Top cyber threats agencies should have on their radar

Since organizations transitioned to home offices, both the frequency and the severity of cyber threats have increased, and government agencies are taking note. Indeed, a 2020 Netwrix Cyber Threats study found that 29% of agencies consider themselves to be at greater cybersecurity risk than before the pandemic. Of those, 86% are worried about the sophistication of cyberattacks -- and those fears are well founded. A September 2020  Microsoft report pointed out that threat actors have rapidly increased in sophistication over the past year, noting that government organizations are the third most targeted vertical, after non-governmental organizations and professional services. To defend themselves, government cybersecurity teams must pay particular attention to the following three cyber threats.

1. Misconfiguration of cloud services

In fiscal 2020, federal agencies planned to move 272 IT programs to the cloud and were considering migrating about a thousand more. As dependence on cloud services grows, the cost of admin mistakes increases as well. Misconfigured storage services, which are present in 93% of cloud deployments, have contributed to more than 200 breaches and cost $5 trillion over the past two years. According to the Cyber Threats survey, when public-sector employees had to go remote, the number of agencies concerned about cloud misconfigurations skyrocketed from 25% to 88%.

This year, adoption of cloud services was fast-tracked at many agencies due to the overnight move to remote work for thousands of employees. Therefore, agencies should check for gaps in security controls and processes that might have been introduced due to lack of time to plan and test the transition.

In addition, some vulnerabilities have been introduced as a result of a lack of clear understanding of the shared responsibility model: While cloud providers are responsible for security of cloud infrastructure as a whole, organizations must manage the data they store in the cloud, including permissions and application or service configuration settings. Agencies should be sure to keep this model firmly in mind when planning their security strategy.

Finally, government organizations must pay attention to detection capabilities. This includes not only quickly spotting attackers in the environment, but also promptly identifying unwanted configuration changes that could put the network at risk. Human errors tend to increase in unfamiliar environments when staff is under stress, so agencies need a mechanism to uncover and fix errors before they cause trouble. The Cyber Threats survey revealed that 37% of agencies needed weeks or months to detect mistakes by IT staff during the first three months of the pandemic, which dramatically increased risk. 

2. Phishing

Since the onset of the COVID-19 outbreak, phishing emails have flooded mailboxes, both personal and corporate. According to research, email scams related to COVID-19 surged 667% in March alone, with Cyber Threats research finding that 53% of public-sector organizations have suffered phishing scams. While the average mean time to detect such attacks is minutes or hours, 30% of government organizations took days to discover these incidents and 5% needed months.

Spam filters and employee training are good measures to help protect against phishing scams. However, business email compromise attacks are getting more sophisticated, so agencies should make every effort to minimize the risk of a user clicking on a malicious link or attachment by keeping their spam filters constantly updated and increasing and improving user training and awareness initiatives.

Organizations must also recognize that some attacks will succeed and take steps to minimize the damage that an attacker or malware infection could inflict. Anti-malware and endpoint protection can mitigate many of the simpler attacks, such as “drive-by compromise” threats. Careful network segmentation, privileged account management and least-privilege access policies will ensure that attacker don’t get the keys to the kingdom by compromising any single account. Solutions for monitoring and detection will enable agencies to spot abnormal access to email or other data to contain and remediate incidents faster. 

3. Accidental data sharing

IBM’s 2020 Cost of Data Breach Report revealed that 28% of all registered data breaches in the public sector resulted from human error. Human error includes various types of employee mistakes that lead to granting incorrect access rights to file sharing systems (including the cloud) or accidental exposure of sensitive data, such as including an improper recipient when sending an email, attaching the wrong document or losing an unencrypted device. Sharing data with unauthorized parties is the third most common root cause of a data breach among the Cyber Threats report respondents from the public sector, with 18% reporting it. Accidental sharing was also one of the hardest types of incidents to discover -- none were able to spot it in minutes; 42% needed days and 53% took weeks or months.

To minimize their risk, agencies should adopt a comprehensive system that enables employees to share files securely, choosing a solution that is as foolproof as possible. Adoption of the cloud is a big step in this direction, but agencies must pay special attention to access rights. Rigorously enforcing the least-privilege principle and requiring regular privilege attestation are best practices that help ensure that only authorized employees can access a given piece of data.  Adopting a solution that can identify overexposed sensitive files and revoke excessive permissions is also highly recommended.

Stand-alone data leak prevention tools or DLP capabilities in a larger platform (like Microsoft 365) can help agencies reduce the chance of someone accidentally sending internal documents outside of the organization. To inform both access management and DLP efforts, organizations should make sure they consistently classify all their sensitive, regulated and business-critical data.

In 2020, agencies are under dual pressure to both provide uninterrupted public service and quickly adapt to the changing local, national and global reality. The challenge for the IT teams is to enable all this change without compromising security and with limited staff and budgets.  Establishing a continuous and repeatable risk assessment process that involves all stakeholders is the best advice. Be sure to include the leadership team, since their input is required to align IT budget and effort with the organization’s broader goals and priorities.