The novel coronavirus has resulted in a health and economic crisis, and lockdowns have been announced across different parts of the world. If you are responsible for running a business, your first concern sure was to keep your business running and prevent financial loss without putting your employees at risk. While a data center, miles away from the affected area, could have ensured zero business disruption under any other circumstance, the COVID-19 pandemic is so widespread that such measures have failed. Work from home has become the new normal to continue operations.
In the absence of powerful control mechanisms that typically existed in the organization and a decrease in regular IT monitoring activities, security incidents have increased. It is now imperative for enterprises to introduce an overall business continuity plan and adopt cyber resilience if they haven’t done so yet. Here are some of the cybersecurity best practices that will enable them to prepare for, respond to and recover from cyberattacks.
- Adopt cloud-based controls: Adopt cloud-based pervasive controls to ensure continuous security detection and protection even when machines are not connected to the network. Review your organizations bring your own device (BYOD) policies once again and enhance security measures, if required, by restricting non-compliant and high-risk devices to the organization network.
- Make data security and privacy a priority: At a time when employees have direct access to critical applications right from their homes, adopt technologies that will secure customer data. Pay special attention to high-risk employee groups that handle personally identifiable information (PIN) or any other confidential data. Closely monitor for any unusual online behavior or patterns that could result in a security breach.
- Rethink budgets for IT and security: While the world is optimistic about life getting back to normal once again, there’s skepticism too. These best practices will not only facilitate operations temporarily but will help even if the health crisis isn’t fixed in the next few months. Hence, it is best to be prepared and implement them as a way of working. Relook at budgets for IT and security and re-allocate funds to accommodate the new normal and do more with lower investments.
- Multifactor authentication is a must: An additional layer of security with multifactor authentication (MFA) to access networks and critical applications is totally worth it. State-of-the-art MFA technologies can not only make logging in less troublesome for users but also help cybersecurity teams protect credentials against theft. Banking interfaces and other critical applications that are functioning in the work-from-home scenario for the very first time can be secured with special controls with VPNs and MFA
- Step up your training and awareness efforts: Virtual training programs and e-mail communication campaigns are a great way to reiterate the need to be extra vigilant on verification. Your employees should be able to recognize and avoid phishing scams. As per a Barracuda Networks report, there has been over a 600% spike in phishing e-mails since the end of February 2020 as cybercriminals capitalize on the fear generated by the COVID-19 Increase your social engineering awareness efforts and educate your employees—whether they are installing software, sharing personal data, or clicking on links in e-mails that look trustworthy, they should verify the source of every URL every single time at every step for authenticity. Shift to crisis-specific testing themes in your phishing campaigns and act accordingly.
- Admit it! Shadow IT is a reality: Many employees set up so-called shadow IT systems without formal permission, usually to be more productive. Processes that rely on these assets while at office may fail, as employees cannot access them from home and an uncertain lockdown scenario will expose these shadow IT systems. Considering the current situation, IT and security teams should extend support and guard these business-critical shadow assets as well as new ones that employees set up to make work from home easier.
- Take advantage of robotic process automation: Businesses that leverage the power of robotic process automation are the ones that will win the competitive edge even in a crisis scenario. Bots not only help enterprises proceed with business as usual by taking care of complex repetitive tasks but can also scale up as co-workers and problem solvers in the absence of a human workforce.
- Maintain good cyber hygiene: A long, complex password to guard devices and files against cyberattacks is the need of the day today and every other day. Ensure home networks connect only with a lengthy, unguessable password. Reusing the same password across the web is not a good idea. Logging in via public WiFi is a big no! Invest in a dependable virtual private network (VPN) for Internet access.
- Introduce processes to report cyber incidents: It is important to have standard processes in place for reporting cyberattacks. At the same time, it is also essential for employees to understand the seriousness of the attacks and be aware of the organizations reporting protocol. Outlook plugins can be an easy and great way to enable your employees to report IT security issues.
- Ensure clear lines of communication: Considering the current work-from-home scenario, if the organization’s e-mail system is suddenly unavailable, ensure employees are still able to interact using a secure means of communication. Social media platforms and messengers are not a good way to exchange sensitive information.
- Stay up to date on updates and patches: As the world anxiously pays attention to updates on the impact of the novel coronavirus from trusted sources, stay ahead of the curve with respect to system software updates too. Accelerating and shortening patch cycles for critical systems such as VPNs and cloud interfaces will help identify and mitigate vulnerabilities quickly, protecting remote infrastructure.
Stay aware and make the right move at the right time to protect your assets!
Vijay Bharti is the Chief Information Security Officer (CISO) and Senior Vice President of Cyber Security practice at Happiest Minds Technologies. He brings in more than 20 years of experience in the area of IT Security across multiple domains like Identity and Access Management, Data Security, Cloud Security and Infrastructure Security.
His recent work includes building Security Operation Center frameworks (including people, processes and various SIEM technologies) where he is working on building an integrated view of security and ways of leveraging advance analytics and big data innovations for cyber security.
