This post has been republished via RSS; it originally appeared at: Healthcare and Life Sciences Blog articles.
This article was originally published on my LinkedIn page on 16 March 2020.
(FYI: As I was writing this post, the news reported that HHS had been hit with what appears to be a denial of service attack.)
In the cybersecurity community there is a saying “Cyber can impact physical and physical can impact Cyber”. We normally think of this in terms of warfare, such as what happened with the Ukrainian power grid a few years back. But as the COVID-19 crisis continues and drives more organizations to enable remote work scenarios, cybersecurity professionals need to be tightly integrated into our organization’s contingency planning to ensure we continue to protect the business. What we don’t want to have happen is a data breach or other security incident to occur during or immediately following the crisis. Having helped with contingency planning in the military for many years and from my experience helping customers with cloud security, here are a few tips:
- Document, Document, Document!!! – During situations like this it is normal to want to execute quickly to meet mission requirements and while doing so not documenting the changes you are making. I know, “say it isn’t so”. When this is over that documentation will be critical for understanding what was done and more importantly backing out any changes that you no longer need.
- Implement a running risk assessment- In the military we did a risk assessment for every event and updated it based on changing conditions. I recommend that you get with the business, determine their mission requirements and start a continuous risk assessment process. One key outcome of this process will be to identify where your data is vulnerable and then help you implement compensating controls. (Example Risk Assessment from Army)
- MFA all the things – If you are allowing any type of remote access to data or services, it needs to be protected with Multi-Factor Authentication. Unfortunately, the world contains a lot of bad actors who will take advantage of this situation to steal information or deploy ransomware. Many of these attacks will attempt to take advantage of a vulnerable identity perimeter, a properly implemented MFA solution will protect against most (~99%) of these attacks. (LINK)
- Block Legacy Authentication – If you are leveraging Office 365, Azure, Azure AD, etc. you should try to remove any legacy authentication from your environment. This, along with, MFA are the most effective ways to protect your Microsoft Cloud environment. If you can’t remove all requirements for legacy authentication: identify where it is used, put a sensor on it and monitor it closely. There are also technologies such as Azure Active Directory Conditional Access that can be tremendously helpful at controlling access as well. (LINK)
- Be aware of Illicit Consent Grant Attacks- In Office 365, an illicit consent grant attack is where a bad actor gets a user to register an application in Azure AD with permissions to their data. Once the user has done this, the application no longer needs an organizational account to access data. I have seen an increase in these types of attacks recently as organizations implement MFA which blocks traditional attacks. Be aware of the steps to detect and respond to these attacks. (LINK)
- Protect the data- I work with healthcare organizations who are on the frontline during this crisis. Suddenly many of these organizations who had very limited remote work scenarios previously are now rolling out work from home (WFH) for their employees. As this happens, we need to think about how we control that sensitive data when folks are accessing that data from their home PC. This is where tools such as Cloud Access Security Brokers (CASBs) and information protection solutions can help. Organizations should be implementing these protections prior to or in parallel with any remote work platforms such as real time collaboration tools. (LINK)
- Heightened vigilance- Bad actors have already started using COVID-19 as part of their phishing campaigns, this will only get worse. And with everyone being focused on meeting critical mission requirements, the potential for users “clicking” on that link or transferring funds is higher. You can also expect our adversaries to look for ways to disrupt services and to deploy ransomware. We must be extra vigilant and ready to “protect, detect and respond” to these attacks while continuing operations. Tools such as Endpoint Detection and Response, Next Generation Firewalls and Intrusion Detection platforms can help protect our assets. Add tools like CASB’s and Cloud Security Posture Management for detection and protection in cloud platforms. We also need to ensure our Security Operations Center is ready for the increased activity.
- Implement a rest plan- You’re probably saying…”What does that have to do with Cyber?”. This situation is going to be with us for a while and we can’t afford to burn people out. “It’s a marathon, not a sprint”. In scenarios like this we tend to go all hands-on deck, which is required initially, but can’t be sustained long term. 24/7 operations will probably be required in many organizations that haven’t previously required them. Leaders put together a work/rest plan and ENFORCE IT! (That includes for you by the way) You will always have those folks that will say “I’m good, I can hang”….they will burn out. Make them take a break. Not only are exhausted people less functional for mentally challenging work, they will also be more susceptible to getting sick. (LINK)
I have in no way covered all the items that need to be accounted for in this scenario, but hopefully this will help. I encourage you to share any thoughts or ideas you have. Working together we can get through this crisis! Oh, and “Wash your hands!!!”
More Reference Links: