Viruses and cyber security operations

We are used to dealing with viruses in cyber security.  They are one of our most familiar threats. New ones come out all the time, we study them, we understand their signatures, and then we update the protection of our population of systems, devices and users to detect them and prevent infection.

In the real world though we are currently facing a very different sort of virus.

Coronavirus or COVID-19

As this post is being written the news reports are coming thick and fast; The World Health Organisation (WHO) has declared the spread of Coronavirus as pandemic. Northern Italy is in lock down, the UK is in “containment” and the approach to the virus response in China, the US and the rest of the world is under intense, and worried, scrutiny.

People have been infected, people have (sadly) died and many more are ill or quarantined (or self-isolated).  There has already been panic buying of perceived essentials such as toilet paper and pasta, and fights have broken out because of it.  As of now, no one knows how much worse this is going to get.

Managing cyber security

Security operations might, if disruption gets really bad, be the least of our worries as businesses.  The impediments to travel, to sales, the plunging stock markets, peaks of demand (or lack of supply) for some goods, massive impacts to demand for others, the closures of schools; as well as widespread illness and loss of life will be much more serious.

If your business provides vital services or has to protect sensitive data, then these obligations, the importance of doing what you normally do, won’t go away.  This will be the case even if the coronavirus becomes more widespread.

Some job roles could be put on hold, people asked to stay off work or work from home.  These types of sensible precautions have already been used by some firms where cases have been suspected and we should expect this to continue.

For organisations, this means providing the ability to work remotely and knowing which roles are critical.  For those that can already (or could easily) be allowed to work from home, those can be managed too.

But where a critical role isn’t easily undertaken off-site, there could be some pre-planning needed.  Often security operations centres (SOC) fit this profile.

Security operations disruption

If you haven’t already, it is worth thinking about how you will manage security operations if access to offices, or travel, or school closures affect the availability of staff or the ability of them to get to the office the SOC normally operates from.

• Can they perform monitoring, investigative and response duties remotely?
• Can you flag alerts to them directly, rather than expecting them to see alerts appearing live on a screen (if they are not in front of it)?
• Can you allow access systems and security controls remotely in an emergency – possibly with privileged access that you might not normally allow over the Internet?
• Do you have tools to allow collaboration and access to knowledge bases when people aren’t sitting on adjacent desks, but isolated at their homes?
• Does this disruption of processes and reconfiguration of systems make you more vulnerable to attack or have less control over access?
• Are you more susceptible to a cynical and opportunistic cyber-attack from an unscrupulous attacker who uses the disruption as a smokescreen?

You can manage personal hygiene and safety with hand sanitiser and regular hand washing, or by curtailing non-essential travel.  But make sure the baseline cyber security hygiene of your business IT systems is sufficient to keep them protected from the background noise of cyber-attack during the next few weeks or months.

Don’t panic

As with everything else, panic is not helpful.  The cyber security equivalent of stockpiling toilet rolls (whatever that is) probably won’t help.  But being caught by surprise and failing to plan for various eventualities is a bad idea too.

Somewhere in the middle is a steady course of preparation, anticipation and reasoned response.  Security operations functions should be seeking a risk-based approach to dealing with this outbreak – as they do with the more technical cyber threats and viruses that are their more normal challenges.

See the WHO page for the latest information on Coronavirus.