Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

6/9/2020
10:00 AM
George Gerchow
George Gerchow
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

CSO's Guide to 'Employee-First' Security Operations During COVID-19 & Beyond

As the work-at-home environment continues to inform new ways of doing business, it's important that security teams remain flexible and ready for change.

The speed in which COVID-19 has evolved has prompted new ways of doing business and added responsibility to the everyday role of cybersecurity professionals and C-level leadership. Recent research from (ISC)² shows that 81% of security professionals have seen their roles evolve in response to the ongoing pandemic, and 23% have seen an acceleration in cybersecurity incidents.

For a chief security officer, traditional priorities include data governance and strategic security policies. However, due to the shift to remote work and increasing business pressures during the ongoing pandemic, that role has evolved to also encompass employee safety and productivity so the company can continue to deliver products and support its customers and partners. As the work-at-home environment continues to inform new ways of doing business, it's important that security teams remain flexible by adopting an employee-first mindset, to keep the entire organization aligned. Here's how:

Step 1: Establish an emergency management team with key stakeholders. Schedule regular (if not daily) meetings to ensure issues are being addressed and strategies are being changing as needed in real-time. This team should have full business representation, including executive staff, regional leaders, and security operations representatives. Although many businesses may currently have these teams in place, it's important that proactive planning remains a top priority even as offices begin to reopen. This team, and the lessons they provide, will be crucial for any future pandemics or crises that pose a threat to business continuity, allowing employees to act faster and make informed decisions.

Step 2: Monitor expanded attack services including insecure home VPN systems and data. Due to the rise of remote work and expanded attack services, phishing attacks have also seen a significant acceleration with employees being enticed by fake password management, executive updates, and GoFundMe messages. To decrease the impact of these attacks, it's important to keep employees informed of the latest threats and how they can protect themselves or seek support if they have become a victim. Employee education is essential, including training on how to lock down home routers with complex passwords and leverage data loss prevention (DLP) technologies.

Step 3: Empower leadership teams with prescriptive information to help inform business decisions that empower secure, reliable operations. As the impact of the pandemic continues to evolve and regional areas are affected differently, CSOs and CISOs must stay informed of all security and operations across all business units in order to regularly update leaders with the most relevant and up-to-date information. For example, if leaders are making decisions on extended work-from-home policies or strategies for reopening offices, they will need to know if the resources are there to support a decision from the standpoints of both business operations and employee security with best-practices documents or contingency plans if new cybersecurity threats arise.

Step 4: Maintain a "pulse" on your employees through real-time chat and collaboration technologies. Regularly monitoring these channels is a good way to stay on top of questions and concerns in order to make the necessary strategy adjustments. In these types of situations, overcommunication is key. Employees, customers, and partners are all eager to hear from organizational leaders during this time. However, content must be relevant and strategic. It's important that the dialogue is led with an understanding tone that takes into account the current situation as it relates to relevant stakeholders and the challenges they face.

Step 5: Sustain a mindset that goes beyond your CSO title. Instead of just looking at things from a technology perspective, it's critically important to assess the human impact as well. This means being empathetic to people's needs and work styles. While a CSO's job is to maintain secure business operations, during these challenging times, it's crucial to ensure that employees are staying engaged and aren't overworked, and that customers and partners feel supported. A human-first approach to security leadership will have long-term benefits to employee and customer collaboration and retention.

Related Content:

 

 
 
 
 
Learn from industry experts in a setting that is conducive to interaction and conversation about how to prepare for that "really  bad day" in cybersecurity. Click for more information and to register

George Gerchow brings over 20 years of information technology and systems management expertise to the application of IT processes and disciplines. His background includes the security, compliance, and cloud computing disciplines. Gerchow has years of practical experience in ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/3/2020
'BootHole' Vulnerability Exposes Secure Boot Devices to Attack
Kelly Sheridan, Staff Editor, Dark Reading,  7/29/2020
Average Cost of a Data Breach: $3.86 Million
Jai Vijayan, Contributing Writer,  7/29/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-18112
PUBLISHED: 2020-08-05
Affected versions of Atlassian Fisheye allow remote attackers to view the HTTP password of a repository via an Information Disclosure vulnerability in the logging feature. The affected versions are before version 4.8.3.
CVE-2020-15109
PUBLISHED: 2020-08-04
In solidus before versions 2.8.6, 2.9.6, and 2.10.2, there is an bility to change order address without triggering address validations. This vulnerability allows a malicious customer to craft request data with parameters that allow changing the address of the current order without changing the shipm...
CVE-2020-16847
PUBLISHED: 2020-08-04
Extreme Analytics in Extreme Management Center before 8.5.0.169 allows unauthenticated reflected XSS via a parameter in a GET request, aka CFD-4887.
CVE-2020-15135
PUBLISHED: 2020-08-04
save-server (npm package) before version 1.05 is affected by a CSRF vulnerability, as there is no CSRF mitigation (Tokens etc.). The fix introduced in version version 1.05 unintentionally breaks uploading so version v1.0.7 is the fixed version. This is patched by implementing Double submit. The CSRF...
CVE-2020-13522
PUBLISHED: 2020-08-04
An exploitable arbitrary file delete vulnerability exists in SoftPerfect RAM Disk 4.1 spvve.sys driver. A specially crafted I/O request packet (IRP) can allow an unprivileged user to delete any file on the filesystem. An attacker can send a malicious IRP to trigger this vulnerability.