We are living in unprecedented times. For most people and companies, this is unchartered territory. The COVID-19 outbreak has swept the globe, shutting cities, closing schools, curbing travel and prompting millions of workers to work from home. The need to maintain business functions and manage business risks is the need of the hour.
Business Continuity In The New World Order
We are all aware of the importance of business continuity plans in sustaining business operations. But let’s accept it; most of us didn’t plan for this. We didn’t have a continuity plan for a shortage of toilet paper, masks or sanitizers. We probably didn’t plan for a sudden wave of remote workers or a surge of incoming traffic from different applications, systems and platforms.
A recent survey by Gartner highlights that only 12% of businesses currently have business continuity planning for something like a coronavirus.
Testing Times For Infrastructure And Cybersecurity
While corporate networks are seeing a sudden rise in virtual private network (VPN) connections, internet service providers are suddenly being pushed to lift data caps. The telemedicine industry also reported an increase in breakdown of technology tools, owed to a recent surge in patients trying to consult their doctors remotely.
Infrastructure that has never been stress-tested in the past is now under a lot of pressure from untested applications, platforms and systems trying to connect to the corporate network.
According to sources, more than 50% of businesses have never been stress-tested for an event of this magnitude.
From a cybersecurity perspective, attackers are known to exploit vulnerabilities and the current climate is an ideal scenario for attackers. As the crisis unfolds, there are several reasons why businesses need to be concerned from a cybersecurity perspective:
• Heightened Levels Of Stress, Anxiety And Panic: Early reports indicate that coronavirus is fueling stress, anxiety, fear and panic in employees. Attackers are known to target vulnerable users, especially in times of social isolation and budget pressure. Employees are bound to make mistakes (by clicking on unwanted links, downloading attachments, entering credentials or leaking data accidentally) when they’re distracted or stressed out. With more and more people at risk of losing their jobs, frustration with employers could lead to increases in malicious insiders leaking sensitive data.
• Lack Of Cybersecurity Hygiene: Similar to washing hands, not touching your face or using a sanitizer, working from home requires a heightened level of awareness in cybersecurity, and chances are your employees have never developed adequate cybersecurity habits. For example, attackers could send out a bogus Zoom teleconference invite and trick users into clicking malicious links to spread malware.
• Rapidly Expanding Attack Surface: With unknown mobile devices and apps connecting to corporate systems, any vulnerability could immediately lead to attackers taking advantage of the opportunity. With so many people working from home, all employees are technically outside of the perimeter. A lack of antivirus software and firewalls, unpatched systems, software and apps could put the entire organization at risk.
• Increased Fraudulent Activities: Seven of the largest social networks (Facebook, Google, LinkedIn, Microsoft, Reddit, Twitter and YouTube) issued a statement last week in an attempt to combat fraudulent activities and disinformation being spread on their networks. Attackers are now using fake coronavirus heat maps that have been designed specifically to spread viruses and malware. CISA (Cybersecurity and Infrastructure Security Agency) also recently issued an advisory cautioning users to be wary of social engineering attacks. There has also been a continuous surge in coronavirus-themed emails.
Practical Questions To Reveal Risk Factors
If you’re in the process of creating or reevaluating a business continuity plan or looking to boost security of your remote workers, below are questions that will flag risk factors that will require your attention:
• Does your business continuity plan involve slow-moving outbreaks where a temporary two-week disruption might suddenly become a five-month disruption? Or is your plan only designed for temporary disruptions? Can your infrastructure cope if suddenly all employees work from home?
• Are there any critical tasks that involve someone physically doing something so that operations run smoothly? Have you identified your critical tasks, employees and applications that must run at any cost in case of a business emergency?
• In case of a disruption, how will your help-desk person do their job if it involves physically checking up on items? Do you have the right processes, policies and tools in place to get the job done?
• Have you stress-tested your applications for high loads? What are the critical applications beyond email, and can your organization handle a sudden surge in traffic?
• If you’re on the cloud, then you’re in a better position to scale. But does your organization have contracts to up-level your cloud if it needs to?
• Is there an ongoing phishing awareness and training program in place to ensure employees identify and avoid phishing scams effectively, especially when they’re at home?
• Are employee home networks trusted enough to do critical work? Do you have a cybersecurity policy in place for people working from home? Are they aware of the system requirements to connect to your corporate VPN?
• Do employees pause and evaluate emails masquerading as official messages? Do they know who or what the trusted sources are? Have you established an official channel of communication?
Like everything else, this situation too shall pass. It is important, however, that we reflect on our learnings, look for gaps in our security operations, lay down policies and plan for similar contingencies in the future. 2020 will certainly go down in history as the year of remote work.