Vulnerability disclosure and cybersecurity awareness campaigns on twitter during COVID‐19. Issue 6 (20th July 2021)

• Record Type: Journal Article
• Authors: Bahl, Aditya; Sharma, Aastha; Asghar, Muhammad Rizwan
• Is Part Of: Security and privacy. Volume 4:Issue 6(2021)
• Page Start: n/a
• Page End: n/a
• Publication Date: 2021-07-20
• Subjects: awareness campaigns -- COVID‐19 -- cybersecurity -- twitter -- vulnerability disclosure; Computer security -- Periodicals; Data protection -- Periodicals; Cyberterrorism -- Periodicals; 005.8
• DOI: 10.1002/spy2.180
• Languages: English
• ISSNs: 2475-6725

Abstract

Abstract: The COVID‐19 pandemic introduced the new norm that changed the way we work and live. During these unprecedented times, most of the organizations expected their employees to work from home. Remote working created new opportunities for hackers since more users were making use of digital platforms for online shopping, accessing Virtual Private Network (VPN), videoconferencing platforms, and software alike. Consequently, cybercrime increased due to the increase in the attack surface, and software vulnerabilities were exploited for launching cyberattacks. There is existing research that explores vulnerability disclosure on Twitter. However, there is a lack of study on opportunistic targeted attacks where specific vulnerabilities are exploited in a way that benefit adversaries the most in times such as COVID‐19. The primary aim of this work is to study the effectiveness of vulnerability disclosure pattern on Twitter in COVID‐19, and discuss how Twitter can be leveraged as Open‐Source Intelligence (OSINT) during a pandemic where the global users can follow a coordinated approach to share security‐related information and conduct awareness campaigns. The study identifies Twitter as an apt source for conducting cybersecurity awareness campaigns as 99.83% of the security vulnerabilities are found to be accurate. The information can help global cybersecurity agencies to proactively identify vulnerabilities, coordinate activities, and plan for mitigation strategies since releasing patches from the vendor might take time.