Our work environment became more digitally connected than any point in the information technology age. With those drastic changes in mind, it is also important to remind ourselves that we are more vulnerable to threat actors and new schemes that interrupt our digital economies and personal lives. Information security, which was the sleeping giant, woke up with a vengeance to become not just a side topic but a critical part of the conversation as almost 90% of workers transitioned to remote work.
Remote work is not fundamentally secure but has provided new challenges for protecting digital assets and information privacy. Perimeter processes provide strenuous security measures and policies that are lacking for remote workers. Since remote work environments are not as secure as enterprise infrastructures. There are numerous tiers of monitoring and active systems protect enterprise environments. Many organizations have moved to VPN solutions for numerous remote workers; however, this is a short-term solution to a much larger issue. New solutions are needed to provide the same measure of protection as internal networks and systems.
In most of my articles, I look at the holistic view of information security. We always need to look at the past but at the same time not let it cloud future decisions. The past is a good teacher to guide us to make sure we prevent a future event…but there are no guarantees in an everchanging environment.
What are some of those events we can learn from to shape our strategy for the future?
If you are interested the link below contains the major global cybersecurity events that took place in 2020
https://www.csis.org/programs/strategic-technologies-program/significant-cyber-incidents
Zoom was the tool that “ran the world’ in 2020… It was not without fault!
I will leave the details to you, if interested, but in April of 2020, the public was informed that Zoom had 500,000 accounts taken using a series of sophisticated set of tools to capture data base records. This was one of many security breaches with Zoom who was always chasing the next security issue.
Twitter had one of the most highly publicized events with several high-profile accounts hacked and pictures and information stolen. This was a “simple” social engineering effort that yielded embarrassing results from an internal breach and caused many problems for Twitter, including a substantial stock price drop.
On March 31, 2020, Marriott International notified some of its guests of “an incident involving a property system.” The notice explained “what occurred, the information involved, the measures taken by Marriott to investigate and address the issue, how Marriott is assisting guests, and steps guests can consider taking.”
Marriott further explained that “hotels operated and franchised under Marriott’s brands use an application to help provide services to guests at hotels. At the end of February 2020, the company identified that an unexpected amount of guest information may have been accessed using the login credentials of two employees at a franchise property. The company believes that this activity started in mid-January 2020. Upon discovery, the company confirmed that the login credentials were disabled, immediately began an investigation, implemented heightened monitoring, and arranged resources to inform and assist guests. Marriott also notified relevant authorities and is supporting their investigations.” This is another incident where the goodwill of an international hospitality provided was severely tarnished through the mistakes of a few people.
What can we learn from this?
Awareness and action need to be the key words in planning your information security future. The above incidents were breached large corporations but cyberattacks have no gauge of big or small! SMBs would not only lose their good will but will also loose their intellectual property and potentially their livelihood.
Most companies concentrate on personally identifiable information (PII). Companies need to focus more on the business intelligence, proprietary processes, and methods. Cybersecurity is a business process just like finance and human resources. All employees should know the ramifications of and the resulting business costs. It is not just an IT problem but should be integrated into the business portfolio of processes and practices.
The common factor in the cyberattacks human error. A cyberattack is often triggered when an individual casually clicks on a malicious link.
Training needs to move to the next level of ACTION. Employees need to be aware but more importantly they need to know what appropriate ACTIONS to take if presented with a potential cyberattack event.
Three important factors for the future:
1. Companies need to be more aware of cloud solutions. Just because you are in the cloud, it does not mean you abdicate your information security responsibilities.
2. Revaluate your IT infrastructure regularly. This is important as technology constantly changes and may not be supported or updated with security fixes.
3. Staying informed on the latest security threats will help in implementing effective defense strategies. Most importantly, company users can be educated on current threats and what to do as a member of the company.
The global pandemic in 2020 was a challenging year for us personally and professionally has forced organizations to pause and evaluate their critical processes. Cybercrime is fast-growing and is not expected to decelerate any time in the near future. The “new” work environment may have a significant segment of the labor force continuing to work from home. Threat actors will continue to exploit employees that are new to working remotely. Businesses should develop solutions and improve their processes as they address new cybersecurity challenges.
Business will still be in the crosshairs of the cybersecurity attacks who will attempt to disrupt business. Don’t be a victim, take action and protect your company goodwill and financial assets.
Let Global Cybersecurity Solutions help you “Keep an Eye on Security.”
www.globalcybersecuritysolutionsllc.com
By: Rick Cobello, President of Global Cybersecurity Solutions, LLC