26 | C O V E R S TO RY
Cybercrime: COVID-19 impact Cybercrime trends in Europe
2/3 of Interpol member countries from Europe reported a significant increase in the malicious domains registered with the key words ‘COVID’ or ‘Corona’;
Cybercriminals are taking advantage of the pandemic to deploy ransomware against critical infrastructure and healthcare institutions responsible for COVID-19 response;
Cloning of official government websites is increasingly occurring to steal sensitive user data, which can later be used in further cyberattacks;
Widespread phishing campaigns.
Key Covid-19 cyber threats %
59
Phishing/ Scam/ Fraud
36
Malware/ Ransomware
22
Malicious domains
14
Fake News
BASED ON THE COMPREHENSIVE ANALYSIS OF DATA RECEIVED FROM INTERPOL MEMBER COUNTRIES, PRIVATE PARTNERS AND THE CFC.
C O V E R S TO RY | 27
Save Teleworking For Businesses
■ Establish corporate policies and procedures ■ Secure your teleworking equipment ■ Provide secure remote Access ■ Keep device operating systems and apps updated ■ Regularly check in with staff ■ Secure your corporate communications ■ Raise staff awareness about the risks of teleworking ■ Increase your security monitoring
For Employees
■ Access company data with corporate equipment ■ Think before connecting ■ Report suspicious activity ■ Use secure remote access ■ Protect your teleworking equipment and environment ■ Develop new routines ■ Keep business and leisure apart ■ Stay alert ■ Be careful when using private devices for telework ■ Avoid giving out personal information
Ransomware Tips & Advice
Ransomware prevents users from accessing their system or devices, asking them to pay a ransom through certain online payment methods by an established deadline in order to regain control of their data.
How does it spread?
■ Visiting compromised websites ■ Clicking on malicious links and attachments ■ Downloading fake application updates or compromised software ■ Connecting infected external devices (such as USBs) to your computer system
Fake News
■ Fake products and services ■ False mitigation and cures ■ Mistrust into official guidelines
SIM swapping – a mobile phone scam A fraudster takes control over mobile phone SIM card using stolen personal data
How does it work?
■ A fraudster obtains the victim’s personal data through e.g. data breaches, phishing, social media searches, malicious apps, online shopping, malware etc. ■ With this information, the fraudster dupes the mobile phone operator into porting the victim’s mobile number to a SIM in his possession ■ The fraudster can now receive incoming calls and text messages, including access to the victim’s online banking ■ The victim will notice the mobile phone lost service, and eventually will discover they cannot log in to their bank account
Break the chain
■ Spot the fake. Share information from official sources only ■ Do not engage ■ Report it
What can you do? ■ Keep your software updated ■ Show caution with regard to social media ■ Never open suspicious links or attachments ■ Update your passwords regularly ■ Buy from trusted sources
■ Do not reply to suspicious emails or engage over the phone with callers that request your personal information ■ Download apps only from officials providers and always read permissions
■ Set up your own PIN to restrict access to the SIM card ■ Frequently check your financial statements SOURCE: INTERPOL, EUROPOL
28 | C O V E R S TO RY
by «BDO Latvia» experts STELL A K APR ĀNE and L Ā SMA KR AMIŅA
The Covid-19 pandemic has significantly boosted cybersecurity Distance work and training, a thorough boom in e-commerce, followed by cyber security, are one of the brightest features of 2020, not only in Latvia or Europe, but all over the world.
In
Simultaneously with the widespread mass introduction of these information and communication technology solutions, the cyber security segment has also grown. The global cybersecurity market is presumed to grow to approximatelly 300 billion USD by 2024, an average of about 50 billion USD annually. The fastest growth in expenditures are forecasted in the municipal (11.9%), telecommunications (11.8%), resource sectors (11.3%), banking (10.4%), and central
Publicity photos of BDO Latvia
essence, the Covid-19 pandemic has been a major driver of the use of information and communication technologies, including in areas where the introduction and use of these products has so far been relatively slow. According to the World Economic Forum›s Covid19 Risk Report, 50% of companies had expressed concern about the increased risks of cyber-attacks and cyber-threats due to the virus, including when employees relocate their day-to-day work to home.
government (9.9%) sectors. The types of cyber-attacks most commonly faced by companies are phishing (37%), intrusion into data networks (30%), accidental disclosure (12%), stolen / lost device or data (10%) and incorrect system configuration (4%). The global cybercrime economy generates approximately 1.5 trillion USD in annual profits, and global spending on security applications is projected to increase to 133.8 billion USD by 2022. The largest investors in cybersecurity are the United States, Israel, the United Kingdom and Canada. The countries with the most attacks are Bangladesh, Algeria, Uzbekistan and Germany, while the countries with the least attacks are Japan, Denmark and Ukraine.
