How do you switch trajectory at speed when you’re under threat?

What should we worry about?

It’s a long list. As we consider opening for business again, the required expansion of remote working makes it more likely that people have:

• Been granted local admin privilege on their laptop
• Synced and stored corporate data to personal cloud storage accounts
• Synced corporate passwords to personal browsers or keychains
• Enabled printing from home devices
• Stored sensitive data into open team rooms
• Stored data on a USB memory stick or USB external hard drive
• Reconfigured/misconfigured local security settings (such as personal firewall, VPN, wireless, Bluetooth, anti-virus and software updates/automatic storage syncing)

And there are other potential areas, due to the disruptions in business as usual, that can make organizations vulnerable. They include:

• Supervisors/managers may have collected personally identifiable information on people to track their health and status.
• Employees’ endpoint devices could be infected with malware via successful phishing campaigns – and, as a result, malware may have found residency within your network, resident in data stores, collaboration sites, or other systems and servers.
• Patches and upgrades may have been deferred.
• Quality assurance processes associated with software development were abbreviated, resulting in statistically more defects per line of code that can be vulnerable to exploit.
• Access controls have been relaxed, additional remote login accounts or credentials have been granted to teleworkers, partners or outsourced staff.
• Privileged access has been granted to service providers and/or backup staff.

Where do we start?

Here are a few simple steps to take as we prepare for the new version of business as usual:

• Update security policies and educate employees on how to expunge information that has inadvertently been stored to personal accounts.
• Use configuration management tools to remove or reconfigure features or functions not ordinarily permitted by policy (compare configuration against the golden image, if possible).
• Review directories for grants of privileged access during the infections period, ensure that access is required or revoke excess privilege.
• Perform a “spring cleaning” of devices and networks – assess devices and networks for evidence of malware infection and command and control communication.
• Review logs created during the COVID-19 period for anomalies – such as unexpected behaviors, gaps in the record, and more.
• Assure endpoint protection packages are up-to-date and configured correctly.
• Run enhanced network vulnerability scans across.
• Review and reprioritize patches and upgrades.
• Make sure your incidence process can cover ransomware-related events.

What should we worry about?

If we look back at the experience of the last recession, one could argue that the security market should be immune to economic downfall:

• Hackers do not stop hacking – cyber-crime increases as those with IT skills join the criminal ranks for needed income
• End users don’t stop double clicking – the financially desperate become more vulnerable than ever to sophisticated financial scams
• Regulations do not simply disappear
• The number of vulnerabilities – our attack surface – increase as organizations defer or delay patching and upgrades,
• The specter of job loss, job dissatisfaction or feelings of economic inequity increases insider risk
• Demand for counterfeit products increases
• There is an increased dependence on third-party outsourcers or cloud service providers to deliver core business functions at a lower cost

That said, it is likely that even under the best-case circumstance, COVID-19-era CISOs will face a flat or nominally increasing budget as non-essential IT programs are reviewed, and upgrades deferred.

It is therefore important that forward-looking CISOs strategically reprioritize their strategy, road map and budget – heading off an inevitable stand-off when the business requests a pause in spending as business strategy is reviewed.

What should we worry about?

The near future will see shelter-in-place restrictions being lifted, people returning to work in various configurations, and normal operations resuming.

CISOs need to anticipate that:

• Some employees will be reluctant to return and continue to work remotely
• Shortages and supply chain risks will continue to disrupt normal business
• Insider threats remain high as staff members’ futures remain unclear
• Nation-states will continue to exploit the persistence obtained previously
• InfoSec will continue to uncover historical breaches while managing ongoing significant ransomware risks
• Companies will invest in infrastructure as emphasis on resiliency and contingency planning is renewed

In the longer term, certain macro trends may also be adding to the CISO’s agenda:

Surveillance

To address the crisis and protect their constituencies, governments and even some large companies are rolling out AI-driven applications which leverage cameras, drones, thermal imaging, location trackers, and facial tracking software. An IAPP report suggests that “civil society and private companies have advocated for a clear regulatory framework of facial recognition technology … Possible measures could include a binding requirement to involve data protection experts and human rights specialists in the teams working on the development of the technology, to ensure fundamental rights compliance by design.” CISOs should fully expect the emergence of new compliance requirements as regulatory agencies balance the need for surveillance powers with the democratic push for privacy rights.

Digital payments 

Physicality of cash use may make digital payment platforms a competitive differentiator. From a security perspective, this shift will require CISOs to rethink the role of technologies, such as identity and access management (IAM), morphing it from a tool of control to a tool which enables client interaction. For example, contactless IAM will see they deliver technologies into bricks-and-mortar facilities that allow for facial or voice authentication. CISOs need to be particularly wary of fraudulent exploitation of these platforms – compromised credentials represent 80% of breaches.

Omnichannel marketing 

The COVID-19 crisis has accelerated the trend toward ecommerce, with 44% of consumers expecting to do more grocery shopping online and 39% expecting to do more durables shopping online over the next one to two years, according to the EY Future Consumer Index. With this shift to online retail comes a push to increase omnichannel marketing capabilities. Collecting more information about consumers, as their activities are tracked, helps create new opportunities for marketers, and for CISOs to identify and prevent fraud. But this also introduces new privacy risks, and potential negative perception from customers. There is a growing “techlash” against technology companies motivated by privacy concerns and what companies do with their data. CISOs need to make sure that customer-data collection not only complies with the relevant laws, but is also justified and provides useful benefits in consumers’ eyes.

Where do we start?

However the near future unfolds, CISOs can be well placed as business advisors and transformation enablers with a focus on the following: 

• The cybersecurity strategy and road map, as well as security governance, management and operational structure, need to be realigned.
• Risk assessment methodologies should be revised to reflect revised operational requirements.
• New KPIs and KRIs for business stakeholders will be necessary to reflect cyber performance in this new world.