Got 5 minutes? Emerge Stronger: Executive Insights for Uncertain Times is a weekly video series where we share perspectives on what we’re hearing from clients and the market about what companies are doing to navigate these challenging times and plan ahead for success.
Watch here, or continue for the full transcript.
RODERICK CARMODY: I am Roderick Carmody, and in this episode we'll be discussing the impact of COVID-19 on the cybersecurity landscape. Joined today by Cameron Over, the leader of CrossCountry Cybersecurity and Privacy Practice.
Cameron, thank you for joining me.
CAMERON OVER: Thanks for having me.
RODERICK CARMODY: How are things over at the Over household and daycare center?
CAMERON OVER: We're taking it day by day - juggling our kids Zoom classes at school, work meetings as well as Zoom soccer practices so we're all hanging in there.
RODERICK CARMODY: Sounds good. I can only imagine how the rapid transition to a work from home environment has impacted organization's cyber privacy infrastructure. What do you see out in the landscape across your client base?
CAMERON OVER: You know, many of our clients shifted quite rapidly to re-prioritize their to do list to incorporate ensuring that the work from home strategy was as robust as possible for their entire workforce across all lines of business.
And the other piece I would say, is ensuring that they had a threat-focused defense to try to understand what attackers are trying to get to as they move to that work from home strategy.
RODERICK CARMODY: And as clients do move to that work from home environment, what tips would you have from a cybersecurity perspective?
CAMERON OVER: There's a few that I would mention that they may seem simple, but they're really fundamental because attackers do look for the highest yield with the lowest amount of work possible. And so some of these might seem simple but they really are critical to success for businesses to stay secure.
The first of which is patching systems, making sure that all of the latest updates have been applied to the machines and the software that are critical for business - one of which is actually Zoom, and a lot of organizations that are using that and other virtual teleconference systems, ensuring that those systems are up-to-date and patched.
Another is multifactor authentication and that's making sure that you have the mechanism to ensure that you're authenticating who people are within systems such as email, because phishing - which is the act of sending malicious emails to try to get people to click links and download malicious content - can be easily forwarded by multifactor authentication.
The third is protective DNS, and that's ensuring that your employees are safely browsing the Internet and not downloading or accessing websites that would otherwise cause harm to those systems.
The fourth is a Virtual Private Network or VPN for corporate use. And that's ensuring that from wherever your employees sit - whether at home or using a shared Internet in a public space - that that connection is secure to the Internet.
And the fifth, again, might seem simple, but ensuring that your employees understand the risks and are trained in order to not click on links and to ensure that they are using VPN and multifactor authentication, as well as raising a concern if they do see something suspicious and they understand how to report that in a timely fashion.
RODERICK CARMODY: That's great. And within the cyber world, I think the topic is called threat informed risk. Is it fair to call it know your weaknesses and why is that important?
CAMERON OVER: Absolutely, so you're completely right. It is understanding your weaknesses and that can mean things from what is your most critical data or your crown jewels and where does that live? And at a simple level, it may be things like your HR and financial data.
Additionally though, depending on the industry and the business, it's really important to understand where the most critical data lives. And so, if you're a software company, it could be your intellectual property. If you hold critical or sensitive data on clients and you're in wealth management, it could be the information on those clients.
And so it really varies depending upon the industry, but it's ensuring you understand where your weak points are within your infrastructure and your systems, and then where that most critical data is. And then going through the effort of understanding what threats might render your organization weak to those and then being able to shore up your defenses in order for that not to happen to your organization.
RODERICK CARMODY: Eventually and hopefully soon, things will return to normal. How do you see this crisis impacting the role of cyber and privacy within organizations going forward from here?
CAMERON OVER: Yes, so that's a really good question. So I think looking at the threat landscape, it's important for organizations to understand what threats face them. And so one thing that we're doing with a number of our clients is modeling those threats through an exercise called threat modeling. And that's understanding the various threat actors, the threat surfaces that are available within the organization, and then how those risks iterate through critical and key processes within information security, within privacy, as well as other lines of business.
Another is understanding that threat intelligence needs to be brought into the organization at key points to understand what risks do exist so that those can be mitigated in a timely fashion.
And a third is testing. So ensuring that your scenarios and your tabletops are tested and iterated to understand how likely and how resilient they are in order to test, fix and test again and work towards achieving optimal resilience to those things. And from a business resilience perspective, it's understanding, again, the critical business areas, the resilience to potential attacks or other interruptions, and how they can either maintain or fail fast and get back online with those critical processes.
RODERICK CARMODY: That's great. Thank you so much, Cameron, for your thoughts, perspectives. Good luck with online soccer practice and thanks to everybody for tuning in.