How to protect networks Spot COVID-19 themed malicious cyber activity Identify COVID-19 related scams, online fraud attempts and phishing emails by stopping and thinking: ■ Authority: Does the message claim to be from someone official? ■ Urgency: Is there a limited time to respond? ■ Emotion: Does the message evoke panic, fear, hope or curiosity? ■ Scarcity: Is the message offering something in short supply? Check if a COVID-19 message is legitimate: ■ Go back to trustworthy sources. Visit the official website, log into an account, or phone the officially advertised phone number. Don’t use the links or contact details in the message received. ■ Check to see if the official source has stated they will never ask for certain details. Protect remote working environments Individuals and Australian organisations continue to be targeted by malicious actors with COVID-19 related scams, online fraud attempts and phishing emails. Consider the following steps to protect a remote working environment: ■ Be aware of scams – educate employees to recognise scams and social engineering and the risks associated with phishing, including opening malicious links and using social media networks. Raise awareness of good personal cyber security hygiene. ■ Enable multi-factor authentication – have multi-factor authentication enabled by default on any corporate networks, devices or systems. ■ Update devices and systems – update software and turn on automatic operating system updates. ■ Use passphrases – these are most effective when they are long, complex, unpredictable and unique. ■ Follow the ACSC’s COVID-19 specific guidance for: individuals working from home, small and medium businesses, large organisations (Operational Technology Environments), and government. ■ Use a virtual private network (VPN) – these are an additional layer to securing web browsing and remote access over Wi-Fi. Note that this does not secure actual devices or online accounts, so it is important that these are also up to date. Stay updated The ACSC has released the following updates about COVID19 malicious cyber activity: ■ COVID-19 themed malicious cyber activity ■ COVID-19 malicious scams - threat awareness and guidance 29