Categories
Security

Most US schools fail to secure distance learners

Education in the United States faced a crisis this year. The looming threat of the coronavirus — which spreads easily in enclosed classrooms — forced schools across the country to develop new strategies for education, most involving some form of distance learning.

The dramatic stress of this transition on teachers, parents, and students is well-known. But the impact of long-term distance learning on the cybersecurity posture of schools and districts has not yet been studied — until now. Researchers at Malwarebytes surveyed IT decision-makers and students from K–12 and trade schools, as well as colleges, throughout the US to compile a report on how education security has fared in the wake of the pandemic.

The results paint a rather grim portrait; the education sector, having always struggled with lack of IT budget and personnel, was ill-equipped to move millions of students to a distance learning model. And despite Herculean efforts by IT teams to connect every student and teacher, cybersecurity often slipped through the cracks.

US distance learners remain vulnerable to cyberattack

US schools have been under tremendous pressure over the last 10 months. Forced to close their doors with little warning, teachers, administrators, and IT teams spent the first few months of the pandemic simply figuring out logistics, such as how to get students access to school resources, devices, and Internet service. Unlike most workplaces, schools have been slower to adopt new technologies, and they were not set up for an easy transition to a distance learning model.

Yet even now, halfway through the schoolyear, educational institutions are struggling with cybersecurity for distance learners. Nearly half of all schools did not change their cybersecurity protocols in response to the new distance learning model, which resulted in a number of issues that dramatically increased IT workload and put undue strain on teachers. Some schools even suffered cyberattacks that delayed their distance learning lesson plans for up to a week. Other key takeaways from the report include:

  • 51 percent of IT decision-makers said that no students, teachers, staff, or guests (including parents) were required to enroll in cybersecurity training before the new school year began
  • 47 percent said their schools developed no additional requirements — no distance learning read-throughs, no antivirus tool installations — for the students, faculty, or staff who connected to the school’s network
  • 46 percent of students said their schools suffered a cyberattack (though only 3 percent of IT professionals admitted to the same); On the flip side, of those who engaged in security best practices before the transition to distance learning, none experienced a breach or had to cancel a single day of learning due to a cyberattack

Clearly, security awareness makes a difference in the overall safety of an organization. In fact, of those who were well-studied in cybersecurity, fewer suffered sustained, excess IT workload or experienced Zoombombing attacks than those who were less prepared. However, knowledge is only half the battle. Many respondents were saddled with device and data shortages. Other schools fell flat on security budget. Additional IT challenges presented by distance learning include the following:

  • 40 percent of educational IT pros said their schools are still missing laptops, computers, or tablets for students
  • 28 percent are still missing these devices for teachers
  • 20 percent of IT decision-makers said they had trouble convincing their schools to invest in cybersecurity
  • 44 percent admitted to difficulties in managing the sudden increase of devices connected to the school network
  • 80 percent said there was a steep learning curve for teachers, students, and staff to adapt to online learning tools

But the report wasn’t all doom and gloom. IT professionals had a gargantuan task in front of them to keep teachers teaching and students learning, and for the most part, they were up to the task. About 72 percent of schools provided Chromebooks, tablets, and hotspots to students, and 59 percent distributed laptops, external microphones, and webcams to teachers. More than 70 percent deployed new software tools for distance learning, including Google Classroom and Zoom.

Unfortunately, despite super-human efforts by some educational IT teams, lack of resources, personnel, and budget have strained an already impacted security posture to nearly the breaking point. About 76 percent of respondents experienced connectivity issues, 30 percent suffered a Zoombombing attack, and 52 percent of teachers had to step in and solve an IT or security issue for students and parents. On the bright side, actual cyberattacks were relatively rare.

So, what can educational IT teams do to improve their school’s security posture in 2021 and beyond? Here’s what the report suggests:

  • Create and train teachers and staff on new cybersecurity policies relevant to distance learning (For other businesses, this can be an additional set of rules related to remote work/work from home)
  • Develop requirements that direct teachers and parents to the appropriate point person in IT or security, should issues arise that need solving quickly
  • Implement access rules, including whether students should use a VPN or password manager to access the school’s network and accounts
  • Host cybersecurity training events for teachers, staff, students, and parents

For more information on the state of education security in the US, read the full report from Malwarebytes Labs here: https://resources.malwarebytes.com/files/2020/12/Lessons-in-cybersecurity_How-education-coped-in-the-shift-to-distance-learning_Malwarebytes.pdf

Categories
Security

Cybercriminal Monday: remote employees and retailers take caution

For the last 10+ years, the post-Thanksgiving shopping bonanza known as Black Friday has courted crowds and controversy, with major retailers deciding to open their doors on Thanksgiving Day to mobs of rabid customers looking for deep discounts.

