The Sectors Experiencing the Most Cyber-Attack Threats While Working from Home, Revealed

In 2020, interest in remote working has reached an all-time high, and flexible working is expected to become the new normal. Specops Software recently discovered that 41% of employees have not been provided with adequate cyber security training while working from home, posing all kinds of threats to businesses.

As a result, Specops Software were eager to discover which sectors are experiencing the largest number of cybercrime threats whilst working from home. To do this, we analysed 2,043 different businesses to find out which sectors are most “at risk”, as well as determining the biggest threat per industry.

The Biggest Cyber Security Threats to Businesses

Specops Software found that 54% of business owners across 11 different sectors have seen a rise in cybercrime threats since working from home, with every sector reporting phishing as the most prevalent attack. Despite this, just over half (52%) of businesses, across all sectors, are considering a switch to permanent remote working for their employees post-Covid.

After surveying 2,043 different businesses across 11 different sectors, and analysing their responses, Specops Software discovered that ransomware attacks are the biggest cybersecurity threat to businesses, with 96% of owners listing it among their biggest concerns. The second biggest threat to businesses is crypto jacking (74%), followed by phishing in third place, with 67% of businesses listing it as their biggest worry following a significant spike in recent months. 

According to businesses, their biggest cybersecurity concerns are as follows:

1. Ransomware – 96%
2. Crypto jacking – 74%
3. Phishing – 67%
4. IoT attacks – 48%
5. Cyber-physical attacks – 39%
6. Third party threats – 26%
7. Social engineering – 16%
8. Smart medical devices and electronic medical records (EMRs) – 13%
9. Shortage of knowledge/cybersecurity professionals – 13%
10.  Connected card and semi-autonomous vehicles – 7%

Cybercrime Threat Rates by Sector, from Most to Least

Specops Software surveyed 2,043 business owners across 11 different sectors in order to find out which sectors are most at risk of cybercrime threats while working from home. The results are as follows:

1. Computer and IT

As employees continue to work from home, Specops Software found that the computer and IT sector are most likely to encounter cyber-attack threats whilst working from home.

Almost 4 in 5 (78%) business owners have reported an increase in threats since lockdown. Despite this, working from home still appears to be a viable option for many, as 85% of employers in this sector would consider permanent remote working.

2. Medical and Health

Unsurprisingly, more than 7 in 10 (73%) businesses in the medical and health sector have reported an increase in cybercrime threats since lockdown began, with many experiencing sophisticated malware attacks in recent months.

Although hackers have promised no more healthcare attacks, the sector is still highly vulnerable and concerned about future attacks. This is one of the reasons only 32% of businesses in this sector would consider remote working for employees.

3. Accountancy, Banking and Finance

Interestingly, 67% of those in the accountancy, banking and finance sector have seen a huge increase in threats – making them the third most likely sector to encounter cyber-attacks while working remotely.

Although they place high on the list, business owners have faith in their employees and cyber-security training, as 58% of owners consider permanent remote working for their employees.

4. Charity and Voluntary Work

According to Gov.uk, over one third of charities don’t know which cyber-attacks they’re most vulnerable to. As a result, one in six charities will suffer cybercrime attacks in the next two years.

Therefore, unsurprisingly, the charity and voluntary work sector is among the top 4 who have seen the most cyber-attack threats during lockdown. Over 3 in 5 businesses (62%) have reported an increase and is why only a quarter (25%) of businesses would consider making a switch to remote working in the future.

5. Customer Service

In recent months, the online customer service industry has seen a significant rise in demand, thus increasing the number of cyber-crime attempts. Specops Software found that more than half (55%) of businesses in this sector have reported a rise in threats since lockdown began.

Despite this, as work can easily be carried out online, 64% of employers in the customer service sector would consider permanent work from home placements.

6. Marketing, Advertising and PR

The majority of the marketing, advertising and PR sector have seen an increase in cybercrime threats since working from home. Our research has found that a whopping 53% of businesses reported a significant growth in threats during this time.

