The holiday shopping season kicks off this week with Black Friday (November 24th) and Cyber Monday (November 27th). And, if it’s any indication of how much online shopping will occur, last year (2016), Cyber Monday set a new sales record of $3.45 billion USD!
So, as visions of sugar plums dancing in users’ heads first give way to visions of online mega-deals for holiday gift buyers, one has to remember it’s also that special time of year for the online version of “The Grinch Who Stole Christmas”, phishers and malware peddlers.
While Black Friday—the day after Thanksgiving—is a day off for many in the United States, it’s still a working day for others. With an array of online deals to take advantage of, those working on Black Friday aren’t going to wait until after work to grab those deals. Neither will employees on Cyber Monday: Last year (2016), staffing firm Robert Half Technology surveyed 1,400 companies in the U.S. and Canada, and found that 49% employees said they will shop while in the office on Cyber Monday, and 39% surveyed said they will use a work-issued device to shop online.
No longer is online shopping on Cyber Monday—or anytime during the holiday season—just a scary time for users and a potential windfall for malevolent attackers. It’s also “The Nightmare Before Christmas” for businesses, too.
A recent study by threat intelligence company DomainTools showed that, while most users were aware of phishing as an online threat, many have clicked on a web link in an email—especially if it’s supposedly from a trusted brand such as Amazon, Walmart and Target—up to 39% at least once, and 13% more than once! Of those that clicked on a link in a phishing email ostensibly from a trusted brand name, over 20% said that their device became infected.
But email is only one way malware is delivered to users on Cyber Monday.
There are also social media scams that attackers play. They will create a bogus web page with a typosquatted or combosquatted email address closely mimicking that of a trusted retailer or online shopping site, develop a fake social media profile using the name of a trusted retailer or online shopping website but adding additional words, such as “Super Deals” or “Cyber Monday”, and wait for users to click through to either steal their login credentials for the retailer or website, download malware onto their device—and, of course, onto the user’s company’s network—or both.
Then there is malvertising, when a user clicks through to a seemingly benign shopping website and clicks on a “Cyber Monday special deal” ad, only to have the device they’re using—often a company-owned device connected to the company’s network—infected with malware, because attackers hacked into the advertiser’s or website’s web server running decade-old, unpatched software, and infected the site’s ads with malware.
These are only a few of the dastardly innovative ways attackers can infect a user’s device during Cyber Monday – or anytime they online shop.
So, when those users are in the office, clicking away on what they believe are real emails, social media links, or online ads from trusted companies with unbelievable deals (but are really cyber attacks like phishing or drive-by downloads), they are likely using a corporate device. And when that device becomes infected and compromised, so can the corporate network.
This is where isolation can help.
A cloud-based isolation platform has the perspective that all web and email content can be dangerous. Good websites and online ads can be infected by attackers without their owners knowing. Many known, trusted websites are running unpatched software on their web servers, and attackers know this and exploit it to drop in malware, ready for users to download without knowing it. Isolation halts the malware and attacks before they can start, by stopping all accessed webpages and content in a cloud-based isolation platform, executing the content in the secure cloud platform – far away from the user’s device, and only serving the user clean, malware-free web rendering content. So, what the user sees is what they would see on the web if the isolation platform wasn’t there. It’s like a piece of bulletproof glass protecting users—and their corporate devices and networks—from potentially dangerous web content, documents, and really, from themselves.
So, realize that employees are going to shop online from work, especially on Monday, November 27th, Cyber Monday, or even on Friday, November 24th, Black Friday, and probably every day between now and the holidays. Just make sure that if they are shopping online, they are able to do it through a pane of bulletproof glass.