As lockdown gradually eases across the UK, many organisations are looking to extend remote work policies. While greater flexibility in work culture has its benefits, those working in organisations’ security operations are well-aware of the risks posed by extended periods of time away from the office.
In preparation for the UKsec Virtual Security Summit on 10th-11th September, we look at how companies can maintain operational resilience amid a work culture marked by the pandemic.
The Challenge?
In times of crises, criminals have shown themselves to be more than adept at taking advantage of the confusion. Cybercriminals are no different, with KPMG reporting that there has been an increase in criminal activity using COVID-19 related vulnerabilities as part of ‘espionage, information operations, and commercial gain campaigns.’
Earlier this year the UK National Cyber Security Centre identified a steady rise in cyber-attacks against remote-working infrastructures showing how APTs and the Human Factor remain key vectors for attack. Targeted attacks from the curiosity and fear caused by the pandemic have meant that malware and phishing attacks have become the go-to method for infection.
To make matters worse, an economic climate in which even the strongest organisations are having their budgets cut, security operations teams are dealing with an increase in threats on a reduced budget.
Substantial reductions in the freedom of movement for employees within lockdown has also meant that an organisation’s ability to physically inspect third and fourth-party security, leaving security perimeters unchecked and insecure.
The Remedy?
As the human element is core for operational resilience in a remote work environment, human solutions are key to remediating weaknesses. Simple steps such as regular reminders to staff about company fraud policies, including phishing emails and whistleblowing procedures are a great way to start.
Expanding these reminders to a more holistic user awareness campaign to provide guidance on how to work securely at home can work hand-in-hand with Incident Response plans that account for the increased volume of phishing and ransomware attacks.
Though inconvenient, enforcing two-factor or even multi-factor authentication to secure cloud and ad-hoc collaborations environments reduces the risk of unwanted actors in your network. As part of an all-encompassing approach to security training, members of your organisation will slowly, but surely, start to make best security practice their only practice.
Lastly, you should consider your dependency on managed service providers, re-evaluating whether they offer the appropriate coverage for your use case. By seeking assurances on security controls and ensuring your security operations team undertake due diligence on new suppliers, you keep both your assets and security perimeter safe.
Learn more about maintaining operational resilience in the face of COVID-19, tackling hybrid-cloud environments, and how best to approach cyber security training and awareness at UKsec 2020!
Join 100s of senior UK cyber security experts on 10-11 September for an interactive agenda built to explore, inform, and address the key challenges facing the UK’s core industries. Learn more about our Speakers and view the detailed agenda online here.
Secure your complimentary place at the event when using code: UKVIP at uk.cyberseries.io
