Covid-19 Does Not Exempt Compliance nor Security Obligations

While companies are consumed with the task of implementing remote work strategies in response to the COVID-19 crisis, it is critical to remember one thing: No matter how chaotic things get, Coronavirus does not exempt you from your industry or government compliancy obligations such as HIPAA, CCPA and PCI DSS. It also does not release you from your responsibility of employing Duty of Care when it comes to protecting third party personal data. For those companies that have already incorporated well-conceived cybersecurity strategies however, those don’t have to be concerns. The COVID-19 threat demonstrates the value of a trusted cybersecurity partner can bring. Feeling secure in uncertain times can be the greatest ROI during turbulent times. With the proper strategy in place, you can focus on your business at hand, rather than the “what ifs” of cybersecurity that add additional disruption to a situation that is already challenging.

Working Remotely Increases Vulnerability

According to a recent flash survey conducted by CNBC, 85 percent of companies surveyed say at least 50 percent of their employees are now remote. More than a third of senior executives report that cybersecurity risks have increased as a result. The fact is that every user account that is allotted remote access opens up one more point of vulnerability, increasing the risk exposure to your company. Compounding this is the fact that working from their comfortable home environment may make employees less vigilant when it comes to cyber hygiene. Also, domain-joined machines that depend on regular policy updates to secure them will be off the ranch for an elongated period of time.

The Storm is only Temporary

Some cybersecurity experts are referring to the COVID-19 situation as a “perfect storm” and that may be so. Users are running with a heighten state of fear and anxiety while working from possible insecure environments as corporate centers run with skeleton crews. It is an environment that hackers dream about.

But the bad news is only temporary!  How your company prepares itself for the present challenge will greatly impact its success down the road. For instance, studies have shown for decades that those companies that continue to advertise during a recession come out of the downturn stronger than their competitors who pull back marketing efforts. With a reduced noise level to compete with, companies that advertise can better position themselves while conveying an image of stability during challenging times.

One thing that COVID-19 has taught us is that risk mitigation is imperative. It is far less disruptive to prevent a threat then it is to deal with its aftermath. There will undoubtedly be a paradigm shift towards remote work after the dust settles. Those companies that learn how to best secure the expanded attack surfaces of their enterprises will have a competitive advantage of their competitors. Those that make it through this transition period without a cybersecurity incident will generate greater trust from customers and the markets that can be leveraged when the everything returns to normal.

Recent Cybersecurity Incidents

Although the turbulent challenges are temporary, we would like to point out some of incidents related to Coronavirus that have recently been reported.

• According to Check Point Software, Coronavirus-themed domain registrations are 50 percent more likely to be from malicious actors than other domains. According to ZDNet, thousands of Covid-19 scam and malware sites are being created on a daily basis.

• The U.S. Health and Human Services Department suffered a cyber-attack on its computer systems last week as part of a nation state attack to disrupt response to the coronavirus pandemic.

• The highly popular John Hopkins University COVID-19 interactive map is being manipulated. According to Brian Krebs, hackers are selling a digital coronavirus infection kit online that can be used to steel passwords, credit card numbers, etc.

• Of course, countless phishing attacks are being implemented every day, coaxing users with Coronavirus Health Alerts or information on Coronavirus Tax Refunds made available. Many of these emails contain malware infected attachments. One such example was identified by Researchers by Sophos Researchers at Sophos have one such attack that installs a Trickbot banking trojan.

Companies must obviously focus on the usual practices such as patching and monitoring more than ever. Some added suggestions directly pertaining to remote work include the following.

• It is important to restrict the number of people authorized to conduct new overseas wire transfers and new payment requests now more than ever. Create a policy that requires employees confirm these types of requests to verify their authenticity as face-to-face interaction is not available.

• Because users are alone out there, they need a way to easily reach out for security concerns and questions. Consider creating an easy to remember email such as security@companyname.com or cybersecurity@companyname.com that users can easily contact internal IT at all times. Be sure that IT personnel monitors this email during regular hours.

• If you have been postponing a cybersecurity training program for “Someday,” well that “Someday” is now. Consider sending out daily emails and video snippets to educate users how to identify phishing campaigns and reinforcing the importance of safeguarding certain types of company information such as customer and employee information, trade secrets, protected intellectual property, etc.

HALOCK Security Labs

Everything is happening at breakneck speeds. It is as if the world is playing with the fast-forward button held down. Even though it is the highest of priorities, you may not have the time to properly strategize and effectively modify your cybersecurity policies to accommodate your rapidly changing environment. That is why it is more important than ever to have a trusted partner that has the proven knowledge base and experience to navigate your cybersecurity strategies through turbulent waters. At HALOCK Security Labs, we are accustomed to dealing with disruption. We have been helping companies feel secure through uncertain times since our beginning. You know your business. We know how to secure and address your current environment. Scope your security needs quickly with:

• Securing Your Remote Footprint Complimentary 60-minute advisory session to review your network security, access, and setup.    
• Security Optimized Spending (SOS)  As organizations refine their output and spending during the pandemic, prepare to justify your budget needs and resource spend to stay secure. Schedule a complimentary 60-minute advisory session.
• Fractional Security Expert  With less staff or a skeleton crew to support a newly remote working company, augment your security needs with a Fractional Expert to address your immediate needs.
• Third Party Vendor Management These changing times may have altered your and your vendors’ risk profile. With our increased reliance on our partners to continue our business operations, it is a best practice to review your third-party risk management (TPRM) program

We are here to help support your risk mitigation. Learn more about our comprehensive Risk Management Program to help prioritize your investments while balancing your security, compliance, and business obligations.