Because many devices attached to home networks don’t get patched or updated as frequently as corporate devices, the most common exploits detected so far in 2020 have targeted older systems. Nearly two-thirds of attacks targeted vulnerabilities disclosed in 2018, and a quarter targeted vulnerabilities from 2004.
Due to the global pandemic, nearly two-thirds of companies have moved half or more of their employees to telework. Sixty-two percent of employed Americans, for example, say they have worked from home during the crisis, with the number of remote employees doubling between March 13 and April 2 of 2020, and this is not just a temporary change. Nearly a third of all organizations with remote workers expect that half or more will continue working from home after the pandemic.
The security implications of such a dramatic transition in such a short period of time cannot be overstated. Under normal circumstances, moving an entire workforce from secure IT environments to home networks with very little cybersecurity would take long-term planning and preparation. But that was not an option in 2020. As a result, 32% of respondents to Fortinet’s 2020 Securing Remote Work Survey found that setting up and managing secure connectivity to be the most challenging aspect of switching to telework.
Part of the problem was that the devices at the company’s core network were not designed to manage the volume of VPN connections required. As a result, many connections were not secure. Or even if they were encrypted, existing firewalls were incapable of inspecting VPN tunnels to ensure they weren’t being used to deliver malware – at least not without significantly slowing down connections.
But the other part of the challenge is that many home networks were not setup to support the bandwidth requirements of VPN, let alone bandwidth-hungry business applications such as video conferencing. In addition, end user devices (many workers began working from home using a personal device) were often unpatched and unsecured as were other devices connected to the home network. These challenges made home networks an ideal target for cybercriminals.
Cybercriminals Are Targeting Remote Workers
And as one might expect, threat researchers saw a significant shift in the behavior of cybercriminals. According to the latest Threat Landscape Report from FortiGuard Labs, global sensors detected that the top attack targets identified in the first half of 2020 switched from targeting corporate devices and applications to things like consumer-grade routers and devices such as DVRs normally attached to home networks.
There was also a significant increase in attacks targeting end users that used concerns about the coronavirus to lure them into clicking on malicious web links or open attachments infected with ransomware or other malware.
Part of the problem was that the devices at the company’s core network were not designed to manage the volume of VPN connections required. As a result, many connections were not secure.
The FortiGuard Labs team saw an average of about 600 new phishing campaigns per day during the spring. And because home users were no longer protected by corporate security devices, web-based malware became the most common attack vehicle, outranking email as the primary delivery vector used by cybercriminals for the first time in years.
And because many devices attached to home networks don’t get patched or updated as frequently as corporate devices, the most common exploits detected so far in 2020 have targeted older systems. Nearly two-thirds of attacks targeted vulnerabilities disclosed in 2018, and a quarter targeted vulnerabilities from 2004.
Seven Recommendations for Remote Workers
During the last several months, IT teams have been scrambling to close the security gaps in their remote worker strategy. But while 92% of organizations report budget investments to address teleworker security, end users are still the front line of any security strategy – and never more so than now. Here are a few suggestions of what they can do to reduce risks.
Learn to Spot Attacks: Many organizations are sponsoring training programs to help their workers identify suspicious emails, websites, text messages, etc. In addition, there are free programs available online to provide end users with essential security training and information. And make sure everyone at home using the network, from roommates to children, get cybersecurity training as well.
Harden Passwords: Another easy step is to simply make passwords harder to guess, and also use different passwords for different accounts. To manage these passwords, use a secure password management system that can remember passwords. Then all anyone needs to remember is the login information for that one application.
Use Multi-Factor Authentication (MFA): Also known as two-factor authentication, MFA combines something a user knows, such as a password, with something they have, such as a fingerprint or a security token. MFA should especially be used when accessing financial information or logging onto the company network.
Patch Home Devices: Have users look at all of their devices at home and make sure they are running the latest versions of their operating systems. Even gaming and entertainment systems have options that let users check to see if they are running the latest version.
Secure Home Networks: This is probably a good time to consider adding or upgrading a security application to protect the home network and devices from attacks. In addition, many home routers now include gateway security which should also be enabled. Some cable operators and internet service providers also provide free security. Remote workers should make sure that logging onto the home WiFi requires a password. They should consider an email gateway that can detect and filter out malicious email attachment and links.
