Keep Your Business Running
The most urgent challenge for most businesses was simply maintaining operations - getting employees productive from home without creating security gaps that attackers could exploit. The businesses that fared best had already invested in cloud services and documented their critical business processes. Those that hadn't were forced to make rapid decisions under pressure, often creating security debt they're still paying off.
VPNs: The Right and Wrong Ways
Many organizations deployed or expanded VPN infrastructure as an emergency measure. Done poorly, VPN creates significant security risks: it extends your corporate network to every remote worker's home environment, which may include personal devices, unsecured routers, and family members using the same network. Done correctly, VPN with split tunneling, MFA, and endpoint security checks can be appropriately secure.
The better long-term answer for most organizations is cloud-based access - Microsoft 365, Google Workspace, and modern SaaS applications that don't require VPN to access. These can be secured with MFA and Conditional Access policies without extending network-level trust to home environments.
Cloud Services Security
Organizations that had already migrated to Microsoft 365 or Google Workspace were significantly better positioned to maintain operations securely. However, the rapid adoption of cloud services also introduced new risks - inadequate MFA configuration, overly permissive sharing settings, and lack of monitoring for unusual access patterns.
Lavawall® monitors M365 and Google Workspace environments continuously - detecting unusual login patterns, unexpected sharing, and configuration changes that indicate compromise or accidental data exposure.
Phishing and Security Awareness
Attackers immediately created COVID-19-themed phishing campaigns targeting people whose concern about the pandemic made them more likely to click on emails appearing to be from health authorities, employers, and government agencies. The volume and effectiveness of these campaigns increased dramatically in the early weeks of the pandemic.
For organizations without a security awareness training program, the pandemic created a real exposure. Employees who had never been trained to recognize phishing suddenly faced sophisticated, timely lures designed to exploit the exact anxieties they were experiencing. The combination of stress, rapid organizational change, and new technology made this period particularly high-risk.
Backups and Business Continuity
Organizations that maintained current, isolated backups were able to recover from ransomware incidents without paying. Those whose backups were stored in locations accessible from the compromised network had their backups encrypted alongside their production data. The pandemic period saw ransomware attacks increase significantly as attackers targeted organizations they knew were distracted and potentially under-resourced for IT security response.
ThreeShield's backup recommendations: at minimum, maintain a current backup copy that is not accessible from your primary network (the "3-2-1" rule: 3 copies, 2 different media, 1 offsite/isolated). Test restores quarterly, not just the backup job completion.