As millions of workers log into work from home to avoid the spread of COVID-19, there’s the risk that they could increase the chance of exposure to another kind of virus, the kind that can lock up corporate networks.
On Wednesday, the World Health Organization declared the coronavirus that causes COVID-19 a pandemic, a move that will surely boost the number of companies asking employees to work from home. The number of companies that have made that move has grown quickly in the past week, with Alphabet Inc.’s GOOG, -5.08% GOOGL, -5.04% Google encouraging its 119,000 North American employees to work from home, if possible, on Tuesday.
Read: Coronavirus has prompted these tech companies to ask employees to work from home
Chenxi Wang, managing partner at Rain Capital and a former Forrester Research analyst, told MarketWatch that companies like Google are well-prepared for such contingencies as they’ve long had a culture of remote working. Other companies, especially ones that rely heavily on on-premise network security protocols, may not have it as easy.
“For a more traditional company,” Wang said, “this change is going to be difficult, because what they have done is they’ve relaxed security of devices within the perimeter, and now this device has to be taken out of the perimeter [and is] sitting in somebody’s house.”
Yaniv Balmas, head of cyber research at Check Point Software Technologies Ltd. CHKP, -2.15% , told MarketWatch that cyberattackers seeking to take advantage of an influx of employees working from home for the first time would likely pivot to focusing on online services that are being used more than usual.
Services that are getting much more use include teleconferencing software like Zoom Video Communications Inc. ZM, +1.67% and workplace-messaging options like Slack Technologies Inc. WORK, -5.75%. While the S&P 500 index SPX, -4.89% is down 14% for the year, and the ETFMG Prime Cyber Security ETF HACK, -5.03% is down 15% in that time, Zoom shares are up 66% and Slack shares are up 9%.
Before coronavirus panic started ramping up, Check Point in January pointed out a security flaw in Zoom that allowed intruders to eavesdrop on meetings.
“Today, since everybody is using these remote services, this attack surface becomes much more attractive,” Balmas said.
Paul Martini, chief executive of iBoss Inc., said the coronavirus-inspired work-from-home push really underscores a problem of compatibility between traditional in-house network security appliances and cloud-based mobile devices. Boston-based iBoss offers secure web gateway services, and began a partnership with FireEye Inc. FEYE, -7.35% back in October to provide that company’s threat intelligence product as a service.
“The biggest problem is that these organizations have moved their applications to the cloud — meaning [Microsoft Corp.’s MSFT, -4.53% ] Office 365, Dropbox DBX, -7.07% , Zoom — but the problem is that the connections to those applications at a lot of these organizations sit inside of a building, so while the applications are safe while you’re in the building, what they’re missing is that these users, as soon as they leave that building, those connections are still required to access those applications,” Martini said.
Martini said iBoss allows for a network security perimeter at the device, or user, level — basically providing a face mask for employees when it comes to computer viruses.
See also: Why coronavirus and the flu actually aren’t that similar
Just as people are being urged to be more mindful in practicing respiratory hygiene for coronavirus, Check Point suggested that at-home workers be more mindful of their online hygiene. For employees, that means being more wary of clicking on suspicious links, especially those related to coronavirus, seeing that attackers are banking that fear will better prompt victims to click without thinking. Check Point said that domains related to coronavirus are 50% more likely to be malicious.
Check Point said that employees working from home should use a company-approved device and consult their IT department if they will be using a personal device to connect to corporate networks. Also, employees connecting through their home Wi-Fi need to ensure that they have a strong password, and to avoid using public or unsecured networks, Check Point said.
Read: If you can work from home, consider yourself fortunate
Rain Capital’s Wang suggested now is a good time for new at-home workers to refresh their passwords into something stronger and to turn on multifactor authentication if they haven’t already, and to become more aware of phishing attempts.
Beyond concerns about insecure internet connections, in-house network security appliances could become overwhelmed by the volume of outside traffic with a massive influx of people working from home. The option of just letting work-from-home users avoid that crush by using the public internet is even worse, iboss’s Martini said, as that offers no defense from trolling hackers.
That kind of volume surge can get pricey if companies are not prepared for it, Rain Capital’s Wang told MarketWatch.
“So there’s not only the security side, the problem is also the cost and volume of network traffic,” Wang said. “When you work remotely you connect back into the company’s servers through [virtual private network], and VPN is designed with the model that it’s only used occasionally.”
See also: What Apple, Microsoft, GE and other U.S. companies are saying about the coronavirus outbreak
“Eventually, I think this is a good thing for security in the sense that we’ll have to get used to remote working through this period of time and possibly this will push all the companies who have this traditional defense mind-set to go to the more zero-trust mind-set, which is what Google’s doing,” Wang said.
The recent work-from-home rush has been big business for iBoss as companies scramble for what might be the new normal, Martini said. The company, which has received Series A funding from Goldman Sachs, said back in October it could launch an initial public offering sometime this year.
“It’s massive. It’s crazy. Literally, we’re getting requests, ‘We’re closing the office in 24 hours, we can’t have people go home,’” Martini said. “Even if they don’t care about malware, their compliance and regulation mandates that you run intrusion prevention on the connection.”
