Business Recovery and Continuity in a Mega Disaster

Cybersecurity Lessons Learned from the COVID-19 Pandemic

Ravi Das

• Publisher: Auerbach Publications
• Year: 2022
• ISBN:
  9781000574593
• Edition: 1
• Topic: Informatica
• Subtopic: Sicurezza informatica

The COVID-19 pandemic has had so many unprecedented consequences. The great global shift from office work to remote work is one such consequence, with which many information security professionals are struggling. Office workers have been hastily given equipment that has not been properly secured or must use personal devices to perform office work. The proliferation of videoconferencing has brought about new types of cyber-attacks. When the pandemic struck, many organizations found they had no, or old and unworkable, business continuity and disaster recovery plans.

Business Recovery and Continuity in a Mega Disaster: Cybersecurity Lessons Learned from the COVID-19 Pandemic reviews the COVID-19 pandemic and related information security issues. It then develops a series of lessons learned from this reviews and explains how organizations can prepare for the next global mega disaster. The following presents some of the key lessons learned:

• The lack of vetting for third party suppliers and vendors
• The lack of controls surrounding data privacy, especially as it relates to the personal identifiable information (PPI) data sets
• The intermingling of home and corporate networks
• The lack of a secure remote workforce
• The emergence of supply chain attacks (e.g., Solar Winds)

To address the issues raised in these lessons learned, CISOs and their security teams must have tools and methodologies in placeto address the following:

• The need for incident response, disaster recovery, and business continuity plans
• The need for effective penetration testing
• The importance of threat hunting
• The need for endpoint security
• The need to use the SOAR model
• The importance of a zero-trust framework

Thisbook provides practical coverage of these topics to prepare information security professionals for any type of future disaster.

The COVID-19 pandemic has changed the entire world to unprecedented and previously unimaginable levels. Many businesses, especially in the United States, were completely caught off guard, and they had no concrete plans put into place, from a cybersecurity standpoint, for how to deal with this mega disaster. This how-to book fully prepares CIOs, CISOs, and their teams for the next disaster, whether natural or manmade, with the various lessons that have been learned thus far from the COVID-19 pandemic.

Chapter 1 Introduction

DOI: 10.1201/9781003279143-1

Introduction

Back in December 2019, the mention of COVID-19 first started to erupt in the news headlines, primarily from China. There was rumor and fear that a new virus was about to plague the Chinese population, with its first outbreak in the Wuhan province.

Even to this day, there is still speculation as to how all of this started. There have been substantiated rumors that it emerged from the notoriously unhygienic meat markets or from a laboratory experiment that went completely awry.

There were even further rumors that the Wuhan University was seeking to hire a virologist to conduct high levels of sophisticated research just before the outbreak of the virus. However, wherever be the origin of the COVID-19 virus began, it was first thought that it would remain localized within China.

But as 2020 began, the spread of the virus became even more rampant in China, and also started to spread outside its borders via cruise ships that were making their respective ports of call.

Many of these passengers started to get sick, many of the ships still remain docked, and as a result, the passengers had to quarantine themselves. But, there was still hope that the COVID-19 virus would still be confined to China.

But, these hopes were dashed when the virus began to make its way across international borders. Many countries in Europe and Asia started to report their first confirmed cases of COVID-19 around the beginning of January 2020.

The virus started to spread like wildfire, eventually reaching the shores of the United States. In fact, the World Health Organization (WHO) declared COVID-19 to be a pandemic in late January 2020. Because of this, the financial markets around the world incurred steep losses, especially in the United States.

The DOW and the NASDAQ displayed wild swings, going as low as 1,000+ points or more, thus triggering the financial markets to immediately stop trading until some calmness could be restored.

Although the actual number of people getting infected in the United States was still more or less mitigated, many governments at the local, state, and federal levels started to heed warnings from the other governments around the world.

Eventually, by March 2020, many states implemented shutdown orders in the sense that only those businesses that were deemed to be essential remain open.

