ANALYSIS OF ATTACKS USED BY CYBER CRIMINALS DURING COVID 19 - Susukailo, Vitalii; Opirskyy, Ivan; Piskozub , Andrian; Voloshyn, Rostyslav; Druziuk, Oleg (Ukrainian Information Security Research Journal, 2021)
According to the World Health Organization, a pandemic is defined as "the spread of a new disease throughout the world." From a cybersecurity perspective, this means disaster. During disasters, the number of cybercriminals grows every day. As more and more highly qualified cybersecurity professionals join the blue team, more and more malicious applications are launched daily, with an estimated 230,000 new malware samples per day, according to researchers at PandaLabs. A pandemic can be viewed as an event that can lead to the fulfillment of business continuity plans or the implementation of disaster recovery measures. During this time, the growing number of cybersecurity threats should be analyzed and the applicable security measures determined. There are also considermany administrative information security issues. This article covers the main issues of infrastructure monitoring, as well as ensuring a high level of vulnerability management and incident response. Presented the management measures that must be used in SOC centers, as well as an in-depth analysis of attack vectors and security measures that can be applied to prevent them. A presented attack via Zoom conferencing software that describes the possible attack vector used by a threat actor to compromise an organization through unprotected users. When malware is provided under the user’s legitimate pseudonym, other users can download it and install it on their assets. It has been determined that the first control that can be applied to avoid social engineering attacks is informative sessions or training sessions that contain examples of fake COVID 19 resources and the second could be the inclusion of phishing detection and email malware scanning modules in the endpoint security software and in the settings of the e-mail delivery system. It has been determined that remote security monitoring should focus on analyzing events from endpoints with host intrusion detection systems, endpoint detection and response solutions, and endpoint security software that allows remote control and aggregation of events across center console. In addition, security analysts should pay attention to events and logs from the organization’s services and cloud infrastructure assets.