Our heavier reliance on technology has allowed malicious actors the opportunity to exploit individuals and businesses, say UNSW cyber experts.
History has shown that in times of chaos, criminals often take control. There is no denying that COVID-19 has amplified the occurrence of malicious online activity, attacking vulnerable businesses already weakened by prolonged lockdowns.
Associate Professor Frank den Hartog from UNSW Canberra attributes the increase in cyber incidents to distraction.
“Distraction is the basis of any crime and the increase in cyber incidents is due to people diverting their focus to COVID-19 and its repercussions. This has led to more unconscious clicking on malicious links, replying to phishing emails, neglecting of subtle alarms raised by intrusion detection systems and delaying updating systems with security patches.”
A/Prof. den Hartog says our heavier reliance on technological innovations and digital devices has provided malicious actors the opportunity to exploit individuals and businesses with limited knowledge of cyber security.
Cultural Geographer Dr Andrew Lapworth from UNSW Canberra agrees.
New technical interfaces are changing the nature of human-technology relations, he says.
“One way our research explores the evolving human-machine interface is through the conceptual lens of habit. Our argument is that technologies really matter when they no longer seem to matter at all…when they move from the new to the habitual, becoming an almost seamless part of our everyday lives such that we barely notice them anymore.”
Dr Lapworth says that understanding the unconscious dynamics of habit is essential to reduce the likelihood of future cyber security incidents.
“This is an important issue for cyber security professionals and teams, whose work is commonly centred on how to instil habits and behaviours of cyber hygiene in their workers or end-users,” he says.
A/Prof. den Hartog says that people’s home network and computer equipment (including mobile devices) are poorly secured – in comparison to company and government networks.
“Various home devices are already used by criminals in botnets when executing Denial-of-Service attacks which are designed to shut down a machine or network and making it inaccessible to its intended users. Connecting personal equipment remotely to the company or government network is therefore very risky.
“Prior to the pandemic, some companies already had working-from-home arrangements and safeguards in place. Not much will change for them. But for others – this is unchartered territory, and cyber incidents will happen, either unintentionally (e.g. crashes) or intentionally (e.g. hacks),” A/Prof. den Hartog says.
When people are at home in lockdown, they are more likely to increase their online activity such as banking, shopping, and accessing public services such as Medicare. Image: Shutterstock
As a result, networks can be overloaded and crash just like the MyGov website did a couple of months ago.
“Although such incidents may not be hacks, they signal weakness to hackers and present opportunities for them to exploit vulnerable networks. If a crash is caused by security safeguards misinterpreting a surge in legitimate use as an attack, are we going to improve those safeguards to prevent such a crash from happening in the future?”
A/Prof. Hartog says that the best thing individuals can do is to stay alert.
“Just think twice before you click on any links. Check if the system requiring your password is really the system it claims to be. Keep your systems and software updated, regularly back up your files, and don’t use your computer as an administrator if not necessary.
“If you are a bit more computer literate, you can switch off macros in production software and unnecessary plug-ins in web browsers and mobile devices. Disconnect internet-of-things devices that do not need to be connected to the internet. For instance, your smart digital photo frame or kettle at home doesn’t have to be connected to the Wi-Fi” he says.
Dr Yenni Tim from UNSW Business school suggests cyber security is a multifaceted issue and that it is important to take a holistic approach.
“This means looking at the entire system – the people, the processes, and the technology to identify potential vulnerabilities that exist in the structure. It also means acknowledging that a breach may be inevitable, and that in addition to a response plan, you should have a recovery plan to maintain, and sometimes repair, the resilience and trust that people have built together,” says Dr Tim.
The government recently announced it is increasing its spending on cyber security to $1.664 billion in a move to raise awareness on cyber threats, disrupt foreign cyber criminals and create more than 500 jobs in the sector over the next 10 years.
Embedding cyber security programs across different levels and sectors is the first step in inspiring people with diverse skillsets to participate in the industry, says Dr Tim. She suggests considering the following two criteria when addressing the cyber skills gap:
“We need to make sure our programs are cultivating the knowledge and skillsets that the industry actually needs. So, collaboration across the government, the industry, and the education sector is crucial when co-designing programs. Initiatives also have to be practical and relevant.
“We need programs that allow individuals to not only recognise the significance of cyber security, but also to identify areas that they can really contribute and make a difference in,” Dr Tim says.