Improve Device Security: New advanced endpoint security solutions, known as endpoint detection and recovery (EDR), not only provides better threat detection, but also prevents infections that manage to get onto your device from executing their malware. EDR solutions should not only be applied to remote worker devices, but also on other endpoint devices in the home.
Upgrade Internet Connections: Remote workers should consider upgrading their internet service so they can run business-critical applications even when others are streaming movies or playing online games. Companies should consider providing funds to help offset the cost of a bandwidth upgrade.
Enhance Your Remote Work Security Now
Cybercriminals will continue to target remote workers, with no signs of letting up. Adding these seven steps to any corporate security strategy is the right way to begin protecting today’s distributed networks that include remote workers.
Now you see me, now you don’t: How subtle ‘sponsored content’ on social media tricks us into viewing ads
People are not as good at spotting them as they think. If people recognized ads, they usually ignored them – but some, designed to blend in with your friends’ posts, flew under the radar.
How many ads do you see on social media? It might be more than you realize. Scientists studying how ads work on Instagram-style social media have found that people are not as good at spotting them as they think. If people recognized ads, they usually ignored them – but some, designed to blend in with your friends’ posts, flew under the radar.
“We wanted to understand how ads are really experienced in daily scrolling — beyond what people say they notice, to what they actually process,” said Maike Hübner, PhD candidate at the University of Twente, corresponding author of the article in Frontiers in Psychology. “It’s not that people are worse at spotting ads. It’s that platforms have made ads better at blending in. We scroll on autopilot, and that’s when ads slip through. We may even engage with ads on purpose, because they’re designed to reflect the trends or products our friends are talking about and of course we want to keep up. That’s what makes them especially hard to resist.”
Learn more
The scientists wanted to test how much time people spent looking at sponsored versus organic posts, how they looked at different areas of these different posts, and how they behaved after realizing they were looking at sponsored content. They randomly assigned 152 participants, all of whom were regular Instagram users, to one of three mocked-up social media feeds, each of which was made up of 29 posts — eight ads and 21 organic posts.
They were asked to imagine that the feed was their own and to scroll through it as they would normally. Using eye-tracking software, the scientists measured fixations — the number of times a participant’s gaze stopped on different features of a post — and dwell time, how long the fixations last. A low dwell time suggests that someone just noticed the feature, while a high dwell time might indicate they were paying attention. After each session, the scientists interviewed the participants about their experience.
Although people did notice disclosures when they were visible, the eye-tracking data suggested that participants paid more attention to calls to action — like a link to sign up for something — which could indicate that this is how they recognize ads. Participants were also quick to recognize an ad by the profile name or verification badge of a brand’s official account, or glossy visuals, which caused participants to express distrust.
“People picked up on design details like logos, polished images, or ‘shop now’ buttons before they noticed an actual disclosure,” said Hübner. “On brand posts, that label is right under the username at the top, while on influencer content or reels, it might be hidden in a hashtag or buried in the ‘read more’ section.”
Although the scientists found that the ads often went unnoticed, if people realized that the content wasn’t organic, many of them stopped engaging with the post. Dwell time dropped immediately.
#ad
This was less likely to happen to ads that blended in better, with less polished visuals and a tone and format more typical of organic content. If ad cues like disclosures or call-to-action buttons weren’t noticed right away, they got similar levels of engagement to organic posts.
“Many participants were shocked to learn how many ads they had missed. Some felt tricked, others didn’t mind — and that last group might be the most worrying,” said Hübner. “When we stop noticing or caring that something is an ad, the boundary between persuasion and information becomes very thin.”
The scientists say these findings show that transparency goes well beyond just labelling ads. Understanding how people really process ads should lead to a rethink of platform design and regulation to make sure that people know when they’re looking at advertising.
However, this was a lab-based study with simulated feeds, and it’s possible that studies on different cultures, age groups, or types of social media might get different results. It’s also possible that ads are even harder to recognize under real-life conditions.
