Since February, when the outbreak went global, there has been a 4,300 percent jump in coronavirus-themed spam, according to a recent study by the Ponemon Institute and IBM. “Cybercriminals are using the coronavirus outbreak to drive their business, with virus-themed sales of malware assets on the dark web and even virus-related discount codes,” the study reports. “They are also rapidly creating domains. COVID-19-related domains are 50 percent more likely to be malicious than other domains registered during the same time period.”

The hidden threat comes from a big increase in the number of phishing attacks masquerading as messages from legitimate organizations, such as email phishing attacks purporting to come from the World Health Organization (WHO). Unavoidably, we have also seen data breaches in Indonesia amid the pandemic as reported in the media.

The concern is that many people forced to work from home lack the secure equipment and protocols that enable digital safety. With newly remote employees accessing corporate networks via personal devices, hackers are probing Wi-Fi configurations and Virtual Private Network (VPN) connections for security vulnerabilities. And as people congregate on cloud-based productivity platforms – both for work and personal reasons – malicious actors are launching schemes to exploit the situation, including hacking into and disrupting live meetings.

The tendency toward ad-hoc decision-making during crises only accelerates the opportunity to leak data or compromise business operations. The potential impacts are more dangerous, too. A distributed denial-of-service (DDoS) attack, for instance, can be far more damaging in an operational environment that is already strained for capacity than one launched when additional capacity is readily available.

However, in an interconnected digital world, one weak link is enough to offset the balance. Most organizations in Indonesia and worldwide are ill-equipped to handle a major cybersecurity incident, much less during a global crisis such as a global pandemic. The Ponemon study found that 76 percent of companies did not have an incident response plan applied consistently across the organization.

About 25 percent reported not having any crisis response or mitigation plans, or Cyber Security Incident Response Plan (CSIRP). An effective CSIRP would cover governance and communications practices and define how crisis response would be handled across the firm, including strategy, technology, operations, community and government relations.

Popular

Jakarta library reopens to packed rooms, long queues

Govt banks on Rp 500t inflows to international financial center

No short-cut for 100 GW renewable ambition