Information confidentiality in the post-lockdown world
Until recently, most nations and corporations around the world were living with different threat and risk profiles. This year, we are all dealing with a global pandemic which is having a wide-reaching impact and threatens life as we know it.
In the realm of security, the facets of this threat have become clearer over recent months and especially so as we’ve navigated periods of lockdown.
Here we explore some of these threats, consider whether COVID-19 has simply unveiled them or indeed created them, and examine how this specifically affects the confidentiality of our information.
China & Russia – the dual threat to national security
China’s role in the discovery of COVID-19 will be scrutinised over the months to come, but in the meantime, suspicions and conspiracy theories swell as we tot up the reports of cyberattacks, foreign agents and espionage cases across the globe. The decision by the UK government to follow the US’S decision to remove Huawei’s 5G infrastructure is seen by many as an affirmation that China-UK relations are at a crossroads as we assess China’s influence and interwoven reach into our nation.
At the same time, we’ve also gained affirmation of the threat posed by Russia. The publication of the Russia Report confirmed what we all knew – Russia poses a threat to UK national security – while also exposing the fundamental error in countering the threat: essentially, no one is doing so as they don’t feel it is their responsibility. On a strategic level, the need for a more unified, simplified and internationally connected model of national security management is the key takeaway and we can see how this would benefit when tackling other threats.
Protecting the search for a vaccine
Health terrorism is not new, but it has really come to the fore with the search for a COVID-19 vaccine. Pharmaceutical industry espionage has been well-documented, more so now as the NCSC issues reports of Russian hacking attempts.
The sharing of incident reports and the ensuing ability to leverage a holistic view of the threat will play a big role in being able to identify health terrorism and counter it effectively. It’s interesting, some say disappointing, how the race to a vaccine for the health of the world has fast become one governed by economic market factors and purchasing power. It remains to be seen whether any cohesion will be achieved.
A rush to lockdown
In the corporate environment, the period of lockdown has proven especially challenging to information security. For those organisations who weren’t already set up for remote working or hadn’t prepared a response as part of a business continuity plan, there was a rushed shift to full remote working.
Recent reports have highlighted poor IT practices, and the need to educate home workers, resulting in reams of guidance on safe remote working practices from institutions such as the NCSC and CISA. The lockdown of offices and working environments has also created the perfect opportunity for adversaries to carry out targeted technical attacks, including the installation of eavesdropping devices.
Home office security
An increased level of remote working necessitates the need to review home offices for the level of protection they offer to confidential conversations in the same way as secure office spaces such as boardrooms do. More C-suite and senior executives are working from home than ever before so conversations on highly sensitive topics such as restructures, mergers and the like, have now moved to home offices, plus those working in industries or within roles which require confidentiality by their very nature have had to decamp from their protected working environments.
There has been an increase in residential survey requests. However, assuring confidentiality is – and always has been – a holistic affair. The detection of electronic eavesdropping threats, which many assume Technical Surveillance Counter-Measures (TSCM) constitutes, is only one element; for true protection, an evaluation of both the physical and cyber vulnerabilities and a strategy and measures to defend against these in the most effective way possible are needed.
Adapting to a new post-COVID-19 world
In order to stay competitive, we must consider how we continue to protect our information and conversational data. In security, we are intrinsically primed to understand and assess the threat to ensure we are prepared for the unpredictable, so arguably we are already well placed to support our organisations and colleagues to combat the threat posed by COVID-19.
With many companies now signalling a move to complete or increased remote working in the long term, there is now the need to consider how best to both maintain a high level of alert by employees and train them on the new threats which emerge. As the timeline of the pandemic has developed, the threat of malicious cyber activity has increased exponentially with attackers exploiting COVID-19 as a means of gaining access to information and financially scamming businesses and individuals.
Arguably then, there is a significant need to support colleagues with security training and security awareness briefings, and the market for effective virtual training and tailored awareness briefings is only set to grow.
As the economy takes a downturn, previous experience of recessions tells us that these times of increased personal and professional stress and uncertainty generate a higher level of insider threat. An incident of social engineering has already hit the headlines recently with the hack at Twitter, and there is no doubt that adversaries will be looking to prey on employees’ vulnerabilities for their own gains.
A combined programme of system and information access review, monitoring and recording, as well as education and timely employee leaver access revocation protocols will help to protect your most valuable assets.
Esoteric Ltd has a series of four content guides available on its website to help organisations to protect their confidential information during COVID-19 and beyond, featuring practical tips and guidance for security professionals.
The guides can be downloaded via https://www.esotericltd.com/register-for-covid-19-security-guides/
Emma Shaw CSyP
