Kevin Beaver: Hello, my name is Kevin Beaver. I'm
an independent information security consultant,
writer and speaker with Atlanta, Georgia-based
principle logic. I often describe myself as a
technical guy at heart who also sees the big
picture of IT and security. I take this balance of
experience and share it with my clients, so they
can adjust their habits and get better -- to
uncheck those boxes that have been creating a
false sense of security and unnecessary risks for
some time. What you see here is one that I share
in many of my presentations. I think it's quite
fitting given what's going on with the SARS, cov2
virus and COVID-19 right now. If you look back
just a few weeks things were chugging right along.
You had your security responsibilities that likely
included a remote workforce, but nothing on the
scale of what we're seeing today. The thing is,
this is your testing time. Well, really the past
few weeks have been your testing time, but you're
still on display. People are watching you to see
how you handle this situation. Many people would
crumble under situations like this, especially
given how complex things can get with IT and
security. But that's not you. That's why you're
joining us on this webcast. You're probably a lot
like me, and you're trying to take in all of this
information and all these ideas that are being
shared. There's always a unique nugget or two that
can truly help you in your situation. And that's
my goal for today: to give you some immediate
things that you can run with to minimize the risks
associated with your new security reality, along
with minimizing the impact when bad things do
occur. Does that sound like a good goal? Okay,
let's keep moving along.
I was just looking at the Wall Street Journal and
saw these headlines related to this Coronavirus
situation. Things impacting WhatsApp, Instagram,
even CIOs who are facing shortages of things like
laptops and other hardware to, you know, to help
deal with all this the sudden remote workforce.
And all of these represent security risks to your
organization in some form or another. And this is
just a small piece of your overall attack surface
and risk posture. So, what can you do? Well, I
have a few slides that I'm going to run through
pretty quickly. So let's jump right in. And I'm
going to share with you what I believe to be the
most important security to-do items for your
remote workforce right now.
Number one, you have to acknowledge the threats
that your users and your business are facing.
There's phishing -- not just traditional phishing
that tries to lure people in, you know to click a
link, open an attachment or provide sensitive
information -- but some more modern attacks that
involve things like conversation hijacking, where
an attacker takes over someone's email account and
is able to mimic the victim's conversation style.
There's also phishing that takes place via SMS
text, which is called smishing. And as well as
phishing that takes place via voice, which is
called vishing. There's also deep fake audio where
criminals could capture someone's voice and then
turn around and use it to mimic that person. This
can lead to your users getting requests from what
appears to be someone in senior management, or
maybe even customers or business partners. And you
have to ask yourself, How are your users going to
respond when they're asked to do something
involving confidential information or money or
some other sensitive area of the business? That
could get ugly in a hurry. If you want to see how
this technology could work, and also read an
interesting story about a popular journalist who's
on the radio here in Atlanta, just google Jamie
Dupree 2.0. It's an interesting technology. And
it's also a pretty sizable threat. So check that
out. There's also identity related fraudulent
requests for things like RFPs, invoices and other
business documents, typically coming in through
unprotected or unsecure email configurations. And
they're basically being sent on behalf of your
business. And this can happen through SPF records
and demark configurations that are either
misconfigured or they're really not configured at
all.
There's ransomware and distributed denial of
service attacks against organizations that are at
the heart of this virus situation including
healthcare clinics and hospitals as well as
government agencies. A lot going on in that space,
and of course there is Zoom. You may have heard
the term Zoom-bombing where uninvited guests are
showing up on Zoom meetings and basically crashing
the party. So to Zoom or not to Zoom, is that the
question? Well, Zoom is in the spotlight right now
because it's a super popular tool, at the moment.
I do think that the company is doing its best to
address the security and privacy issues that
they've been called out on. The reality is online
meetings, through their platform can be secured
through various configurations. And real quick, if
you're looking to lock down Zoom meetings, you can
do things like generate random meeting IDs, you
can avoid using personal meeting IDs for public
events. You can require authentication for users
to join your meetings. You can even require
multi-factor authentication. You can enable
encrypted chat, you can prevent users from sharing
their screens. You could disable video annotation
and so on, there are literally tons of things that
you can do to lock it down and have reasonable
security. So I say figure out what it is that you
need to do, that, you know works well, based on
your specific security and privacy needs, make
those changes and be done with it. Otherwise,
there's a dozen other online meeting platforms
that you quite likely have at your disposal that
you could use instead.
