hey everyone welcome back to today in tech I'm Juliet Beauchamp and I'm here with
CSO senior writer JM Porup. You might be working from home but that
doesn't mean that security threats have stopped stick around alright Dan thank
you so much for joining us remotely I know it's a little bit different how
we're shooting this so I really appreciate your patience and that you're
calling in to discuss hackers hackers are not taking a break even though we're
all working from home right thank you for having me Juliet that's right very
much the case you know I'm hunkered down here in my basement with my Mad Max
clothes you know surrounded by piles of ammunition and twelve paper I feel like
I'm ready for the apocalypse now but your enterprise may not be well many of
us do work from home the huge numbers of employees whose roles were never
intended to be remote are now being sent home without any significant planning by
IT department and that's creating some serious security issues that need to be
addressed you know I've spoken with people who
tell me you know our office is hundreds of desktop computers and they said go
home and they didn't give us a laptop and they said just use your personal
computer don't use a VPN we don't have one set up yet and well under the
conditions of the pandemic these measures you know may well be the
correct ones they do have significant cybersecurity consequences so that
organizations need to be addressing sooner rather than later right I would
have to imagine that the sort of million-dollar question here is how do
you transition a usually completely in office workforce to a completely remote
workforce and how do you do that securely I would imagine it's really
difficult and that perhaps a lot of enterprises just may not have the tools
to do so because they didn't they weren't necessarily plenty late for this
I mean who plans for a pandemic right right hopefully the CDC but certainly
not a regular organization I one could argue that a business
continuity plan and disaster recovery plan should include some thought and
damages as they do for hurricane flood fire earthquake and so forth and so on
but the main thing here is that organizations of any significant size
it's 10 G is MDM mobile device management software on employee laptops
and phones to ensure that employees are following policies and procedures one
might imagine there is certain content employers don't want to see their
employers accessing at work I leave that to your imagination you know we don't
want to see you know if an employee leaves their laptop in a cafe or a
subway these things happen all the time the ability to remotely wipe that that
date that sensitive organizational data is also important as is ensuring that
there is appropriate hard disk encryption applied on those laptops for
just that circumstance but telling employees you know go home access the
sensitive corporate data using your teenage daughters laptop that's full of
everything under the Sun and probably full of malware which is then going to
be used to you know access your corporate network is may be sufficient
for one or two weeks in a you know the genuine emergency were in right now but
that needs to change as soon as is reasonably possible or there's going to
be a rash of ransomware attacks in about two or three months from now yeah I want
to know how this is going to become a potential hackers field day you now have
this just huge huge groups of people who like I said when maybe never supposed to
work from home have never worked from home before that are now meant I have a
mandated work from home policy so how our hackers going to use that to their
advantage well I mean I think what enterprises need to do is focus on
getting the basics right I see a lot of high-priced vendors saying just to use
our solution you're going to be fine but you know are our employees using
password managers with unique long strong passwords for every site is
two-factor authentication turned on for all of the organizational
authentication needs preferably you to have token like a given key you know it
is there a a mandatory VPN into the corporate network in order to access
corporate resources for instance I'm hearing a lot of anecdotal evidence and
data showing that the number of Remote Desktop Protocol RDP services now
available directly to the Internet has mushroomed in the last two three weeks
what is our DP why would you use it let's say you've got Joan in accounting
and sitting on her desk for the last 15 years is the dust covered Windows XP box
not patched no longer patrocle completely insecure running a desktop
accounting software they use for reconciliation every end of quarter this
is just an example but these kinds of scenarios exist across all the legacy
organizations but all the sudden send a quarter and joan needs to do
reconciliation so IT says we're going to punch a hole that the firewall let you
you know RDP directly into that ancient unpatched insecure box so you can do
your job and like in an ideal world that may be necessary but you want to go
through the VPN to the corporate network and then access RDP because if you let
Joan at home from her kids laptop access that RDP service so can anybody on the
entire planet thinking carefully about how you you know give employees access
to the resources they need to do their jobs becomes you know an important and
serious question and I would also imagine that a lot of organizations
perhaps don't have the budget to sort of come up with all of this cash to deploy
all of these solutions so what is the general advice that you can give for an
enterprise that perhaps just doesn't have the cash on hand to suddenly deploy
tons of different remote networking and remote work options well I'm not an
economist I'm a cyber security expert and and we're hearing people say we're
staring down the barrel of a depression worse than the Great Depression so in
terms of the macro economics of how do businesses not go bankrupt that is a
question well beyond the scope of our conversation or my
ability to have an informed opinion but you know like the general principle
folds and has always thought in cyber security security exists to support the
needs of the business not the other way around and if security of leadership
very carefully and emphatically explains to the decision-makers what the
situation is and what the risks they are running are then ultimately the buck
stops with the CEO on the board if the CEO and the board say you know if we
spend money on security we're going to go out of business then that does not
make sense because the first security threat is going out of business if you
have no business there is nothing left to secure there are no employees there
are no clients there is you know nothing so security is always a question of
trade-offs in terms of the needs of the organization whether that's a for-profit
