IBM Security has announced the results of a global survey examining consumers’ digital behaviors during the pandemic, as well as their potential long-term impact on cybersecurity. With society becoming increasingly accustomed to digital-first interactions, the study found that preferences for convenience often outweighed security and privacy concerns amongst individuals surveyed – leading to poor choices around passwords and other cybersecurity behaviors.
Consumers’ lax approach to security, combined with rapid digital transformation by businesses during the pandemic, may provide attackers with further ammunition to propagate cyberattacks across industries – from ransomware to data theft. According to IBM Security X-Force, bad personal security habits may also carry over to the workplace and can lead to costly security incidents for companies, with compromised user credentials representing one of the top root sources of cyberattacks reported in 2020. IBM X-Force Threat Index 2021: Compromised user credentials were #3 initial attack vector for cyberattacks in 2020, representing 18% of incidents reported.
- The global survey Global survey was conducted by Morning Consult on behalf of IBM in March 2021. The study was conducted among 22,000 adults in 22 markets. of 22,000 individuals in 22 markets, conducted by Morning Consult on behalf of IBM Security. The survey identified the following effects of the pandemic on consumer security behaviors in Singapore:
- Digital Boom will Outlast Pandemic Protocols: Singaporean respondents surveyed created about 10 new online accounts during the pandemic across all categories, and on average, created 2 new accounts for shopping/retail. Respondents under 35 are slightly more likely to have created new online accounts during the pandemic. With nearly half (47%) reporting that they do not plan to delete or deactivate any of the new accounts they created during the pandemic after society returns to pre-pandemic norms, these consumers will have an increased digital footprint for years to come, greatly expanding the attack surface for cybercriminals.
- Account Overload Led to Password Fatigue: The surge in digital accounts led to lax password behaviors amongst those surveyed, with 45% of respondents admitting to reusing credentials mostly or always re-use the same credentials they have used for other accounts, and 29% have an even mix of re-used credentials and new credentials. GenZers (52%) and respondents under 35 (51%) are more likely to be re-using the same credentials across accounts. This means that many of the new accounts created during the pandemic likely relied on reused email and password combinations, which may have already been exposed via data breaches over the past decade.
- Convenience Often Outweighed Security & Privacy: Over a third (34%) surveyed would rather place and pay for an order digitally than go to a physical location or call to place an order even if they had concerns about the website/app’s safety or privacy. Those under 50 and GenZers are more likely to say they would rather place and pay for an order digitally than go to a physical location or call to place an order even if they had concerns about the website/app’s safety or privacy. With these users more likely to overlook security concerns for the convenience of digital ordering, the burden of security will likely fall more heavily on companies providing these services to avoid fraud. Nearly seven in ten (69%) respondents would remove permission for an application track behavior if the app were tracking activity across other apps and websites.
- As consumers lean further into digital interactions, these behaviors also have the potential to spur adoption of emerging technologies in a variety of settings – from telehealth, to digital identity. Prediction based on IBM Security Insights.
“Like other countries across the globe, Singapore was propelled by the pandemic into a digital-first interaction for nearly every facet of life and it continues to shape our day-to-day interactions. From groceries, banking, social interactions to even healthcare services for COVID-19, consumers are demonstrating a sophisticated command of digital tools. As a result, businesses are increasingly reliant on digital channels for customer engagement and service delivery, greatly increasing their cybersecurity risks. Organizations are actively looking for advanced tools, leveraging AI and analytics, to modernize their Identity and Access Management platforms to provide a frictionless user experience across digital platforms while creating a stronger security posture and limiting potential risk. To assure the greatest levels of security, adopting a ‘Zero-trust’ approach, developing and understanding context around every user, every device and every interaction is mission critical.” Matthew Glitzer, Vice President, IBM Security, APAC.
Consumers Report High Expectations for Ease of Access
The survey shed light on a variety of consumer behaviors impacting the cybersecurity landscape today and moving forward. As individuals increasingly leverage digital interactions in more realms of their lives, the survey found that many have also become primed with high expectations for ease of access and use.
5 Minute Rule: According to the survey, most adults (53%) expect to spend less than 5 minutes setting up a new digital account.
Three strikes you’re out: On average, respondents across all age group would attempt about 3 logins before resetting their login credentials including password. These resets not only cost companies’ money, they can also pose security threats if used in combination with an already compromised email account.
Committed to Memory: 50% of respondents in Singapore store online account information in their memory (most common method) while 22% store this information in the notes application on their phones or tablets and 21% write this information on paper.
