By Richard Addiscott
Gartner, Inc.
Despite the current global pandemic, cybercriminals have made it clear they’re not taking any time off. In fact, the Canadian Centre for Cyber Security issued an alert warning that health organizations supporting the national response to COVID-19 face an “elevated level of risk” for security incidents.
During these kinds of crises, organizations are focused on employee health and business continuity. Now that many workers have shifted to working remotely and organizations are distracted trying to handle the virus, security and risk management teams need to be more vigilant than ever.
It’s critical for security leaders to take preemptive steps to ensure the resiliency and security of their organization’s operations as attackers seek to exploit human nature and nonstandard operating modes. In a sea of overwhelming priorities, security and risk teams should focus on seven strategic areas during COVID-19.
- Update incident response protocols to reflect new operating conditions
Given that most of the security and risk team is now operating in completely different environments and mindsets, incident response plans and protocols might become obsolete or need to be adjusted. Even incidents that would normally be well-managed risks can become bigger issues if the team can’t respond effectively.
Begin by reviewing the response team. Ensure that primary, secondary and alternate roles are filled and that everyone has access to the equipment they need to be effective. This is also a good time to reach out to suppliers to see what hardware they have and whether you can get it to the right people if needed.
Review all documentation and conduct a walk-through with a careful watch for any problem areas. If the organization does not already have a cybersecurity incident response capability, consider using the services of a managed security service provider instead of trying to stand up a new system.
- Test and secure remote access capabilities and patch endpoints
Given how quickly most organizations found themselves moving to remote work, many security teams did not have time to perform basic endpoint hygiene and connectivity performance checks on corporate machines. Further complicating the matter are employees who are working on personal devices.
Ensure that corporate laptops have the minimum viable endpoint protection configurations for off-LAN activity. Security and risk teams should also be cautious with access to corporate applications that store mission-critical or personal information from personally owned devices.
Where possible, they should confirm whether personal devices have adequate anti-malware capabilities installed and enabled. If not, they should work with the employee and their corporate endpoint protection platform vendor to ensure the device is protected as soon as possible.
Other mechanisms such as software-token based multifactor authentication will also be useful to ensure only authorized personnel have access to corporate applications and information remotely.
On a strategic level, make sure someone from the security team is part of the crisis management working group to provide guidance on security concerns and business-risk-appropriate advice.
- Ensure remote workers remain vigilant to social engineering attacks
The reality is that employees will have more distractions than usual, whether it’s having kids at home, worrying about family or concerns about their own health. They’re also operating in a different environment and might not be as vigilant about security during a time where cybercriminals will exploit the chaos.
Make sure you reach out to senior leaders with examples of target phishing attacks, and alert employees to the escalating cyberthreat environment. Remind them that they must remain focused and hypervigilant to suspicious activities.
If appropriate, send out reminders every two weeks and remind them of the location of pertinent documents such as remote and mobile working policies, as well as where they can access security awareness training material if they want a refresher. Further, clearly communicate who to contact and what to do if employees suspect a cyberattack.
- Tune security monitoring capabilities to have visibility of the expanded operating environment
The sudden relocation of much of the workforce creates the potential for cybersecurity teams to miss events. Ensure that your monitoring tools and capabilities are providing maximum visibility. Check that internal security monitoring capabilities and log management rule sets enable full visibility. If using managed security services providers, check in to make sure they are adapting their monitoring and logs in a manner that makes sense for the new operating landscape.
- Engage with security services vendors to evaluate impacts to the supply chain
The changes in the security landscape won’t just come from your own organization. Be aware of what your partners and supply chain are actively doing with regards to security that will affect your organization. Confirm how they will be securing collected data and information from the business. Remember that each of these organizations has their own people to worry about and their own business concerns. Ask questions about where third-party organizations might fail to deliver on promised security services.
- Account for cyberphysical systems security challenges
COVID-19 is stressing many pieces of the economy, from hospitals and healthcare to delivery services and logistics. This extends cybersecurity concerns to cyberphysical challenges, especially given the increase in automated services and systems. Security and risk teams should focus on ensuring foundational CPS/OT security hygiene practices such as asset discovery and network segmentation, and evaluating the risk of fixing a vulnerability against the risk, likelihood and impact of an attack to prioritize scarce resource deployments.
- Be mindful of employee information and privacy
Organizations may collect employee information that relates directly to the COVID-19 pandemic. For example, organizations might want to record when an employee visits a risk area or is home with an illness. However, this must be done ethically. Remember that all this information is subject to laws and industry rules. Beyond that, organizations should seek to collect the least amount of information possible, ensure it is factual and store it in a secure manner. This information should be disclosed only when required by law and within the organization only on a need-to-know basis.
Richard Addiscott is a Senior Director Analyst at Gartner. Mr. Addiscott works with information and cybersecurity leaders covering topics focused on improving security risk management maturity and outcomes, optimizing organisational security risk postures, and demonstrating clear alignment between security and strategic business outcomes.