Although the sector is at risk of attacks, almost 4 in 5 (79%) businesses are willing to introduce remote working permanently. However, to combat the rise in attacks, businesses are planning on introducing tougher cyber security training for their employees.

7. Legal Services

Less than half (47%) of businesses in the legal services sector reported an increase in cyber-attack threats as employees work from home.

One of the major threats to law firms in 2020 is an increase in sophisticated ransomware attacks, which can have a catastrophic impact on businesses if their cyber security isn’t up to scratch. This is one of the reasons why only 28% of employers would consider remote working permanently.

8. Recruitment and HR

Recruitment and HR comes in eighth place, with 2 in 5 (44%) businesses noticing an increase in cyber threats since working from home. As a result, once cyber security training has been implemented efficiently, 79% of businesses would allow employees to work from home on a permanent basis.

9. Creative Arts and Design

Employers in the creative arts and design sector have also seen an increase in threats, with 43% of businesses noticing a spike. But as the sector isn’t as vulnerable as others, a whopping 69% of employers would consider permanent remote working post-Covid.

10.  Education and Training

In recent years, there have been many cyber-attacks on the education sector. It is not only crucial to protect against financial loss and prevent disruption, but also to protect students from harm.

Thankfully, the education and training sector rank among those least likely to encounter a cyber threat whilst working from home, as only 36% of employers reported an increase in attempts during lockdown. But, due to the nature of the job, only a third (33%) of businesses would consider remote working for employees.

11. Travel and Hospitality

The sector least likely to encounter cybercrime threats whilst working from home is the travel and hospitality sector, with only 31% noting an increase.

Due to Covid-19, hundreds of thousands of employees have been furloughed or made redundant, therefore making the sector less of a target for cyber-criminals. Only 23% of employers would consider permanent work from home schemes as businesses start to get back on their feet.

How Can Businesses Stay Safe and Reduce Cybercrime Threats?

Specops Software’s cyber security expert, Darren James, has provided some expertise about how businesses can stay safe:

Since many people in the world are now working from home, we need to think how the security boundaries have changed. Previously, our users might only be logging into to corporate managed devices on corporate networks in corporate sites. This rule of working is now in the past for any organisation that wants to keep working.

We now need to focus on allowing our users to work from any location, at any time and potentially on any device, but still in a secure manner. Passwords are an obvious weak link in this story, so making sure that we enable MFA where possible, but also increase the quality of our passwords to all users is a must. 

1. Make use of tools that can check your current passwords for ones that are on existing breached lists. Encourage users that are using breached passwords to change them.

• Encourage the use of passphrases e.g. 3 random words, block the use of any breached passwords and if you are planning on increasing expiry times to avoid the “cached password” issue, look at using these longer expiry times as a way of rewarding the use of passphrases. Also consider reducing complexity as a balance for increasing the length to try an avoid users writing passwords down on post-it notes.

• Another common attack vector post COVID, are social engineering attacks on service desk staff. Users are no longer able to visit IT departments in person and maybe calling from public numbers rather than internal, so making sure that your service desk is actually speaking to “Susan from Accounts” and not a hacker is very important, the days of being able to “recognise the voice” isn’t a viable option any more.

• Don’t forget to enable disk encryption on all devices that handle corporate data, this includes mobile devices, and use restrictions to block logins from disallowed countries or non-compliant devices.

• Don’t forget the basics, make sure you have backups of all business-critical data. Make sure you test the backups and make sure you store those backups in a secure location and in an encrypted state. Review permissions to sensitive data both in the cloud and on prem, to make sure that the right people have the right access to the right data.

Methodology:

Specops Software surveyed 2,043 businesses in the 11 main sectors to determine the safety of their business whilst working from home. Specops asked each business owner if they have experienced more cyber-attack attempts than usual from March-July 2020. The survey also asked which cyber-attack threat has been most prevalent over this time, along with which one they see as the biggest threat to their business.