“Even in a neutral, non-personalized feed, participants struggled to tell ads apart from regular content,” Hübner pointed out. “In their own feeds which are shaped around their interests, habits, and social circles it might be even harder to spot ads, because they feel more familiar and trustworthy.”
Personalized pricing can backfire on companies, says study
If part of the product’s value depends on how many people are using it, think a social media network or e-commerce platform, not being able to see what others are being charged means consumers are fuzzier about how many people are likely to buy in and join the network.
Personalized pricing, where merchants adjust prices according to the pile of data about a consumer’s willingness to pay, has been criticized for its potential to unfairly drive-up prices for certain customers.
But new research shows that the practice can also hurt sellers’ profits.
Consumers commonly experience personalized pricing through digital coupons or other discount offers they receive either as potential customers or after making a purchase. Other recent examples include the practice of “Buy Now, Pay Later” plans that bundles the sale of a product with a subsidized loan, which can offer different prices to different customers based on their willingness to pay, and airlines using artificial intelligence to customize prices for individual airfares.
Companies can tweak their prices according to data about a customer’s digital footprint, including their buying preferences, location, lifestyle and even what kind of digital device and operating system they use—all in pursuit of squeezing maximum profit out of the buyer.
The downside though, says Liyan Yang, a professor of finance and the Peter L. Mitchelson/SIT Investment Associates Foundation Chair in Investment Strategy at the University of Toronto’s Rotman School of Management, is that this practice typically obscures the price information available to other consumers, an important factor in their decision to buy.
When prices are transparent to everyone and they’re low, “you know that on average, more people will be buying,” says Prof. Yang.
But if part of the product’s value depends on how many people are using it, think a social media network or e-commerce platform, not being able to see what others are being charged means consumers are fuzzier about how many people are likely to buy in and join the network.
The upshot? “Consumers are going to spend less,” says Prof. Yang.
The researcher put those ideas under a theoretical microscope when he and former Rotman PhD student Yan Xiong, who is now an associate professor at University of Hong Kong Business School, used mathematics and game theory to model what happens when consumers can’t see what other people are being charged for a network-based product. Their models revealed that a company ultimately charged more when prices were concealed compared to when they were transparent, leading to lower profits.
Luckily for companies, there are workarounds. Using similar modelling, the researchers found that the profit pitfall could be avoided through some kind of corporate commitment or backstop related to keeping prices low even as a company also pursued profits.
That could be done by the company committing to keep prices within a certain range or at least to lowering prices through a corporate social responsibility program, by developing a good reputation among consumers, by initially offering low prices that are transparent to attract consumers with a lower price threshold, or through the use of price caps either mandated by government or voluntarily adopted by the company.
Another option is for a government to require companies to charge the same price to all customers, a strategy promoted in China, the European Union and the United States where personalized pricing practices have become an issue.
While companies typically dislike regulation, Prof. Yang points out that theoretically at least, some form of price restriction may lead to better corporate profits in the end.
“There are trade-offs,” he says, adding that regulators would have to “gauge precisely” where the limits should be to hit the pricing sweet spot that optimizes profits to the company.
The study appeared in the Journal of Economic Theory.
Time plays a key role in consumer behavior, especially concerning the purchasing patterns of vulnerable groups in society who have been ridiculed in offensive and discriminatory ads. Ben-Gurion University researcher Dr. Enav Friedmann examined the long-term reactions of consumers from discriminated groups after exposure to offensive advertising. Such advertising often manifests in marketing messages that demean excluded groups, reinforce harmful stereotypes, or cross social norms.
Their findings were published last month in Psychology & Marketing. Dr. Friedmann is a member of the Department of Business Administration at Ben-Gurion University of the Negev. She is the head of the LBM research lab, which focuses on marketing,
“The social and psychological implications of such advertisements are profound,” explains Dr. Friedmann. “Socially, they normalize prejudice, perpetuate stereotypes, and undermine efforts to achieve equality. We decided to examine these conflicts of social identity combined with consumer behavior. This is a topic that hasn’t been researched enough, but it has significant implications for individuals, groups, and businesses in society.”
The Study’s Approach
To this end, three independent experiments were conducted. They examined the impact of exposure to insulting advertisements or those excluding vulnerable groups (women and people of color) at two time points: immediately upon exposure to the ad, and then 10 days or a month later.
