It’s important that everyone is aware of the risks posed by our connected world, including device makers, governments, enterprises, and end users. Building such awareness is what Cyber Security Awareness Month is all about. This October is the 16th annual Cyber Security Awareness Month, and a lot has changed since the inaugural October back in 2004.
In 2004, most computer work was done at the worker’s desk, and the IoT and social media was in its infancy. Back then, the founders of Cyber Security Month, the Department of Homeland Security, and the National Cyber Security Alliance, launched Cyber Security Awareness Month to kick off a broad effort to help Americans become more aware of the risks they face online.
Increased Connectivity, Increased Risk
In this day and age, virus definitions in the form of signatures are essentially outdated the moment they are released; in October 2020 alone, the independent IT security institute AV-TEST registered 5.63 million new pieces of malware, bringing the total number of new pieces of malware registered by the institute to 1.1 billion, just for 2020.
With numbers like this in play, security software that relies on signatures to keep users safe is facing an unstoppable tidal wave. In the fight to keep both home and enterprise networks safe from malware, viruses, ransomware, and so on, ‘next generation’ antivirus software now employs more up-to-date security methodologies. The powerful technologies of artificial intelligence and machine learning literally ‘train’ endpoint protection models to recognize what malicious behavior and files look like, and prevent them from running in the first place.
Similarly, this blog series published throughout Cyber Security Awareness Month 2020 will empower all users to own their role in security by proactively learning to recognize cyber threats, and taking steps to reduce their own personal risks.
And the risks are considerable. Consider IoT security. The security of IoT devices is a challenge for consumers and enterprises alike. Consumers are increasingly automating their homes with Internet-connected devices for the sake of convenience, buying lights they can control through their WiFi, and acquiring entertainment systems that they can manage through voice command.
Virtually anything that can be connected to the Internet is being connected, and it’s not just home devices – enterprises also face the same type of risks when it comes to enterprise IoT, with the Internet connection of systems that are used to manage complex office buildings and office parks, as well as trucking fleets, medical devices, farming infrastructure, manufacturing and more.
What kind of dangers are we facing, as more and more ‘things’ are connected to the Internet? A few years ago, researchers found that they could gain control of certain functionalities of the Jeep Cherokee while it was moving. They were even able to cut the vehicle’s transmission. Since then, thousands of IoT devices have been accessed by threat actors and exploited, including webcams, medical devices, and even smart fish tanks.
Our connections are also extending out from our homes, offices, and manufacturing plants with the rise of smart cities, which is the use of sensors and networks among communication technologies, citizens, and city infrastructure to help cities run more efficiently. For instance, one day, smart cars will be connected to, and interact with, traffic lights, traffic meters, charging stations, and even electric grids to make these systems more efficient through connectivity. The projected value of global IoT in smart cities will reach $330 billion by 2025.
Now that we are interconnected, and becoming more so every day, how do we better secure ourselves?
Trust: But Continuously Verify
One effective strategy to protect yourself in a connected world is simply to employ what’s been touted as Zero Trust policy (but what I like to refer to as “continuous trust”). Unlike traditional approaches to network and endpoint security, which typically require an authentication given once by a user or device, and then broadly trust the actions of the users and devices, the zero or continuous trust approach flips that calculation to “don’t trust unless you’re continuously verifying”.
AI supported math models now give us that capability. They go a long way toward securing traditional networks, and they will also go a long way to help secure all the networked devices that are persistently connected to networks.
Additionally, with the work-from-home trend likely to remain in place for some time, enterprises need to find long-term, sustainable ways to secure their remote workforces and their devices. This includes applying additional security protections to remote employees’ email, calendars, intranets, and web-based collaboration applications such as messaging platforms, along with common device operating systems.
Finally, everyone needs to be increasingly wary of their digital surroundings. People need to be more aware of what they are doing, and how to securely maintain the devices and applications they use every day in every part of their lives.
Enterprises can help employees by providing security awareness training, and integrating it into their day-to-day routines. Enterprises can teach their employees about phishing, the importance of keeping personal systems up to date, and good security hygiene such as proper password management. A little security education goes a long way, and can be built on during an employee’s time at a company to help fill gaps that even the best security software can’t fill, such as social engineering.
It’s important that enterprises step up to the task. According to a Capita survey, a full 92% of employees say that they believe it’s their organization’s job to secure remote working — but many don’t think their policies are effective.
Regardless of what security software a company uses or what policies it employs, every company can strengthen itself from the inside out by helping employees understand basic Internet security risks and assisting them in building good security habits. It’s a small step that will go a long way to helping us all be more secure while staying connected.
