Managing Editor, IFSEC Insider

Author Bio ▼

James Moore is the Managing Editor of IFSEC Insider, the leading online publication for security and fire news in the industry.James writes, commissions, edits and produces content for IFSEC Insider, including articles, breaking news stories and exclusive industry reports. He liaises and speaks with leading industry figures, vendors and associations to ensure security and fire professionals remain abreast of all the latest developments in the sector.
December 4, 2020


Lithium-Ion batteries. A guide to the fire risk that isn’t going away but can be managed

Cyber security

Keeping cyber secure at Christmas

Sylvain Cortes, Security Evangelist and cyber security expert at Alsid, highlights the need for security departments to raise awareness through their organisations over cyber threats this Christmas.

Why are hackers feeling festive?

Reduced staff – December is the month of cookies, chocolate, and half your workforce going on vacation. That means thicker waistlines and thinner lines of defense as you juggle interim employees and reduced staff across the board.

Email avalanche – December and January result in a chaotic inbox cocktail: Christmas promotions, New Year wishes, (virtual) party invitations, online purchase receipts… Phishers know the situation well and will cloak themselves in the email avalanche. Even if staff are aware of phishing and other scam tactics, attention inevitably wanders. Remember that 80% of attacks start with a phishing tactic – an unending migraine for organisations.

Remote work – This has never been more relevant than this year, with so many employees still working from home due to the pandemic. As staff check emails, print invoices, or follow prospect activity, you’ll be relying on your corporate VPN. As VPN activity increases, your SOC team gets flooded with traffic to inspect, and that translates to more false positives. The attacker can duck into this traffic jam to hide intrusion and other malicious activity.

Read: Overcoming challenges of remote working in security

Staff might also be tempted to use that free Wi-Fi offered by hotels, train stations, and airports when travelling, which tends to fall on the poor end of the security spectrum. Public Wi-Fi spots are an excellent entry point for attackers, so make sure employees are aware of the risks.

Bad Santa is coming for your data

All hackers want for Christmas is to encrypt data and pocket other’s well-earned cash. Ransomware attacks are skyrocketing, and we anticipate a record-setting number of encryptions for December 2019 and January 2020.

The classic attack scenario looks like this:

Alsid-CyberXmas-19Hackers will use Active Directory domain dominance to mask their presence and dramatically increase encryption efficiency. The attack path will use OS vulnerabilities or Active Directory misconfigurations to perform lateral movement and privilege escalation.

Cyber security strategies for Christmas

You can implement a specific Christmas security plan to reduce the effectiveness of attacks. This is not complex, but it is important to guard against any Scrooges eyeing your organisation:

  • Provide a best practice checklist for salaried and interim employees alike: phishing, IT security procedures, internet usage, etc. must be crystal clear.
  • Evaluate resilience by checking your workstation patches and your Active Directory configuration. You may use a specific solution, such as Alsid, to check your Active Directory sanity and any potential misconfigurations. Monitor your workstation status. To ensure your OS is updated, you may use a mix of GPOs and WSUS configuration.
  • Have backups. It is not enough to check the “success” status of your backup jobs – you must confirm that your backup files are resilient by testing a restore plan on specific systems.

Weather the Christmas storm

Holiday cyber attacks won’t be going away any time soon. They will grow and adapt to take advantage of increasing traffic and decreased resources inside businesses. A simple umbrella won’t cut it. You’re going to need to build an IT shelter to monitor your employees’ behavior, your Active Directory’s security, and your backups’ resilience. After all, no one wants to wake up to coal in their SOC.

Subscribe to the IFSEC Insider weekly newsletters

Enjoy the latest fire and security news, updates and expert opinions sent straight to your inbox with IFSEC Insider's essential weekly newsletters. Subscribe today to make sure you're never left behind by the fast-evolving industry landscape.

Sign up now!

man reading a tablet, probably the IFSEC Global newsletter

Related Topics

Notify of
Newest Most Voted
Inline Feedbacks
View all comments
December 8, 2020 6:35 pm

[…] story first appeared on IFSEC Global, part of the Informa Network, and a leading provider of news, features, videos, and white […]

December 22, 2021 10:29 am

Great article and more relevant than ever!