Devices Exposed and Malware Widespread on Remote Office Networks, According to Review of 41,000 Organizations
BOSTON — April 14, 2020 — Bitsight, the Standard in Security Ratings, today released research spotlighting significant security issues across the rapidly rising number of networks used to work from home. According to the research -- which analyzed more than 41,000 organizations -- companies suddenly now face newly exposed or vulnerable devices and services, and their employees are using malware-infected networks.
The research comes on the heels of Bitsight’s latest offering, Bitsight Work From Home -- Remote Office, which enables organizations to discover and monitor security issues on remote offices and networks, helping users to reduce the risk that their networks and data will be compromised.
To perform this analysis, Bitsight leveraged its broad, unique visibility into global security performance along with its industry-leading asset mapping capability to identify work from home and remote office (WFH-RO) networks. The research reveals that the surge in work from home activity has dramatically expanded the cyberattack surface, leaving companies and their data vulnerable. Chief among the findings:
Work From Home Networks 3.5 Times More Likely to Have Malware
Networks used to work from home are 3.5 times more likely to have malware present than the traditional corporate network. Forty-five percent of companies had malware on their employees’ work from home networks, whereas only 13.3% of companies had malware on their corporate networks.
Networks used to work from home are 7.5 times more likely to have five or more distinct families of malware present than the traditional corporate network. Seventeen percent of companies had at least five distinct malware families observed on their employees’ work from home networks, whereas only 2.3 percent of companies were observed to have at least five distinct malware families on their corporate networks.
Well-known bot networks -- networks of computers infected with malware -- are more prevalent on work from home networks compared to the corporate network. For example, the Mirai botnet is observed at least 20 times more frequently on work from home networks than corporate networks, while the Trickbot malware is observed at least 3.75 times more frequently on work from home networks as compared to corporate networks.
Home Networks Expose New, Vulnerable Services
The nature of work from home networks offers unique potential exposures and vulnerabilities. Commonly observed exposed devices include: cable modems, routers, cameras, storage peripherals and other IoT devices. Most of these interfaces are inadvertently accessible or infrequently updated by the user, heightening the concern.
For example, the research found that 25.2% of work from home networks have one or more services exposed on the Internet. Of those, 61.2% have an exposed cable modem control interface, an exploitation channel commonly used by Internet-wide attacks.
“Company security risks are rising sharply as a massive workforce suddenly accesses sensitive resources from anywhere,” said Stephen Boyer, chief technology officer at Bitsight. “Addressing cyber risk to the remote workforce has become the primary concern for security and risk professionals. Through our latest innovations, Bitsight is helping organizations of all sizes tackle this critical priority immediately.”
For Bitsight’s research on Work From Home -- Remote Office networks: https://bitsig.ht/34vv5Tg
For more information about Bitsight’s Work From Home -- Remote Office capabilities: https://bitsig.ht/2XxX5nN
About Bitsight
Bitsight transforms how organizations manage cyber risk. The Bitsight Security Ratings Platform applies sophisticated algorithms, producing daily security ratings that range from 250 to 900, to help organizations manage their own security performance; mitigate third party risk; underwrite cyber insurance policies; conduct financial diligence; and assess aggregate risk. With over 2,100 global customers and the largest ecosystem of users and information, Bitsight is the Standard in Security Ratings. For more information, please visit www.bitsight.com, read our blog or follow @Bitsight on Twitter.