Leadership discussions are going beyond business continuity and surviving the pandemic, to focus more on resilience, security and safety for the future.

It’s no longer news that the COVID-19 pandemic has pushed the world into a ‘new normal’, transforming the way we work, learn, communicate, entertain and socialize.

It’s also no secret that opportunistic cybercriminals have exploited the uncertainties of this new reality, as businesses and consumers learn to adapt.

Read also:

Beyond business continuity and survival, business leaders are finding that they have to also refocus their strategies to include critical areas such as security, safety and resilience.

CybersecAsia had the opportunity to discuss this new reality with Mark du Plessis, Managing Director, Accenture Security:

What, in your opinion, is the ‘new normal’ corporate environment? How could organizations in Asia adjust to the ‘new normal’ workplace and workforce?

du Plessis: As we move beyond the challenges of business continuity, organizations are refocusing on strategies to withstand new threats and seize new opportunities. The daily conversations about operations and profits now include business survival, safety, security, and resilience.

There is an increasing need for an agile operating model that provides flexibility to rapidly pivot to a remote-enabled workforce in response to dynamic market conditions. They must also be prepared to improve the long-term operations of the business, not just return to “normal”.

For example, with hybrid workplaces set to be the norm, security policies and frameworks need to be adjusted for the remote workforce as well as for those physically present in the office. Access to corporate networks will be more sacred than ever and managing these controls effectively will be vital for a safe return. I would advise organizations to put in place privileged access management to reduce the risk of a privilege escalation from an attacker coming in via your remote access route. 

Fortunately, organizations realize the task at hand. In the last five to six months, organizations have increased their security budgets as part of their efforts to manage the challenges thrown by the pandemic. With security becoming a priority for leadership teams, we expect a much-welcomed behavioral change in the workforce, a culture where security is intrinsic and applicable to everything. 

With work-from-home strategies in place, what can organizations and employees in the region do to prevent security incidents and data leakage, and enhance systems resilience?

du Plessis: Organizations should institute situational threat intelligence briefings virtually to include security leaders, technical leaders, senior executives, and current business continuity and disaster recovery war rooms. They should also remind employees and third parties to remain vigilant, as well as building analytics and automation for endpoint, VPN, threat intelligence, vulnerability management, data loss prevention, and employ other technologies and monitoring solutions to accommodate the expanded use of a multitude of devices in potentially less secure locations.

People are the most important part of the security fabric. An important step towards building resiliency is educating employees about the potential risks of remote work, including phishing. They rely on home WiFi routers and VPN connections to company infrastructure, and misconfigurations risk the leakage and theft of sensitive company information. To protect against such vulnerabilities, organizations should ensure employees are aware of information protection procedures, best-practices while working remotely, and understand how to configure and connect to company VPN providers and avoid split-tunneling in particular.

Employers should also plan fallback measures for phone-based and offnet communications and work, as VPN providers may encounter scaling issues as a large number of users join. They must ensure that employee computers and devices are updated with the most current system and application versions

With hybrid workplaces, another important step is data cleansing and integration. This means provisioning for the integration of company data generated outside the company network while working remotely back to the company server. It involves reviewing the data and ensuring its authenticity before merging it with company’s information system.

What areas should organizations focus on to be both agile and cybersecure in the current business climate? 

du Plessis: Agility and security are two sides of the same coin, one cannot be effectively agile without being secure. Truly agile organizations have strong threat resiliency, and they must manage the risks associated with large-scale workforce fluctuations.

Solutions involve updating existing cybersecurity policies and educating workers in good cyber hygiene practices to reduce non-malicious internal threats. Particular focus should be placed on patching weaknesses in systems. It is also recommended to swiftly shift the premise of cybersecurity strategies from that of a “walled garden” to one of “zero-trust”. The latter relies on strict identity verification and authentication of users, devices and transactions attempting to access resources on a private network – whether or not they are insiders or outsiders. 

What are some best practices to be aware of – especially in the areas of customer experience, employee experience and business continuity – as they plan to survive and thrive in the ‘new normal’?

du Plessis: As organizations look to digitize the customer experience journey, malicious threat actors exploit the confusion and uncertainty to penetrate the organization. Communicating first can help disinformation lose its power. They should factor the additional security vulnerabilities and the importance of digital identity and authentication, data security, as well as tools and techniques needed to mitigate new threats for security monitoring.

Additionally, they must pivot to a more defined, employee-centric operating model, one that re-orients teams around what matters most to employees and delivers differentiated experiences to maximize engagement and build trust. Organizations should evaluate and promote solutions that allow distributed teams to connect and collaborate safely, securely and effectively— optimizing the employee experience while maximizing productivity.

Some measures that can help achieve this outcome include:

  • Adopt and measure collaboration with the large-scale deployment and use of collaboration tools and through providing targeted, prescriptive guidance on how to be safe and secure when working remotely. Establish clear guidelines on how to share information securely based on data classification, audience and content type.
  • Make the best of leading practices while accepting that not all work can be done remotely. Adjust expectations accordingly, both within the organization’s teams and across the ecosystem of stakeholders.
  • Be nimble and innovative with the latest technologies. Clearly communicate which officially approved software and tools may be used for remote working—including those for file sharing, video conferencing, virtual whiteboard collaboration and chatting.
  • Anticipate the increase in volume and load from the use of collaboration tools from more employees working remotely, while also improving usability and productivity. Encourage large-scale virtual sessions using interactive broadcast and web conference platforms to support the shift from physical to virtual workshops and conferences.