Okay, moving on to number two.
Setting security standards. You no doubt already
have some more generic security standards. You
know, these are the things that make up the
fundamental elements of your security program. But
in the context of remote working, you need to be
very precise on what it is that you want and need
in your environment. This should involve things
like user authentication and passwords, software
updates for workstations, and even tablets and
phones, data backups, email, especially as it
relates to using and commingling personal and
corporate accounts, file sharing and other cloud
applications, VPN and you know, whatever type of
remote access connectivity you might have.
And this is a big one, computer acquisition and
disposal, and really configuration, of the new
computers that people may be getting on their own
and, and securely wiping of those systems if they
decide to sell their old systems. There's also
security monitoring, logging and alerting. How is
this going to play out on your remote systems, you
may not have any information at all or it may
require technologies like DLP and Caspi, maybe
even some type of managed service that you can
roll out quickly. Now, all of these things sound
like policies right? They can be made into actual
policy documents which are then enforced across
your environment. But first, you must Have the
actual standards in place to build your policies
on. So don't take this step lightly. I know you're
probably putting out a lot of fires at the moment.
Just try to get people on board and you know,
online. That's your, that's your your number one
goal. But in the short term, you really need to
think about what your new standards are, because
we don't know how long this virus situation is
going to drag on. So you need to get with your
colleagues and really your Security Committee and
figure out exactly what it is that you're trying
to achieve so that everyone is on the same page
and some semblance of mobile computing, security,
cannot only be agreed upon, but also reached.
Number three, there's an infinite number of things
that could happen in your security program right
now. What you have to focus on are the things that
need your immediate attention. So what are your
known vulnerabilities? What are the
vulnerabilities that you suspect but you haven't
yet confirmed? Where are your valuable business
assets being stored and how are they being
handled? Are your security controls actually
working? And how do you know? What can be
automated or outsourced to further reduce your
risks, maybe even your overall attack surface and
improve overall compliance and security? Ask
yourself, what are we doing right? What should we
be doing differently? And is what we're doing
actually defensible? If an incident or breach
occurs -- and do all this again in the context of
teleworking, remote access, this new reality that
you are living and working in, And another
important thing, continue your security testing.
Your vulnerability and penetration testing, your
basic vulnerability scans, your IT controls
audits, whatever it is that you've been doing. You
need to continue doing it and quite likely do more
of it. You have to be able to, you know, find not
only your existing vulnerabilities, but also the
new stuff that has cropped up as of late that will
crop up, just given the new configuration. The
last thing you need right now is some low hanging
security fruit to lead to incident or breach in
the middle of all this. Okay, number four, based
on what you're seeing in terms of threats, both
existing and emerging, even security standards
that you might need for this new work environment.
And then the new risks that you have been able to
quantify. You need to update your documentation.
And I'm mostly referring to your security policies
and procedures here. Your acceptable usage policy
is probably going to be one such document and then
of course any policies related to the standards
that I brought up, such as passwords, backup,
software, patching and all that. You may or may
not have actual security standards documented. And
if you do, you can update those documents. Perhaps
most importantly, you need to be thinking about
your Incident Response Plan and your business
continuity plan. These two documents can provide
guidance on how to handle security events, but
both at your level working in IT and security and
of course, at the level of your users, and they're
going to help you make sure that you can keep the
business running.
The reason I'm recommending you update your
documentation is because many security events that
end up being the incidents and breaches that
create so much headache are a result of mismatched
expectations. Users don't know what's expected of
them. They don't know what to do and what not to
do. They're out on their own making security
decisions on your behalf. Oftentimes having never
even seen any sort of security documentation or
rules that they must work by. And that is not a
good place to be, but it's easy to get there.
Especially with the new realities of teleworking.
