When your home is your office: personal networks and devices increase attack surface 

The current COVID-19 situation and latest lockdowns have forced many organizations to adapt to keep business and operations running, especially with large numbers of personnel teleworking outside of the corporate network. We published an  article in April  on vulnerabilities and best practices related to videoconferencing, but there are new risks out there to be aware of, especially now that so many of us are relying on home networks and devices with their riskier information security profiles. 

Opportunistic threat actors are using this shift to launch targeted and widespread attacks, as resources privately utilized might not be secure the way they are in an organizational secured infrastructure. With most organizations teleworking, maintaining businesses continuity often outweighs proper security measures. 

Non-corporate resources such as home networks, home computers and unplanned-and-unsecured remote work solutions have provided a new attack surface for threat actors, with a broader and easier-to-compromise scope for targeted attacks against the most valuable target: access to corporate and sensitive data. 

A new and critical vulnerability leads to a new attack surface 

While some organizations provide corporate, secured, and managed resources to their employees, others don’t and, as a result, threat actors have the perfect scenario to leverage access to corporate resources, which from outside the organizational network are unprotected, unmanaged and unsecured. 

In a practical view and, as an example, one of the new attack vectors raised during 2019 was related to Remote Desktop Protocol. Due to the latest critical vulnerabilities affecting this protocol and some of its client-related products, home users’ lack of control in terms of regular patching cycles for home devices allowed threat actors to exploit vulnerabilities in unprotected home systems. 

Many organizations did not prepare for this eventuality, with greater adaptative measures needed to maintain businesses and operations, or measures in a rush, not considering all the necessary controls for adequate information security. 

Low levels of security controls in our home systems encourage threat actors to also target personal email addresses rather than professional ones, leveraging easily-compromised home devices in order to target personal profiles, using the same TTPs (tactics, techniques and procedures) as when professional profiles were in their sights but, in this case, with added vulnerabilities, with lower levels of security controls than in a corporate environment. 

Security controls such as 2FA (or MFA, multi-factor authentication) are nowadays available for services and platforms that we use in our personal and professional lives including Gmail, Outlook Live, etc. However, 2FA is not enough! It does not address the main concern: a current and ongoing global security vulnerability that does not exist with a technical appearance, with even more negative global implications and consequences for all of us than the most critical flaw we have ever seen before.  

As we normally distinguish between work life and personal life, we should also do the same with what we use for each of them and be aware of their limitations in terms of information security constraints. 

If bad actors are able to get into our corporate networks and infrastructure where there are security perimeter levels in place (firewall, IPS, IDS, endpoint security, permissions, etc.), they can even more readily use this new and broader scope of attack, targeting systems and networks with a simple and by-default configured settings and a home antivirus engine.  We can expect home and personal targets such as email addresses, home networks and computers, etc. to be a major part of this new and forced attack surface.

What you can do

Some recommendations to be protected against this worldwide security issue include: