Sebastian Fischer of  U.S. Cybersecurity and Infrastructure Security Agency and J. Alexander Hershey of Clark Hill

As COVID-19 continues to alter the way we live our lives, organizations and individuals must protect their sensitive data in order to protect themselves. While some changes are likely to be temporary, others are will have long-lasting effects. The pandemic has forced employees to work remotely, resulted in school closures impacting almost 70% of the world's student population, and given rise to a number of new online scams. These drastic, rapid changes highlight the need for better organizational and individual cybersecurity practices.

As we move toward even greater reliance on computer networks, we must also consider how to do so safely and how to provide virtual security while protecting digital privacy rights. The unexpected transition to a mass work-from-home setting has introduced new and vulnerable points on which attackers will focus. Employers have been forced to rely upon communication technologies that have not been as secure as was hoped or expected. At the same time, there has been a rise in malicious social cyber activity such as online scams and phishing emails. To minimize vulnerabilities and any accompanying liability, organizations and individuals should reconsider their privacy and security practices and policies.

While security measures require investment up-front, the average cost of a data breach in the United States was $8.19 million in 2019. Moreover, in addition to the expenses to respond to and recover from data breaches, there is a trend towards individual recovery from lawsuits. To avoid potential operational risks and legal liabilities, employers and other organizations should take precautionary steps in a number of areas now.

Remote Work Concerns

Organizations that have transitioned all or part of their workforce to remote work must consider how they will achieve reasonable security. For many organizations, this means expanded use of virtual private networks (VPNs), multifactor authentication (MFA) rather than single-factor authentication, antivirus software, and firewalls. In addition to such tools, organizations must also consider other security controls, such as policies and training. As COVID-19 pushes more employees to work remotely, these policies and trainings should reflect this new reality—from considering the physical security and privacy of home offices to the use of third-party protection devices. Organizations, large and small, must consider their capabilities and what they can ask of their employees.

No single tool or policy is likely to be sufficient for all settings, nor is perfect security a practical goal. Organizations should instead adopt a defense-in-depth strategy. By implementing diverse, independent security controls, organizations can mitigate against the threat of a cyber attack. Any strategy will require an understanding of the particular conditions under which employees are working. Remote work arrangements should utilize technical controls to adequately encrypt and secure data, prevent both malicious attacks and unintentional mistakes, and recognize the need to implement both physical and technical security controls.

In establishing better cybersecurity practices, organizations should review the type of data they store, transmit, or otherwise possess themselves or with their third-party partners. Organizations that deal with sensitive data—which should be broadly understood as the sum of the data controlled—should utilize stronger security measures. Moreover, organizations should minimize the data they collect and store in order to become less attractive as a target of attack.

Cloud Computing

The COVID-19 pandemic has also driven further reliance on cloud computing, the practice of using a network of remote servers to store, manage, and process data. Cloud computing can provide significant benefits to organizations though reduced IT costs and increased ease of collaboration on remote work. As offices have shut down or scattered to homes, the value of cloud computing has become even more pronounced.

Cloud computing, however, comes with its own risks concerning the confidentiality, integrity, and availability of data. Organizations, especially those in heavily regulated industries or jurisdictions, that use cloud computing services must be cognizant of the security practices of their service providers. Newer laws and regulations have begun to hold organizations in a broader array of business sectors responsible for the security practices of their business associates. As a result, an organization can be held liable if their cloud service provider is not exercising reasonable security.

Moreover, in addition to employee and customer data, organizations may have sensitive intellectual property that they must keep confidential. Making data available in the cloud, however, creates additional exposure for the data. This exposure is further amplified if the data must also be available to a team, as each set of employee credentials (username and password) provides an additional avenue for a data hack or leak in the cloud. As a result, organizations that use multifactor authentication are better able to secure the confidentiality of their data.

Protecting the confidentiality of data is not the only concern companies should have, they must also ensure that the data is accessible and reliable. For organizations that store data online, the ability to access that data may become compromised. If a cloud network goes down, a company's access to its data may be lost across all employees unless local backups are maintained. Organizations must also determine their needs and preferences for access to a data set by multiple employees at the same time. Thus, choices must be individualized for the organization—while some organizations will prefer greater access, others must take steps to make modifications to maximize data security.

Online Fraud and Cyber Extortion

Malicious actors have also responded to the COVID-19 pandemic. From ransomware attacks targeting health care systems to an increase in phishing campaigns, there has been a rise in cyber threats during the pandemic. While some threats are perpetrated by criminal organizations, others are conducted or sponsored by foreign countries. No matter its source, organizations and individuals can—and should—take measures to protect themselves against fraudulent conduct. While antivirus software and other technical measures help to reduce successful attacks, individual users must also exercise basic caution and wisdom when opening links and attachments or providing information online or by email, phone or even regular mail.

Cyber threats arising during the pandemic have taken advantage of uncertainty, inaction and confusion. Phishing scams, for example, are capitalizing on the increase in email traffic, the use of personal devices to perform organizational work, and the reduced availability of live interaction. COVID-19 also complicates the work of cybersecurity professionals and teams. While some work can be done remotely, other activities are most effectively done in person or when hard-wired. Importantly, the increase in vulnerable points, whether from home internet connections, the use of personal devices, or poorly configured home office spaces, adds additional difficulty to a field already suffering from a critical shortage of trained individuals.

Legal Trends and Developments

The COVID-19 pandemic has highlighted the need for increased legislative attention, funding, and action to improve the nation's cybersecurity infrastructure and practices. Some changes have already been proposed, but others are more likely to build upon trends developing before the pandemic began. In addition to developing state and international law on the subject, a bill was introduced in the U.S. Senate on May 14 that would require organizations to implement reasonable privacy and security practices. The bill would also allow for a private right of action by individuals for recovery of up to $5,000, attorney fees and litigation costs. The provision of such incentives to litigate individual rights is likely to cause an increase in the number of data breach lawsuits.

As a result, organizations should create or update enterprise risk policies and plans, with an updated understanding of cyber threats. Creating an effective risk enterprise management plan is an involved process and should contemplate the unique situation that the organization is in and where it wants to go. Moreover, a risk enterprise management plan should account for the new threat landscape that COVID-19 has produced and for the various requirements of jurisdictions in which the organization may operate. Many jurisdictions have created broadly applicable laws with varying and sometimes contradictory requirements. Consulting with legal experts will help an organization understand risks and reduce liabilities before they come to fruition.

In considering how to operate as a result of the pandemic, organizations must account for cybersecurity. Failure to do so not only risks disruption to an organization's activities but also threatens significant costs, regulatory action and potential liability in litigation. In sum, the COVID-19 pandemic will likely accelerate the growth in cybersecurity issues generally, and organizational readiness and response capabilities have become crucial as a result.

J. Alexander Hershey is a member of Clark Hill and its Litigation practice group focusing on unfair competition, trade regulation, and intellectual property protection, including with respect to technical and cybersecurity practices. Contact him at [email protected].

Sebastian M. Fischer was recently an associate in the firm's litigation practice group when he contributed to this article. He now holds an Internship position the U.S. Cybersecurity and Infrastructure Security Agency, although the views expressed herein are not specifically a reflection of the views of the United States government and/or CISA. Contact him at [email protected].