Businesses that were not deemed to be essential remain closed for a much longer period of time, pretty much indefinitely. People were forced to remain at home and even work from home (WFH). Social distancing was mandated by staying at least six feet apart from one another. Also, face masks have to be worn when going outside. This was a rule at least in the United States for all of summer 2020. But over time, the COVID-19 virus started to ease up and the number of people getting infected started to experience a declining trend.

As a result of this, many of the stay-at-home orders were eased, and people could go out once again, and start to resume normalcy back into their lives yet once again. But no sooner that this started to occur, the COVID-19 virus started to spread again because of the closer contact among people which was allowed at that time. All of this started to take place in fall 2020, with its peak reaching closer to winter 2020.

Yet once again, people were confined to their homes and work from there as well. But by late winter 2021, and even going into spring 2021, new hopes started to emerge as vaccinations were starting to get approval from the Food and Drug Administration (FDA), with the initiation arising from pharmaceutical giants such as Pfizer, Moderna, and Johnson and Johnson. Unfortunately though, there were heavy restrictions imposed as to who gets vaccinated first.

The first group of people who were allowed to get the shot were the first responders, the elderly living in senior citizen retirement homes, and those individuals who were deemed to be at a higher risk of developing COVID-19 due to complications, such as cardiac patients or those with cancer.

But over time, more people continued to get vaccinated, and eventually, by around early summer 2021, the new Presidential Administration of Joe Biden mandated that all people, regardless of age, work occupation, or physical ailment, were eligible to receive it.

With this, many more people could get this life-saving vaccination, and because of that, the sheer numbers of confirmed COVID-19 cases drastically declined. There was firm hope that eventually COVID-19 would finally disappear and that people and businesses could return to normalcy back permanently.

For example, any venues that were canceled in summer 2020 were planned to reopen once again, and many businesses were planned to open their brick and mortar presence yet once again.

But unfortunately, as of the writing of this book, these hopes seem to be dissipating once again, with the emergence of the delta variant of the COVID-19 virus, which has literally spread all over the world. Although restrictions so far have not been so severe, many entities were requested to use face masks and provide proof of vaccinations.

Many businesses so far have been rethinking of their back-to-work orders, and these entities have extended the work from orders going into January 2021.

The bottom line is that the COVID-19 pandemic has gripped the world in ways we could never imagine. This has been truly so far a once-in-a-lifetime event, with the ramifications being far more devastating than what was thought earlier.

For example, every aspect of daily life and industry has been impacted, and because of that, people have to rethink and come up with new ways how to move their lives and businesses forward. Probably one of the greatest impacts that COVID-19 has made has been on the world of cybersecurity.

One of the largest areas in which this impact has been felt is with the dawn of the new remote workforce. Although working virtually and away from the traditional brick and mortar office is not a new concept, the way it has gripped the world has been unforeseen and even unprecedented. The concept of a near 99% remote workforce was something that was thought to happen in five or six years, more like in the middle point of this decade.

But, with the rapid spread of the COVID-19 virus, this became an utter reality in just a matter of three months. Because of the drastic quickness in the implementation of this, many cybersecurity mistakes were made which had devastating consequences.

For instance, the IT security teams across Corporate America were forced to hastily issue company devices, and not all of them had the necessary security features installed onto them. Thus, this led the American Workforce to pretty much use their own personal devices to conduct their daily job tasks.

This is a phenomenon which is literally known as “Bring Your Own Device” or BYOD for short. It posed many new cybersecurity challenges as well because many of these personal devices did not have any sort of protection. The second major problem that emerged was the meshing of the home networks and corporate-based networks.

For example, the remote workforce now had to use their home-based network in order to gain access to the shared resources that were stored on the corporate servers. Of course, there was a minimal level of protection for these home-based networks which thus exposed the corporate networks to even more cybersecurity weaknesses, gaps, and vulnerabilities.

Another s...

Table of contents

• Cover Page
• Half Title Page
• Title Page
• Copyright Page
• Dedication
• Contents
• Acknowledgements
• Author
• Chapter 1 Introduction
• Chapter 2 The Cyber Lessons That Have Been Learned from COVID-19
• Chapter 3 How to Prepare for the Next Pandemic
• Chapter 4 Conclusions
• Index