With society becoming increasingly accustomed to digital-first interactions, a global study on consumers’ digital behaviour found that preferences for convenience outweighed security and privacy concerns.
Consumers’ lax approach to security, combined with rapid digital transformation by businesses during the pandemic, may provide attackers with further ammunition to propagate cyberattacks across industries – from ransomware to data theft.
According to IBM Security X-Force, bad personal security habits also carry over to the workplace and can lead to costly security incidents for companies, with compromised user credentials representing one of the top root sources of cyberattacks reported in 2020.
Conducted by Morning Consult on behalf of IBM, the IBM X-Force Threat Index 2021 identified the following effects of the pandemic on consumer security behaviours in Asia Pacific:
Digital boom will outlast pandemic protocols: APAC respondents surveyed created about 17 new online accounts during the pandemic across all categories.
With 37% reported that they do not plan to delete or deactivate any of the new accounts they created during the pandemic after society returns to pre-pandemic norms, these consumers will have an increased digital footprint for years to come, greatly expanding the attack surface for cybercriminals.
Account overload led to password fatigue: The surge in digital accounts led to lax password behaviours amongst those surveyed, with 86% of APAC consumers admit to re-using their online credentials across accounts at least some of the time.
This means that many of the new accounts created during the pandemic likely relied on reused email and password combinations, which may have already exposed via data breaches over the past decade.
Convenience often outweighed security & privacy: 54% of the APAC respondents surveyed would rather place and pay for an order digitally than go to a physical location or call to place an order even if they had concerns about the website/app’s safety or privacy.
60% of millennials are more likely to say they would rather place and pay for an order digitally than go to a physical location or call to place an order even if they had concerns about the website/app’s safety or privacy.
With these users more likely to overlook security concerns for the convenience of digital ordering, the burden of security will likely fall more heavily on companies providing these services to avoid fraud.
These behaviours have the potential to spur the adoption of emerging technologies in a variety of settings – from telehealth to digital identity.
Matthew Glitzer, vice president, IBM Security, APAC, says businesses are increasingly reliant on digital channels for customer engagement and service delivery, greatly increasing their cybersecurity risks.
“Organizations are actively looking for advanced tools, leveraging AI and analytics, to modernize their Identity and Access Management platforms to provide a frictionless user experience across digital platforms while creating a stronger security posture and limiting potential risk.
“To assure the greatest levels of security, adopting a ‘Zero-trust’ approach, developing and understanding the context around every user, every device and every interaction is mission-critical,” said Glitzer.
APAC survey factoids:
APAC respondents shifted further into digital interactions during COVID-19, and in most instances say they will continue to rely on digital interactions in life after the COVID-19 pandemic compared to prior. 69% of consumers in Asia Pacific engaged with pandemic-related services including COVID-19 financial relief, testing, treatment and vaccinations via some form of digital channel (web, mobile app, email, and text message).
While websites/web apps were the most common method of digital engagement, mobile apps and phone calls also received significant usage.
As healthcare providers push further into telemedicine, it will become increasingly important for their security protocols to be designed to withstand this shift – from keeping critical IT systems online to protecting sensitive patient data and continued HIPAA compliance.
This includes data segmentation and implementing strict controls so that users can only access specific systems and data, limiting the impact of a compromised account or device.
To prepare for the event of ransomware and extortion attacks, patient data should be encrypted, preferably at all times, and there must be reliable backups in place so that systems and data can be quickly restored with minimal interruption.
Paving the way for digital credentials
The concept of digital health passes, or so-called vaccine passports, introduced consumers to a real-world use case for digital credentials, which offer a technology-based approach to verify specific aspects of our identity.
This exposure to the idea of digitized proof of identity during the pandemic may help spur wider adoption of modernized systems of digital identity, which could potentially replace the need for traditional forms of ID like passports and driver's licenses, offering a way for consumers to provide the limited information required for a specific transaction.
While leveraging a digital form of identity has the potential to create a sustainable model for the future, security and privacy measures must be put in place to help protect against counterfeiting – calling for the capabilities of blockchain solutions to verify and provide the ability to update these credentials in the event they are compromised.
Response options for businesses (IBM recommendations)
Zero Trust Approach: Continuously validates the conditions for connection between users, data, and resources to determine authorization and need.
This approach requires companies to unify their security data and approach, with the goal of wrapping security context around every user, every device, and every interaction.
Modernizing Consumer IAM: Invest in a modernized Consumer Identity and Access Management (CIAM) strategy can help companies increase digital engagement and use behavioural analytics to help decrease the risk of fraudulent account use.
Data Protection & Privacy: Organizations must put strong data security controls in place to protect against unauthorized access – from monitoring data to detect suspicious activity, to encrypting sensitive data wherever it travels. Also, implement the right privacy policies on-premise and in the cloud to help maintain consumer trust.
Put Security to the Test: Companies should consider dedicated testing to verify that the security strategies and technologies they’ve relied on previously still hold up in this new landscape. Re-evaluating the effectiveness of incident response plans, and testing applications for security vulnerabilities are both important components of this process.