The offensive ads were designed to be inspired by authentic advertisements from companies, which contained offensive content toward women and people of color. A total of 640 women and men, both light-skinned and dark-skinned, participated in all the experiments and answered questions related to the brand and their personal feelings.
Key Findings
In the first experiment, a hypothetical ad for a body soap brand called “BubbleSoap” was presented, with a racist implication toward people of color. A dark-skinned family was shown in the ‘before’ image and a light-skinned family in the ‘after’ image. It was found that dark-skinned participants who felt their ethnic group was severely discriminated against, and tended to identify less with their group, showed a higher purchase intention for the BubbleSoap brand ten days later compared to participants who did not feel their ethnic group was discriminated against.
The second experiment involved an offensive advertisement toward women for a real brand. Participants were randomly exposed to either non-offensive sexist ads or offensive sexist ads. The offensive version was identical but included the text: “Women, I’m sick of you! I get tired of all of you so quickly,” with the well-known tagline below: “You’re not you when you’re hungry.” This ad was inspired by real candy bar ads that mock the idea of men respecting women and aggressively disparage women under the guise of sarcastic humor.
After about a month, it was found that women who identified their gender group as significantly discriminated against, and tended to identify less with the female group, were more likely to choose the brand that offended their group. The choice was made at each time point by choosing between three chocolate brands. Of course, the respondents’ initial preference for the offensive brand was considered.
In the third experiment, neurological measurements were taken using an EEG device in a lab experiment for a construction company. Participants were randomly exposed to either offensive or non-offensive sexist ads. The offensive version included the text: “She thinks she understands… In big decisions, don’t let her decide!” Participants were asked to describe their feelings toward the brand at two points in time. The researchers measured the activation of the participants’ right and left frontal brain regions during a brand feeling task. After ten days, among women who identified their group as significantly discriminated against, and tended to identify less with the female group over time, increased activity was found in the left frontal areas (compared to the right) of the brain. These areas are known in the literature to indicate a desire to approach a stimulus.
Photo by Marcus Herzberg from Pexels.com
The Paradoxical Phenomenon
The findings revealed a paradoxical phenomenon: participants who reported high levels of perceived discrimination against their group, and over time tended to identify less with the offended group, actually showed an increasing preference for the brand that insulted their group. This was measured through purchase intention, actual product choice, or brain responses indicating an approach toward the brand.
This phenomenon aligns with theories of disidentification, a process in which individuals from vulnerable groups come to understand the long-term consequences of harm to their group (reduced self-esteem and group-esteem).
Those who feel their group is significantly discriminated against and tend to reduce their identification with the group in order to protect their sense of self-esteem, tend to do so by approaching the object that harmed their group over time.
“The research findings deepen our understanding of how identity threats affect responses in advertising contexts and highlight the ethical considerations brands must address when formulating campaigns,” explains Dr. Friedmann. “This research delves into the psychological complexity of identity regulation as a result of exposure to threatening content for consumers.”
Implications and Recommendations
The study results do not suggest that offensive-discriminatory advertising is an effective marketing strategy. Most participants exposed to this content did not demonstrate more positive attitudes or behaviors than those in the control group; rather, it was a specific limited group of people who reacted positively to it. On the contrary, such advertisements can exact a significant psychological toll on individuals belonging to discriminated groups. These findings reinforce the importance of adopting an ethical approach to identity-based marketing and avoiding tactics that exploit social vulnerability for strategic profit.
In accordance with the study’s findings, the researchers recommend adopting an approach that involves enforcement and clear criteria to prevent harm to various population groups.
“Enforcement against offensive and discriminatory marketing is essential to protect the well-being of individuals and foster a more egalitarian society. As a society, we must develop specific criteria for controlling offensive advertisements, as is customary in the UK, and impose significant financial penalties on those who violate them,” concluded Dr. Friedmann.
The Research Team
The research team included: Eliran Solodoha from the Peres Academic Center, Sandra Maria Correia Loureiro from the University of Lisbon, and Lior Aviali, LBM Lab Manager, from Ben-Gurion University of the Negev.