Multi-factor authentication: While password reuse is a growing problem, adding an additional factor of verification for higher risk transactions can help reduce the risk of account compromise. The survey found that over three quarters of Singaporean respondents have used a two-factor or multi-factor authentication to access an online account across all time periods
Diving Deeper into Digital Healthcare
During the pandemic, digital channels became a crucial component to address massive demands for COVID-19 vaccines, testing and treatment. Consumers’ adoption of a wide variety of digital channels for COVID-19 related services may spur greater digital engagement with healthcare providers moving forward by lowering the barrier for entry amongst new users, according to IBM Security analysis Prediction based on IBM Security analysis. According to the survey:
- Singaporean respondents shifted further into digital interactions during COVID-19, and in most instances say they will continue to rely on digital interactions in life after the COVID-19 pandemic compared to prior. 45% of consumers in Singapore engaged with pandemic-related servicesIncludes COVID-19 financial relief, testing, treatment and vaccinationsvia some form of digital channel (web, mobile app, email, and text message).
- While websites/web apps were the most common method of digital engagement, mobile apps and phone calls also received significant usage.
As healthcare providers push further into telemedicine, it will become increasingly important for their security protocols to be designed to withstand this shift – from keeping critical IT systems online, to protecting sensitive patient data. This includes data segmentation and implementing strict controls so that users can only access specific systems and data, limiting the impact of a compromised account or device. To prepare for the event of ransomware and extortion attacks, patient data should be encrypted, preferably at all times, and there must be reliable backups in place so that systems and data can be quickly restored with minimal interruption.
Paving the Way for Digital Credentials
The concept of digital health passes, or so-called vaccine passports, introduced consumers to a real-world use case for digital credentials, which offer a technology-based approach to verify specific aspects of our identity. According to the survey 62% of adults in Singapore say they are familiar with the concept of digital credentials, and 79% would be likely to adopt them if they became commonly acceptable.
This exposure to idea of digitized proof of identity during the pandemic may help spur wider adoption of modernized systems of digital identity, which could potentially replace the need for traditional forms of ID like passports and driver’s licenses, offering a way for consumers to provide the limited information required for a specific transaction. While leveraging a digital form of identity has the potential to create a sustainable model for the future, security and privacy measures must be put in place to help protect against counterfeiting – calling for the capabilities of blockchain solutions to verify and provide the ability to update these credentials in the event they are compromised.
How Organizations Can Adapt to Shifting Consumer Security Landscape
Businesses that have become increasingly reliant on digital engagement with consumers as a result of the pandemic should consider the impact this has on their cybersecurity risk profiles. In light of shifting consumer behaviors and preferences around digital convenience, IBM Security suggests that organizations consider the following security recommendations:
- Zero Trust Approach: Given increasing risks, companies should consider evolving to a “zero trust” security approach, which operates under the assumption that an authenticated identity, or the network itself may already be compromised, and therefore continuously validates the conditions for connection between users, data, and resources to determine authorization and need. This approach requires companies to unify their security data and approach, with the goal of wrapping security context around every user, every device, and every interaction.
- Modernizing Consumer IAM: For companies that want to continue leveraging digital channels for consumer engagement, providing a seamless authentication process is important. Investing in a modernized Consumer Identity and Access Management (CIAM) strategy can help companies increase digital engagement – providing a frictionless user experience across digital platforms and using behavioral analytics to help decrease the risk of fraudulent account use.
- Data Protection & Privacy: Having more digital users means that companies will also have more sensitive consumer data to protect. With data breaches costing companies $3.86 million on average, amongst those studied2020 Cost of a Data Breach Report, benchmark study conducted by Ponemon Institute, analyzed and sponsored by IBM Security, organizations must put strong data security controls in place to protect against unauthorized access – from monitoring data to detect suspicious activity, to encrypting sensitive data wherever it travels. Companies should also implement the right privacy policies on premise and in the cloud in order to help maintain consumer trust. According to the survey, over three in four respondents in Singapore trust healthcare (77%) and banking/financial institutions (81%) to protect their personal/sensitive information, and 60% trust large tech companies.
- Put Security to the Test: With usage and reliance on digital platforms changing rapidly, companies should consider dedicated testing to verify that the security strategies and technologies they’ve relied on previously still hold up in this new landscape. Re-evaluating the effectiveness of incident response plans, and testing applications for security vulnerabilities are both important components of this process.
