In the current context of the COVID-19 pandemic, teleworking exposes companies and organisations to cyber attacks. These are major issues and challenges for CIOs and CISOs!
Almost one third of the world's population is now locked down and soon almost one billion people will be teleworking[1]. This situation is unique in human history. Technology is enabling business continuity for many companies and organisations in many economic sectors. Large companies and SMEs are often well prepared and have already been practising telework for many years on a daily basis for targeted categories of employees: managers, consultants, engineers, etc. Under the governance of the CIO and CISO, they have been able to adapt quickly and massively to move into telework mode. Other companies, organisations or administrations which are less mature in this way of working have had to manage the global health crisis by deploying unsecured and untested infrastructures, workstations and network links in an emergency, with access to critical applications or resources. In addition, CIOs are faced with a decline in staffing levels which leads to difficulties in managing and strengthening security for implementing telework.
Cyber attacks, cyber fraud, data theft, phishing operations ... are exploding worldwide.
However, cyber-malware is unethical and exploits all the vulnerabilities arising from this global crisis. Cybercriminals are infiltrating the computer networks of companies, administrations and individuals. In France, on Saturday March 14th 2021, on the eve of the first round of municipal elections, the metropolis of Aix-Marseille-Provence declared a massive and widespread cyber attack, paralysing a large part of its equipment, including in the territories. On the same day, in the UK, the Hammersmith Medicines Research Centre, which works on COVID-19, suffered a ransomware attack. On Sunday March 22nd, the AP-HP was the target of a computer attack requiring the temporary shutdown of external access to emails and teleworking tools. Companies such as Omnia Holdings, Tesla, Space X and Lockheed Martin also faced major cyber attacks in March. Cyber attacks, cyber fraud, data theft, phishing and other sophisticated scams are exploding all over the world.
Technological and innovative security tools
The level of risk clearly increases when implementing emergency teleworking, with workstations that have not been previously approved, updated and secured (antivirus/malware, VPN link or secure cloud), or when employees use their personal digital equipment. In the current context, there will be a significant risk exposure divide between organisations that have defined, prepared and regularly approved a true Pandemic Business Continuity Plan (BCP) and those that have not.
There is a very wide range of technological and innovative tools for securing telework environments: IAM (Identity Access Management), MFA (Multi-Factor Authentication), VPN (Virtual Private Network), anti-virus/malware, network segmentation, Endpoint Detection and Response, Artificial Intelligence based solutions, etc.
[1 ] Estimates by Owl Labs
Some advice
- Implement a secure connection tool such as a VPN to encrypt and isolate traffic between the workstation and the corporate network, or a secure cloud access solution.
- Systematically update the OS and all software associated with the workstation and identify potential vulnerabilities (CVE).
- Install anti-virus, anti-malware and firewall software.
- Implement a reliable and efficient access and identity management solution (IAM, MFA, SSO).
- Change passwords very regularly.
- Do not connect to a public WiFi.
- Implement desktop encryption tools.
- Raise awareness and train employees on the proper use of their tools in this mode of work and on cyber risks.
The adoption of the cloud is enabling native IT agility and rapid failover processes to a Business Continuity Plan. Many organisations around the world have recently adopted a "Zero Trust Security" policy: no device, user, workload or system should be trusted by default, either inside or outside the company. This seems to be the best strategy for deploying secure telework tools and services.
We can be sure that the current period we are going through will undoubtedly challenge the governance, strategy, security solutions deployed, training of our people to make our organisations and companies more resilient and agile in the future. The context will accelerate all the processes of migration to the Cloud and the adoption of collaborative platforms, video conferencing, data sharing... Will Cloud providers, operators and SaaS editors have sufficient capacity to face this tidal wave?