So if you thought you didn't have control of your
users before, this virus situation is taking
things to an entirely new level. By the way, if
you don't currently have any security policies
documented, a lot of people don't, or they have
something basic, maybe acceptable usage and the
employee handbook. But there are a lot of great
resources online where you can go buy or otherwise
download security policy templates. You just need
to make sure that you're not doing it for the sake
of checking a box, but instead, basing your
policies and procedures on things that your
business actually needs, doing it for the greater
good of the business. So in order to do that, you
need to fully understand where your gaps and
security opportunities are. That typically comes
in the form of a formal information risk
assessment. Really, then and only then what you
want to create the security documentation once you
understand where things stand. And of course, you
need to do whatever you can to put controls in
place to actually enforce your rules. Otherwise,
your policies or all this documentation will
create nothing more than a false sense of
security. And this documentation is not going to
be worth the paper that it's printed on. So you
got to be real careful in your approach to this.
Okay, number five, my last recommendation, and
it's all about communication. There are lots of
ways to manage your messaging with your employees.
But this is largely going to come in the form of
online sessions, reminder emails, and maybe videos
and some other form however you're communicating
with your employees. Just make sure that you're
communicating with them, and they're not in the
dark. Your messaging focus needs to be on their
terms, not yours. And what I mean by that is,
you've got to put yourself in the shoes of your
users and the current situation that they're in.
And rather than simply shoving technical jargon in
front of them and telling them what they can't do,
think of creative ways to share how they can work
remotely in a secure fashion that not only
benefits the business, but also them as employees.
And part of this is, you need to stress that they
are the security team, they are a member. Each and
every user. Each and every employee is a member of
your security team. You're all in this together
and without them doing what's right by thinking
before they act, there's no reasonable way to
ensure security of your business information
systems, at this point in time, especially how
complicated things are. Be sure to get HR or
executive management, maybe even both involved to
not only flesh out your policies and security
documentation, but also for socialization of your
messages and ideas. And I think this is going to
help increase the likelihood of buy-in and making
sure that these things stick long term.
Odds are that you already have a security
awareness and training platform. And if so, that's
great. keep using it. If anything, you might want
to lighten up on the traditional phishing testing
that you're that you've been doing. And instead,
just use the platform to get information out to
your users in a timely and measurable fashion over
the coming weeks. And be sure to check out the
free resources that I've come across recently
online. Lucy security has an entire website
dedicated to user education and getting messages
out in this time. It's called
workfromhome.education.
And sans has their work from home deployment kits,
so be sure to check those out. And as you're going
through all this thinking about specific ideas, to
share with your users, you could talk to them
about 1000 things but some stuff that came to my
mind is, you know, not using business related
login credentials on personal websites, thinking
about the consequences of clicking "no" or "later"
when prompted to install software updates. How
they're handling data backups and file storage,
what to do and not do, thinking before installing
new software. And of course, you know, updating
their systems when their software does prompt them
to do so, encrypting their laptops and mobile
devices if they're not already. And you could even
create a short video or webinar and write an
article showing your users what exploits actually
look like. Show them the screenshots from
Metasploit or similar tools from your most recent
vulnerability and penetration testing. Explain to
them what can happen when software updates don't
get applied or when they choose to use weak
passwords, things like that. Most importantly,
focus on the security basics, all this common
sense stuff that I've been talking about, and the
reason being, that's where you're going to get the
return because those are the items that are
overlooked the most often and are therefore
exploited the most often.
The goal should be to set expectations, enforce
your rules, and then test and refine over time,
And you make your decisions around the concept of
"we enable work." You, whether you're an IT or
security or some other function within the
organization. Think about all this in the context
of we enable work. And I think that's really going
to help. And this is how you're going to get your
payoff. So time is of the essence right now. Your
heads down, and you're going to be for the
foreseeable future. Just don't forget to take in
the lessons that you're being taught along the
way.
John Maxwell said, "experience gives the test
first and then lessons afterwards." And I've also
heard it said that experience is something you
don't get until just after you need it. So look
for the lessons so you can get better. Folks,
these are challenging times in IT and security,
and I certainly don't envy you just now. That if
you do all the right things, there will be
positive outcomes. There is light at the end of
this tunnel. We're going to get through this
together and you're going to be much wiser and
much stronger on the other side. And if everything
falls into place, due to good decision making and
focused efforts, you're going to have a much more
resilient network environment as well. And that's
pretty cool. Thanks for joining me and I wish you
the best of luck with everything.