C O V E R S TO RY | 29
With Covid-19, the risks of working from home have become more important. These include vulnerable video conferencing links or hacked video conferencing passwords that can be used to access the corporate network, as well as the risks of insecure networks and the use of vulnerable computers by employees. The more risk, the more investment
Surprisingly, regulation in the field of cybersecurity is very fragmented and the definitions used in this sector are not used consistently in EU legal regulations and policies. At the same time, there is a permanent Computer Emergency Response Team (CERT-EU) in the European Union, covering all EU institutions, bodies and agencies. It consolidates the existing Task Force into a permanent and effective unit responsible for a coordinated EU response to cyber-attacks against its authorities and cooperates with the EU Institutions› internal IT security units and liaises with computer threat response units and IT security companies in Member States and elsewhere to exchange threat information and techniques for their prevention. It also works closely with NATO partners. We consider cyber security throughout the Baltics to be good, at the same time there are subjects who do not appreciate the importance of virtual security and thus even cause problems for other participants. It can be unequivocally concluded that investments and also various types of educational measures on the importance of security in the
electronic environment will have to be made by everyone - the state, local governments, companies and also the population.
Europe does not sleep
Unsurprisingly, on 2 December 2020, the European Council endorsed conclusions recognizing the increasing use of Internetrelated consumer products and industrial devices and the new risks to privacy, information security and cybersecurity. The conclusions emphasize the importance of a long-term assessment of the need for horizontal legislation to address all related aspects of cyber security of devices, such as accessibility, integrity and confidentiality. Also, in 2020, the Council of Europe imposed, for the first time, restrictive measures on six individuals and three organizations responsible for or involved in various cyber attacks. The sanctions imposed include a travel ban and an asset freeze, while EU individuals and organizations are prohibited from making funds available to listed companies and individuals. In addition, the European Council and the European Parliament reached a preliminary agreement on 11 December 2020 on a proposal
to establish a European Center of Competence for Industrial, Technological and Research Cyber Security with headquarters in Romania and a network of National Focal Points to ensure a digital single market, including in areas such as e-commerce, smart mobility and the Internet of Things, and to increase the EU›s autonomy in cybersecurity. The Council of Europe has introduced a framework enabling the EU to impose targeted restrictive measures to deter cyber-attacks and to respond to cyber-attacks that pose an external threat to the EU or its Member States, by allowing sanctions to be imposed on individuals or entities responsible for cyber-attacks or attempted cyber-attacks, provide financial, technical or material support for such attacks, or are otherwise involved in them. This framework also applies to cyber attacks on third countries or international organizations where restrictive measures are considered necessary to achieve the objectives of the Common Foreign and Security Policy. Please check our website https://www.ahk-balt.org/ for tips for working from home from BDO Latvia
30 | C O V E R S TO RY
CHECK HOW SAFE YOUR COMPANY IS Cybersecurity incidents may have GDPR or PR consequences, and might even lead to the company going out of business. Not sure how vulnerable your company is with regard to cybersecurity?
Please check the statements below. If you cannot answer one or more of these with a clear yes, your company is at great risk in the event of a cyberattack.
You really understand that your company needs cybersecurity
Your company has an up-to-date antivirus and firewall
You don’t fully rely on technology and train your employees to be aware of cyber risks
Your company’s work from home policy is clear and includes easy-tofollow action plans
Employees don’t use their private computer for work purposes
Employees don’t leave their computer and other technical devices unattended even for a short time
The videoconferencing links and passwords are kept safe using secure password management tools
Your company has an action plan in the event of a cyberattack and the employees know what tactical action should be taken
Your company uses secure networks – remote access systems are fully patched and securely configured
Your company’s data backups perform regular checks and are adequately protected
Your company observes personal data protection requirements and reporting obligations in the event of a data leak
Do you have any questions in the area of cybersecurity? The German-Baltic Chamber of Commerce (AHK) will be happy to put you in touch with the experts. Please contact us: Joachim Veh
Assistant to the management Joachim.Veh@ahk-balt.org