business or the government or an NGO or what-have-you they all have their
missions and security exists to support that mission got it so I want to touch
briefly on something a piece that you've wrote perhaps - a few days ago maybe a
week ago now depending on when we get this particular actually up but I would
have talked a little bit about security teams in particular so you wrote this
really interesting piece about sort of building redundancy into your security
team and I feel like we hear it all the time that you want to build guns in the
sea into your security networks but I don't know if people often think about
it as the physical people members of the team and it's a really interesting point
I mean we have this first of all this mandated work from home policy and
second of all a serious public health threat that if someone on your team gets
sick and they can't work that could be a huge security concern yeah it's a bit
grim bit gruesome to think about but nevertheless a real thing you know there
is a massive cyber security skill shortage the you know employment rage
and the field is famously less than zero you know millions of jobs being
advertised going unfilled and what that means is that most organizations are
understaffed not all but but most are understand
and what that means is you have stressed-out overworked although highly
paid cybersecurity professionals who have to get the job done with a limited
amount of time and sometimes a limited amount of money and you know IT people I
work tonight II for a long time we are famously idiosyncratic in our solutions
and then we keep our own little solution in that text file on our desktop we
forget to put it in the binder where everybody else needs to see it and then
you know when I wind up on a ventilator nobody knows how to make the thing that
goes bingo Bing because that was not documented and especially with security
teams which can often be you know a smallish number of people ensuring that
everybody knows how things work and then there's a redundancy and authentication
yet only one person holds the keys to the kingdom and that person you know
gets hit by a car get sick what have you then that can cause you know a very
serious issue for an organization and this is good practice not just for
pandemics like you know in terms of fraud prevention it's a mandatory
holidays are very common you must take a week off and somebody else has been into
your job this is an excellent way to catch people doing things they shouldn't
be doing inside an organization so looking at job redundancy job rotation
job shadowing insecurity is always a great idea anyway because you know even
in the best of times job churn in this field is huge that amazing employee you
hire just bounced or a 50% pay rise 12 months later well what about their work
what are the processes what are the procedures where the passwords where the
hardware tokens you know ensuring that individuals do not commandeer job
descriptions is an important part of risk management that's a good point and
I would also imagine that if you don't have that sort of redundancy built into
your security team that it's sort of another example of how your organization
could be potentially very attractive to hackers yeah you know I mean you need to
have more than one guard at the door mmm-hmm - not a great metaphor but you
get what I make I understand what you're saying yeah exactly
so before I let you go JM I just want to touch on one more time just sort of a
roundup I wouldn't know the specific tools the
specific security tools that employers should make sure that their employees
have access to if possible to really protect their enterprise from a hacker
when everyone's working from home because I would also imagine that and
this is a conversation for another time but having secured home networks could
also be an issue but let's say let's leave that home Network conversation for
another time and what tools can employers deploy now if they have the
means so some of the most important thing to do if there are resources is to
ensure employees have work issued laptops with MDM ins installed properly
to enforce policies and procedures and to ensure that employees are accessing
the corporate network using a corporate provided VPN and not a private third
part of VPN an enterprise needs to own their VPN and they need to make sure
their employees working remotely have MDM on work issued laptops even the best
resources organizations right now can't make that claim and that is sort of the
the you know the holy grail that we're looking for you know people who travel
for work you know are supported by IT as ruined warriors they travelling
salespeople executives they've got the remote laptops with all the bells and
whistles because their job description requires if you're a travelling employee
then you have to have a traveling laptop this is you know QED and it may be that
you know going for enterprises need to think more and more about employees as
potentially dispersible and able to work from home then we didn't notice because
again I'm not Pepa demonologist but I'm hearing news this could be the first
wave of multiple waves of Kovac pandemic so we can be on and off this sort of you
know work cycle for the next multiple years now assuming you don't go to
business how do you how do you remain flexible enough to say on 48 hours
notice everyone works yeah bye you know Enterprises needs it
to not just think about today in next week
what about six months from now twelve months from now when there's another
pandemic alert and we have to do this all over again so so thinking about that
infrastructure and building flexibility and mobility into infrastructure I think
is going to be key moving forward right moving forward I feel like there could
be a lot of lessons to learn for just future any sort of disaster planning you
know I mean having a solid business continuity and disaster recovery plan
with regular tabletop exercises is something most security departments know
they have to do and do do I think most have been blindsided by the risk of a
pandemic because we haven't had one in basically anyone's lifetime whereas you
know hurricanes earthquakes fires floods they happen you know with the seems
increasingly regularity so you know we think we've gone a little bit you know
numb to the risk that we now face sure well thank you so much Jim this is
a really interesting insights and I really appreciate it thanks so much for
joining us it's always a pleasure Julia thank you for having me and thank you
all so much for watching this episode of today in tech if you liked this video be
sure to give it a thumbs up and subscribe to our Channel if you have any
questions about best security practices for your employees be sure to leave a
comment below I'll get back to you or I'll get back to you on James behalf
with those answers thanks again for watching and see you next time