The workplace has transformed rapidly over the past ten years, as enterprises look to take advantage of the emerging technologies. Increasingly, employers and employees alike are able to leverage modern communications platforms and cloud technology to greatly enhance productivity and collaboration.

As adoption of internet-based solutions increases, however, so does cyber crime. Almost half of UK businesses suffered an attack in the past year, with many experiencing cyber security related issues at least once a week. Most employees are likely to have had some kind of security training, standard procedure for the majority of businesses now, but how many know exactly how hackers attack?

Psychological tricks hackers deploy

With more companies using strong security solutions, attackers are shifting focus to exploiting workers, rather than network and system vulnerabilities. These so-called ‘people hackers’ use four main techniques to bypass critical thinking. Understanding them can help you detect attacks before they do damage, reducing the risk of any human errors being made.

The most common psychological trick is quite simple: providing, or seeming to provide, something the victim needs. Many of us scoff at emails promising free products, but it can be much more crafty than that. Perhaps you’re at a conference when the Wi-Fi goes down. Before you know it, a backup network is up and running, but you’re prompted to enter your credentials again. This captive portal, purposefully launched by an attacker, could distribute malware or steal information from your device. The hacker has created the need and the solution, without arising suspicion.

Such attacks can be made more powerful if the attacker appears to be a person of authority. In recent years, there has been a rise in assailants that use information gathered about higher-level employees to impersonate them. From the victim’s perspective, it may look like their boss requesting an important document or credential. In reality, it could be an attacker posing as them. The further an attacker infiltrates a network, the easier such impersonation becomes.

Information gathering acquired through these methods also helps a hacker launch attacks during stressful periods, when logical thinking is compromised. When a deadline is looming and stress levels are high, employees are more likely to lose focus and download a document or open an attachment without thinking.

Finally, but crucially, hackers will try to divert your attention one way while performing an attack elsewhere. It could be as simple as an email from a “co-worker”, asking you to print and deliver a physical document to their desk, whilst your system is being compromised in the background.

Here’s a useful snapshot that you can share with colleagues and employees within your organisation:

Click on the infographic above to download a PDF you can share with your users.

Dealing with a suspicious email

Studies have revealed that around half of UK hacks are phishing scams via email. One in every 3,722 emails is a phishing attempt, and most of those make use of one or more of the psychological techniques above. With attackers getting more sophisticated, here’s how you can protect yourself properly:

Naturally, adhering to the above as well as staying productive during stressful times can be difficult, but thankfully, there are solutions out there that do most of the heavy lifting. Email security tools scan all inbound emails in real-time to look for suspicious content and detect anomalies in sender addresses or email headers. These alerts are passed on to employees in their email client while attachments are scanned before they can be downloaded. If a user does click a suspicious link, it will open in an isolated browser to protect from malware and phishing attempts.

Our partners LIBRAESVA have developed an insightful test to see how secure your organisation’s email is. Simply enter your email address and they will send you a series of test emails to see what gets through your email security.

Covid-19 and the lockdown has dramatically increased the use of Virtual Private Networks (VPNs). At the beginning of 2020 most organisations would have had the majority of users connecting to the network locally, and just a handful of remote workers connecting via a VPN. Since March 23th that dynamic has changed, with the majority of users now relying on remote connectivity for work. 

This has naturally come with a few challenges. Connectivity issues are common when a user doesn’t have enough bandwidth. But this can often be resolved by ensuring that other people sharing the home WiFi are not on Netflix or House Party while a remote worker is trying to work!  

via GIPHY

The biggest challenge is security and specifically Distributed Denial of Service (DDoS) attacks. VPNs are easy targets and multiple users accessing the network via VPNs dramatically increases the surface area for these attacks. 

What is a Distributed Denial of Service (DDoS) attack? 

DDoS attacks take advantage of network capacity limits and will send multiple requests to a network resource with the aim of exceeding its capacity to handle multiple requests. As a result it overloads the system and prevents the network resource from functioning properly.  

Typically, attackers target website resources with the goal of a ‘total denial of service’ so that the victim’s website won’t function. This may be for the purpose of demanding payment to stop the attack, to discredit a company or as a smoke screen to steal sensitive data. Targets are often online businesses like ecommerce retailers, IT and telecom companies, financial service providers and banks, and government organisations. 

The financial consequences of an attack vary depending on the size of business and the network resource attacked. A DDoS on an ecommerce website will cost the business in lost sales, remediation and potentially any payments to stop the attack.  

Why are Virtual Private Networks (VPNs) vulnerable? 

While hackers generally target website infrastructure, the Covid-19 pandemic and widespread remote working has presented them with another opportunity. There has been a significant increase in malicious attackers launching DDoS attacks on VPN infrastructure at a time when they know the impact will be most felt. 

Even low volume attacks can overwhelm VPN concentrators and firewalls, and low volumes are likely to go undetected by DDoS defences – as they don’t get triggered. Secure Socket Layer (SSL) VPNs are also vulnerable to SSL floods, where they are unable to handle high volume of SSL handshake requests. Randomised UDP floods or IKE floods are also an issue. Internet Key Exchange (IKE) is used by IPSec VPNs for authentication and encryption handshaking. 

What can you do to secure your network? 

As your remote VPN applications and concentrators may be old and previously only used as gap-filling IT infrastructure for a small number of remote users, you may not have optimised DDoS protection for your VPN or have tested your VPN infrastructure against this type of attack. 

To identify threats and attacks your cyber security tools need to know what normal looks like, and VPN traffic currently looks very abnormal compared to what it looked like at the beginning of the year. 

Monitoring and alerting are therefore essential to initially build a picture of what’s normal behaviour, and for real-time visibility on what’s happening on your network. With this information you can fine-tune DDoS policies to ensure attacks are identified in real-time. 

To help address this challenge our recently launched cloud based Virtual SOC service now extends visibility beyond the perimeter to include VPN activity. This new feature will enable vulnerable businesses to quickly and cost effectively address the significant risks faced through the increase in VPN activity.  

In response to Covid-19 and the increase in remote working, we are also offering customers a free Cyber Security Health Check. For further details please visit this webpage or contact us directly to find out more. 

Stay safe