EC News DeskWe’re living in a time of great upheaval. Countries across the world are facing a pandemic. We all have a lot to be worried about, for our workers, business operations, financial impact, and the health and safety of ourselves and our families. With organisations waking up to a changing economic outlook, perhaps cybersecurity is not top of mind. But it should be a top priority.
Cybersecurity is the foundation upon which so many digital services are delivered and how we connect and communicate. In fact, it has recently been included in the Department of Homeland Security’s designation of essential critical infrastructure workforce.
We have to be vigilant, for example, in mitigating new threats that are emerging as a result of this situation. We have to ensure that people can access accurate and potentially life-saving information as they are asked to stay home. We have to keep businesses running as workers are remote.
The idea that we could encounter a major cybersecurity challenge to our health systems or other vital infrastructures on top of the pandemic is probably more than we want to comprehend. Yet, already, a hospital in Europe has faced a cyber incident.
As business and government leaders, we have a responsibility to be aware of all potential possibilities and err on the side of caution.
Protecting a rapidly scaling remote workforce
A top challenge for businesses is managing a remote workforce. You may have proper tools and protection in place since remote work is not a new concept. But how do you scale? Even organisations that have the ability to support remote workers are struggling to increase scale and move quickly.
Complicating the matter is the disruption the coronavirus pandemic is causing to our supply chains. It has already become difficult to ensure the speedy delivery of goods and materials where they are needed. The situation is likely to get worse as more people work from home and more elements of the supply chain begin shutting down.
Leveraging and accessing services from the cloud is one way to think about scaling and protecting your remote workers. This applies to cybersecurity, since more solutions are in the cloud than ever before; it can also apply to other areas of the business where software-as-a-service may be a more viable distribution model than physical products.
The key is to take proper steps to not only leverage cloud security solutions, but to also ensure your organisation is not increasing cybersecurity risk by expanding its use of cloud services.
We can stay connected to one another virtually even when we’re not together physically. It is impossible to overstate just how valuable these connections are. We must do everything possible to ensure these connections are available, trustworthy and safe.
Back to basic cybersecurity hygiene
With exponentially more people working remotely, and with the likely increase in the use of cloud-based services, more than ever we have to stress the importance of employing good cyber hygiene and discipline.
Follow best practices in what to do and what not to do. This applies to our workers, employees, partners, supply chains and, of course, ourselves.
Cybersecurity leaders have to be in constant communications with our workers and ecosystems. They have to educate everyone and practice what they preach.
Remember, many people are working remotely now who have never worked remotely before. They may not be aware of things they are doing that may inadvertently create unnecessary risks. Among the basics that must be communicated:
- When working remotely, keep business and personal accounts separate. The bleed over of risk from personal to business can be detrimental to a company or government organisation.
- Use best practices in basic hygiene such as using strong passwords and changing them routinely, using multi-factor authentication, identity management and device security settings.
- Make sure users know what to do if a device is lost, stolen or compromised in any other way. Make sure IT and security teams have the proper tools for monitoring and visibility across cloud environments.
- Apply the same principles in the cloud as you would on premises, including decisions about what is most important to protect, prioritising resources and having the ability to see and stop threats that pose the greatest risks to your core mission.
Most of all, and I can’t stress this enough, try to keep things as simple as possible. In an environment of uncertainty, keep complexity at bay.
Business continuity requires agility
Many organisations are trying to adapt to the unprecedented disruptions. They have to be flexible. In military terms, we would be looking at the difference between a raid and a movement-to-contact operation. With a raid, you have a great deal of certainty, detailed intelligence on the threat, an organised and synchronised plan and everything built around clockwork precision.
Movement-to-contact is exactly the opposite. You are dealing with uncertainty and don’t know precisely where the threat is and how it will react. You don’t commit the entire organisation up front, you hold a lot in reserve. You may start with a small reconnaissance force, relying on clear communication to gain the intelligence to decide what to do next.
You need to have flexibility and resources in reserve to deal with the unknown. That’s the situation we find ourselves in with the pandemic and cybersecurity threats.
We have to have constant communications around what is going on, how we’re adapting and educating all of our people about security in this new environment. Keep things simple, have backup and contingencies, and be ready to change priorities.
In the past we may have thought about critical infrastructure in terms of energy grids, water supplies, air traffic control, military intelligence and other matters of clear and urgent national security. In a pandemic, however, we have to be flexible: At what point do we consider groceries a priority over other, more traditional, critical infrastructure or services? What about transportation services that get needed equipment and supplies to hospitals?
No one knows how long this coronavirus pandemic will last. We have to ensure that our health care, supply chains, military operations and other vital systems are secure. For leaders in business and government, we have to make sure cybersecurity remains a priority and take the proper steps to mitigate potential risks.
By John A Davis, Vice President of Public Sector at Palo Alto Networks.
