Global Survey: The Cybersecurity Reality of the COVID-19 Remote Workforce

May 11, 2020

| | Endpoint Security & XDR
For many organizations, the rapid transition to an entirely remote workforce due to shelter-in-place orders has brought on a slew of sudden and profound cybersecurity challenges. On one hand, organizations need to secure corporate-supplied devices as well as personal devices as employees log in to corporate networks from home. On the other, adversaries have exponentially increased their efforts to prey on the public’s fear and disinformation during these troubling times. However, as employees now operate from the confines of their homes, their exposure and awareness to cybersecurity threats often isn’t as clear as it once was in the confines of their seemingly more secure office spaces. At CrowdStrike, we’ve been taking a regular pulse of the tactics, techniques and procedures (TTPs) that both eCrime and nation-state adversaries are employing, and sharing best practices and tools that organizations can use to defend themselves. In our new “Work Security Index” global survey, we reveal how prepared — or unprepared — organizations are in securing their remote workforces during the COVID-19 pandemic. The Work Security Index, which was conducted by research firm YouGov, surveyed more than 4,000 senior decision-makers in the U.S., Australia, France, Germany, Great Britain, India, Japan, Netherlands and Singapore.

The Current State of the Workforce Gives a False Sense of Security

Due to COVID-19, our survey reveals that a large majority of respondents around the globe are now working remotely, with more than half of them working remotely directly as a result of the pandemic. This, in turn has given rise to the use of personal devices, including laptops and mobile devices, for work purposes, with 60% of respondents reporting that they are using personal devices to complete work — with countries like Singapore and India even reaching 70% or higher in personal device usage. The mix of company and personal devices creates a range of cybersecurity challenges, from unpatched devices to insecure networks. However, a majority (89%) of respondents optimistically believe their devices are secure against advanced cybersecurity threats while working from home. Compounding the problem, 53% of survey participants revealed that their company has not provided any additional cybersecurity training on the risks associated with remote work. This is especially problematic for small businesses, where 69% of respondents report having received no additional cybersecurity training. Yet, CrowdStrike data indicates that attacks are on the rise, and training is of the utmost importance. Adversaries are as relentless as ever, employing social engineering phishing techniques, targeting remote services and deploying ransomware that preys on confusion and fears around COVID-19. It’s more important than ever for organizations to heighten their employees’ awareness of this new breeding ground for cybercrime activity.

Bringing the Suspension of Disbelief Back to Reality

Half of the respondents believe that their businesses are no more likely to experience cybercrime in the wake of COVID-19. Unfortunately, we’re seeing the exact opposite. CrowdStrike has seen a hundredfold rise in COVID-19-themed malicious files from February to April 2020, and there’s no sign of these attacks slowing down. More troubling, cybercriminals are using people’s uncertainties and shifted workplace environments to benefit financially, attacking victims by using stolen data, impersonating the World Health Organization or using lures that align with health guidance, containment and infection-rate news. While organizations are trusting their employees to operate just as effectively remotely as they do in the office, they still must remain as vigilant as ever to maintain the security of their networks, devices and data.

Key Factors in Securing a Remote Workforce

While having an entirely remote workforce is a new frontier for many organizations, it is important to plan for post COVID-19. As large-scale remote work will continue to be the norm, best practices for securing a remote workforce is vital as ever. Your current cybersecurity policy should factor in remote work and give it the same degree of importance as in-office work environments. This includes planning for the use of personal devices, secure access for “bring your own device” (BYOD) on corporate networks, and leveraging VPNs to protect sensitive data accessed through insecure WiFi. In addition, it’s crucial to keep employees informed and educated about how to secure their at-home workspace. This starts with maintaining basic cybersecurity hygiene, and continuing cybersecurity training as coronavirus-themed scams escalate and evolve. Also, organizations that have crisis management and incident response plans prepared and executable by a remote workforce are better equipped to weather the storm of future pandemics and other crises. As businesses build out their cybersecurity policies, here are a few criteria to consider that can help ensure successful implementation:
  • Make sure your endpoint detection and response (EDR) solution is able to detect attacks both on corporate and personal devices.
  • Utilize managed threat hunting to detect sophisticated adversaries and provide insights into the latest TTPs.
  • Leverage cloud technology to secure corporate, personal and even mobile devices that contain corporate data.
In the wake of COVID-19, the world now faces a new reality of remote work, perhaps becoming the new normal for businesses of every size. However, by keeping the priorities listed above top of mind, organizations can ensure that their transition to (and possibly back from) a remote workforce goes smoothly.

Survey Methodology

CrowdStrike commissioned YouGov PLC to conduct an online survey of 4,048 senior decision-makers in Australia, France, Germany, Great Britain, India, Japan, Netherlands, Singapore and the U.S. Fieldwork was undertaken April 14-29, 2020.

Additional Resources
Breaches Stop Here
Related Content
CrowdStrike Earns AAA Award, 100% Total Accuracy Score in SE Labs Q3 Enterprise Advanced Security Test
CrowdStrike Earns AAA Award, 100% Total Accuracy Score in SE Labs Q3 Enterprise Advanced Security Test
CrowdStrike Named a Leader in GigaOm Radar for Ransomware Prevention
CrowdStrike Named a Leader in GigaOm Radar for Ransomware Prevention
BLG Sees an 80% Reduction in False Positives with CrowdStrike
BLG Sees an 80% Reduction in False Positives with CrowdStrike