In the past ten years or so, Hong Kong saw an almost sixfold rise in technology-based crimes, while the amount of money lost to cybercrime grew from HK$148 million to HK$2.96 billion in 2020 alone. The big increase in 2020 was powered in part by the pandemic and the shift to remote working on a large scale. Suddenly, millions of workers who were normally inside the corporate firewall and using apps safely on the company network were outside. They were using more unsecured personal devices, thereby presenting a bigger risk and a larger potential attack surface.
The recent increase in cybercrime also included a significant rise in online shopping swindles, including things like mask scams, where fraudsters conned money out of people by falsely claiming to have face masks for sale online, as malicious actors took advantage of the pandemic situation. Cloud computing was vital during the lockdown, as it gave workers access to corporate apps and data from home offices, but it also meant increased potential for data breaches via unmanaged devices or networks. According to research by Hong Kong Internet Registration Corporation, 64% of companies adopted remote working in the first half of 2020 in Hong Kong. But the report also found that cyber risk and data breaches were the top two concerns for both employers and employees under a work from home (WFH) model.
It looks like hybrid working is likely to be part of the normal working world moving forward, with 65% of Hong Kong business leaders reporting they are redesigning their office spaces for hybrid work. But hybrid also means more end users potentially using free Wi-Fi or insecure consumer technology to access corporate networks. And, of course, they are by default outside of the control of your corporate IT and cybersecurity teams, which should drive a zero trust network access (ZTNA) approach. Zero trust is an approach in which security policies are applied based not on assumed trust but on context ascertained through least-privileged access controls and strict user authentication, making it perfect for mobile devices and WFH. This all means that your cybersecurity needs to be robust by design, and you must remember to legislate for an increased human factor: according to research, human error contributes to 95% of cybersecurity breaches.
New vulnerabilities lead to new attacks
Alongside an increase in potential entry points comes an increase in the types of attacks themselves. The past year or so has seen phishing increase dramatically. In 2020, one report found that there had been a 667% increase in phishing emails. Phishing was already a major issue for enterprise cybersecurity professionals; it just became a bigger one with so many more workers outside the corporate perimeter. Almost half of workers admitted falling victim to a phishing scam while working remotely.
At the same time, ransomware attacks have been on the increase and have grown more sophisticated. Attackers now combine data leakage attacks alongside ransomware to convince victims to pay up, an approach known as “double extortion.” Orange Cyberdefense reported an almost six-fold increase in double extortion attacks from Q1 2020 to Q3 2021.
The Orange Cyberdefense Security Navigator 2022 report found a range of new cyberthreats and trends emerging among the overall 13% increase in cyberattacks on enterprises in 2021, one of which was a marked increase in attacks against mobile devices. Security Navigator reported that mobile operating systems, like iOS and Android, are increasingly common targets for attacks, and Orange Cyberdefense predicts that attacks targeting mobile devices and operating systems are likely to continue to grow.
More WFH means more mobile
For enterprises in Hong Kong, as more workers work from home at least some of the time, how those workers connect, and from where, changes, too. That’s meant an increase in workers accessing enterprise applications in the cloud, something that requires a different approach to cybersecurity. Secure Access Service Edge (SASE) is a popular solution. SASE is best explained as a smart blend of networking and security, and it enables IT administrators to manage both network and security together in the cloud. The mass increase in workers WFH and with more mobile devices means enterprises suddenly had to monitor a new, larger attack surface. You were no longer talking about the perimeter being the corporate network.
How can SASE help? It is an approach to security that is tailored for a more distributed world. SASE combines cloud delivery with software-defined wide area network (SD-WAN) and security, which lets you defend your network and devices on a much larger scale compared to just running your security from a centralized data center. SASE is also based on identity, something else that is designed with today’s more distributed world in mind. SASE bases its policy-driven access on the identities of users, groups or devices and factors in a user’s location, a device’s security status or even the time of day an access attempt is made. It brings context into the equation. The identity elements of SASE mean it is able to build continuous access enforcement rules at network level and drives ZTNA. It is ideally suited to the new world of work, greater mobile use and increased WFH.
Constant vigilance is key
As we move forward into 2022, enterprises need to address an equation that includes cloud, mobile devices and other digital tools that enable remote working, plus the human factor, and come up with a solution that delivers a secure, productive working environment. SASE is a key approach that will enable companies in Hong Kong to remain vigilant in the face of a changing threat landscape.
Read more about how Orange is helping companies secure remote workers in the Orange Cyberdefense whitepaper Securing your remote workers: A comprehensive guide to protecting your organization in the age of remote working.
Recommended for you
Edmund Yick is General Manager of Orange Business in Hong Kong and Taiwan. He is responsible for developing and managing the Orange Business portfolio of business solutions for multinational enterprises.
He has over 30 years of sales and management experience and is a Commerce and Business Administration graduate of the University of Toronto.