This year, things look a little different. While some doors will open on Black Friday, many shoppers will choose to look for deals online instead. And even though online shopping will protect consumers from catching COVID-19, there’s no guarantee they won’t pick up a different kind of virus — and pass it on to corporate networks.

Conversely, online retailers and organizations with ecommerce platforms should take extra precautions this year, as cybercriminals have already ramped up their attacks on a wide variety of shopping sites.

Watch out for Black Friday and Cyber Monday pitfalls

As the nation heads into a holiday season on lockdown, we once again face norms-defying circumstances: Thanksgiving gatherings will be much smaller and Black Friday will likely have crowds rushing to their laptops instead of their local malls.

Since the start of the pandemic, online spending has increased by 75 percent. Ecommerce cybercrime has followed suit, with a 25 percent rise in credit card skimming observed in the first month of the pandemic alone. Scams laced with COVID-19 misinformation have tricked thousands into giving out their personal and business data or led to infections of home and corporate networks. And ransomware attacks have taken advantage of a vulnerable and distributed workforce. All this means the stakes are even higher for the coming week of holiday shopping.

In fact, expect stores to extend Black Friday deals through the month and beyond, luring shoppers repeatedly back to their ecommerce pages for maximum return on investment. But the old methods for staying safe while online shopping are not all relevant in today’s threat landscape. For organizations with remote employees who may also use their work device for personal use (or personal device for work activities), it’s prudent to send out reminders this holiday shopping season to keep personal business — especially online purchases — separate from business business. Here are a few you can send to your staff:

  • Just because a website uses HTTPS and has a padlock does not mean it is safe. It simply means that the connection is secure between a particular server and who the website claims to be. But it’s easy for cybercriminals to spoof legitimate sites and have your information be sent to them over a secure connection. All the padlock guarantees is that other cybercriminals can’t interrupt the exchange.
  • To protect against web skimmers, consider equipping personal devices with antivirus software that has web protection, or browser extensions that block malicious content. All work devices should be protected with the same.
  • Avoid clicking directly on targeted ads for a particular deal. Online ads could contain exploits delivered via malvertising, which could deliver malicious payloads or divert users to scam pages. If there’s an ad for a great deal, go directly to the retailer’s website instead.
  • Do not use public WiFi to shop online. Also avoid using the company’s VPN for that purpose. The best bet is to shop from a password-secured home network or to purchase your own VPN for home use.

In addition, online retailers and other ecommerce sites should take particular precautions over the next month to protect against web skimmers or other online attacks. Here’s my advice for staying secure:

  • Keep your site updated to protect against cybercriminals who would exploit vulnerabilities, and that includes shoring up weak code. Make sure any admin access to the site’s backend is protected with a strong, rotating password.
  • Make sure any third parties, including Content Management Systems (CMSes), financial transaction partners, or even libraries of code are free from known vulnerabilities by running all updates or cross-checking code for mistakes.
  • Take preventative measures by implementing safeguards, such as a Content Security Policy (CSR) and Subresource Integrity (SRI).

Best wishes for a safe and happy Thanksgiving holiday!

Categories
Security

Brute force attacks increasing on open RDP ports

Ever watch a procedural cop show where the lead detective is some kind of password savant? Then you know this scene: The detective walks into a suspect’s apartment, finds a locked computer, and, after his partner complains they’ll need NSA hackers to get in, cracks the tricky password in a single try. While I love a good Hollywood cybersecurity gaffe, the truth is Detective Special Skills actually would have a decent chance at getting into that computer if he knew the suspect’s name and attempted using a few of the most popular default passwords today. (I’m looking at you, 1-2-3-4-5.)

But let’s say this suspect is a little more tech savvy and has a stronger, unique password in place. That’s game over, right? No getting in? Unfortunately for us good guys trying to protect our personal or business data, the answer is no. By using brute force attacks that automate trial and error, cybercriminals are able to run thousands or even millions of username and password combinations until they crack the code for credentials.

COVID-19’s grip on the global workforce has remained tight for nearly three quarters, keeping the majority of corporate employees — including technicians, security, and IT staff — confined to their homes. The repercussions of ongoing work-from-home conditions continue to be felt, especially a generally weaker security posture for all organizations, the natural result of having a distributed workforce. One such repercussion is a massive increase in open RDP ports, from 3 million in January 2020 (pre-Covid) to 4.5 million in March (post-Covid).

Cybercriminals of course pounced immediately, and to our detriment, they keep throwing everything they’ve got at us. COVID-19 misinformation, scams, social engineering laced with malware, Emotet and more of its friends, digital card skimmers, targeted ransomware attacks, and now brute force attacks, which themselves are methods of endless, everything-but-the-kitchen-sink attack.

Brute force attacks are typically automated or conducted via application, which allows threat actors to “set it and forget it,” coming back to their target once the app notifies them of a successful crack of the desired credentials. And lately, they’ve been cracking open a lot of RDP ports, exposed to the Internet so that remote workers can access company resources from home or IT staff can troubleshoot employee devices remotely.

Once cybercriminals have brute forced their way into an open RDP port, they can launch ransomware attacks, install keyloggers or other spyware on target organizations, or conduct espionage or extortion — pretty much a nightmare scenario. To protect against brute force attacks and shield RDP ports, I recommend:

  • Limiting the number of open ports
  • Restricting access to RDP ports to only those that need it
  • Enhancing security of the port and the protocol (with security software that blocks malicious IPs from compromised servers, for example)
  • For remaining RDP port users, disabling legacy usernames, rotating passwords, and enabling 2FA

At Malwarebytes, we’re now exploring new protective features to combat rising brute force attacks on open RDP ports. Stay tuned for some news on that soon!

To learn more about brute force attacks on the rise and how to protect open RDP ports, read our blog on Malwarebytes Labs: https://blog.malwarebytes.com/exploits-and-vulnerabilities/2020/10/brute-force-attacks-increasing/

For advice on how to protect RDP access from ransomware attacks: https://blog.malwarebytes.com/security-world/business-security-world/2018/08/protect-rdp-access-ransomware-attacks/

And for a refresher on best security practices for all work-from-home employees: https://blog.malwarebytes.com/how-tos-2/2020/03/security-tips-for-working-from-home-wfh/

Categories
Security

Covid fatigue causes careless behavior, endangers online safety

Because it’s not bad enough that we’ve had to shelter in place, shut down businesses, and stay away from friends and families for months. Now we learn that our natural response to this stress — a type of emotional exhaustion medical professionals call Covid fatigue — puts us in danger, too. Great. Might as well give up now.

The above paragraph is a meta example of Covid fatigue… or at least the beginnings of it. The defeatist attitude is a telltale symptom of this type of fatigue, which should not be mistaken for the fatigue that can sometimes be a symptom of Covid-19 infection. Covid fatigue is instead defined as feeling overwhelmed and exhausted by the conditions brought on by the pandemic and the ever-changing list of rules to follow in order to stay safe.

Those with Covid fatigue are less likely to follow basic social protocols for protecting against the virus. And that, unfortunately, spills over into their online habits as well.

For many of you in IT and security, a lightbulb may have already flickered on. Covid fatigue sounds awfully similar to security fatigue or alert fatigue. Indeed, it’s the exact same principle. And if you’re catching on to how emotional fatigue can lead to self-destructive behavior online (like reusing passwords or exercising less caution opening emails, for example), then guess who else knows?

The most successful threat actors study user psychology so their social engineering tactics can be believable. And those threat actors have been clued into Covid fatigue for a while now.

It’s most important, then, that IT and security leaders guide their employees in fighting back against possible online attacks, remembering basic security hygiene, and combatting emotional fatigue. The last item may require help from your people operations teams, but will ultimately lead to a happier, healthier workforce with energy in reserves.

There’s so much uncertainty with this virus, and that contributes to Covid fatigue, too. But if there’s one thing we can be sure about, it’s that battling this pandemic — and the one we’re facing online — is a marathon, not a sprint.

Read on to learn how to cope with Covid fatigue and stay safe online: https://blog.malwarebytes.com/malwarebytes-news/2020/10/how-covid-fatigue-puts-your-physical-and-digital-health-in-jeopardy/

For background on security fatigue: https://blog.malwarebytes.com/101/2017/04/how-to-fight-security-fatigue/

To see what Johns Hopkins recommends for fighting Covid fatigue: https://www.hopkinsmedicine.org/health/conditions-and-diseases/coronavirus/how-to-deal-with-coronavirus-burnout-and-pandemic-fatigue

On alert/notification fatigue: https://betanews.com/2020/07/09/security-report-alert-fatigue/