More than six months have passed since the World Health Organization classified Covid-19 as a pandemic. Since then, the way we live and work has certainly been transformed. And one of the sectors that has certainly felt this change the most has been Cyber Security.

A change forced by the forced distribution of workers remotely. But now that this new paradigm seems to have been so well received that it has been adopted in a stable way, with companies like Facebook and Google saying that they want to continue in this way, we also need to rethink how Cyber Security and data management will be tackled from now on.

Human factor first and foremost – When we talk about Cyber Security, people are – in most cases – the weakest link in the defence perimeter.

In an era of widespread Smart Working, keeping employees and other workers trained and ‘alert’ to the latest threats will be increasingly difficult.

If we then think of scenarios in which new employees will be hired without having to work on-site and will not have the opportunity to “test” company policies and best practices first-hand, it becomes even more complicated.

To be successful and maintain the right level of resillience and awerness from employees, on-boarding programmes will need to include a strong Cyber Security training component – through specific cyber risk prevention courses – as well as a robust data management policy training programme; for example:

– which types of data are sensitive,
– what to do and what not to do,
– who to contact when things go wrong.

It is not even a “fire-and-forget” process.

According to a recent study, employee enthusiasm falls by 22% after the first week of work, so it is important to plan regular checks and reminders to detect and correct errors.

And remember that no matter how good your on-boarding procedures are, people will still make mistakes – so think about how to automate data management processes and work to make your data stack as foolproof as possible.

Classify data efficiently – Data classification remains a critical point for many companies, with two-thirds of companies claiming to have classified less than half of the data in their cloud storage systems.

Widespread remote working will increase the stakes, making unclassified data a greater risk factor and making it more difficult than ever to identify problems and correct them at the same time.

There are several approaches that can help in this regard: effective training is a must and cleaning up existing data sets is important.

But it is also crucial to recognise that distance working brings new distractions, so mistakes will continue to creep in.
The best approach is to automate the classification process so that when workers make a mistake, sensitive data is still collected, labelled and processed as it should be.

Control actions before data – In the era of on-site work, many companies believed they could keep data secure by strengthening their perimeter. After all, if you keep the bad guys on the outside, you’ll get away with it, right?

Well, this approach didn’t work well before Covid-19 and it certainly won’t work in the new era.

With a distributed workforce, your perimeter has just become exponentially larger than n times and more difficult to manage.

So you will need a new Cyber Security strategy.

The best approach is to focus not on building walls that prevent access, but rather on the control systems that determine how the data is used.

In short, a ‘distributed’ security strategy to match the ‘distributed’ workforce.

Ideally every time a user tries to open, copy, share or alter a given bit of data, your security infrastructure should be able to check its credentials to ensure that it is impossible for individual users to use or share sensitive data inappropriately.

In this case a Zero-thrust Cyber Security approach is the best option.

The right approach – The result is that data security will remain a major challenge for both large and SMEs in the coming months and the shift to remote working will inevitably create significant new gaps.

There is no way to avoid these risks altogether, this would be utopian.

But by acting simultaneously on two fronts, human and technological, the cyber risk factor is drastically reduced.

In the first case, Security Training and Awerness activities such as Phishing Simulation Attack must become a must.

In this way, the risk linked to phishing (still the main means of attack for Criminal Hackers) is significantly reduced.

From the technological risk point of view, it is advisable to implement regular Security testing activities such as Network Scan, Vulnerability Assessment and Penetration Testing to secure the company perimeter and identify and close possible vulnerabilities in a timely manner.

At the same time, combining these activities with Cyber Threat Intelligence will allow you to be informed in real time of possible threats in progress or already in progress affecting company assets, employees’ emails and much more…

As always the motto remains: Don’t let your guard down!

SOURCE: FEDERPRIVACY