The COVID-19 pandemic has had so many unprecedented consequences. The great global shift from office work to remote work is one such consequence, with which many information security professionals are struggling. Office workers have been hastily given equipment that has not been properly secured or must use personal devices to perform office work. The proliferation of videoconferencing has brought about new types of cyber-attacks. When the pandemic struck, many organizations found they had no, or old and unworkable, business continuity and disaster recovery plans.
Business Recovery and Continuity in a Mega Disaster: Cybersecurity Lessons Learned from the COVID-19 Pandemic reviews the COVID-19 pandemic and related information security issues. It then develops a series of lessons learned from this reviews and explains how organizations can prepare for the next global mega disaster. The following presents some of the key lessons learned:
The lack of vetting for third party suppliers and vendors
The lack of controls surrounding data privacy, especially as it relates to the personal identifiable information (PPI) data sets
The intermingling of home and corporate networks
The lack of a secure remote workforce
The emergence of supply chain attacks (e.g., Solar Winds)
To address the issues raised in these lessons learned, CISOs and their security teams must have tools and methodologies in place to address the following:
The need for incident response, disaster recovery, and business continuity plans
The need for effective penetration testing
The importance of threat hunting
The need for endpoint security
The need to use the SOAR model
The importance of a zero-trust framework
This book provides practical coverage of these topics to prepare information security professionals for any type of future disaster.
The COVID-19 pandemic has changed the entire world to unprecedented and previously unimaginable levels. Many businesses, especially in the United States, were completely caught off guard, and they had no concrete plans put into place, from a cybersecurity standpoint, for how to deal with this mega disaster. This how-to book fully prepares CIOs, CISOs, and their teams for the next disaster, whether natural or manmade, with the various lessons that have been learned thus far from the COVID-19 pandemic.
