Tag: COVID-19

Weidenhammer of Wyomissing is a digital strategies and technology solutions company. Anthony Cartolaro, Jr., is vice president of Weidenhammer’s Digital Platforms Division and has more than 25 years of technology leadership experience.

LVB: Has the volume of cyber-attacks grown since the start of the COVID-19 pandemic?

Cartolaro: The COVID-19 pandemic has indeed turned a number of things upside-down in the world today. Students being educated from their homes, contactless delivery of food and other items right to your door, and a larger-than-ever remote workforce. So, with all of that technology being used to help us change our pre-pandemic behaviors in this COVID world that we now find ourselves living in, the answer is a resounding yes. The more technology in use, the higher the risk for attack.

LVB: What are the biggest concerns in cyber security right now with so many people telecommuting and shopping from home?

Cartolaro: Effective cyber security can be complex, but in its simplest form, we associate cyber security risk with the amount of “attack vectors”. Generally, attack vectors are the number of pathways in which potential threats or bad actors can gain unauthorized access to computers and data. Now that the world has gone remote, both in our work, but also shopping from home, the use of technology has increased exponentially. This increase also equates to an increase in the number of paths or attack vectors available to would-be bad actors.

Another risk that we continue to face in 2021 is the after-effects of our pivot to a remote workforce in 2020. While some organizations were already leveraging technologies that allowed them to work from anywhere and at any time by using the cloud – the cloud for email, collaboration, phone systems, etc., some organizations were not so ready. So, in their rush to keep their business running in 2020, some IT departments permitted staff to install applications on their work device that would allow them to keep working – this is in contrast to standard IT security and governance best-practices.

LVB: What can companies do to protect their employees, customers and data?

Cartolaro: I understand, in the heat of the moment, IT leaders had to do what was needed. Now, IT leaders need to recognize that not only the increased use of technology, but also some of the tactics used to keep our employees connected have opened ourselves up to vulnerabilities. That said, although the world has changed, I’m not sure my advice would be much different today than it may have been a year or two ago. I would encourage our IT leaders to start with an assessment. Vulnerability or security assessments give organizations a “heatmap” of the attack vectors or vulnerabilities that exist today. These assessments will scan their network, their devices, and their servers to report on known issues that may exist. Things like unauthorized applications, missing anti-virus and anti-malware software, or devices that are not running the latest updates or patches. I consider this the “low-hanging fruit.”

Part of an assessment should be a review of their IT security processes, policies and governance. This includes reviews of their standard procedures for security incidents, updating their employee acceptable use policies and ensuring that their IT security policies are in line with today’s standards and compliance requirements. Add in their own industry-specific regulations, things like HIPAA (Healthcare), FERPA (Education), and PCI (Payment Card Industry), and this step can be daunting, but necessary.

Lastly, organizations need to focus on the most vulnerable part of their technology infrastructure, the users. User awareness is a must-have and often overlooked component of a mature cyber security posture. There are many online services that organizations can use to help train staff on cyber security threats like what to look for when they get suspicious emails. The end users are your most vulnerable, but if you can make them aware, they can also be your best defense.

LVB: What do you see on the horizon for the cyber security industry?

Cartolaro: In 2021, I believe we need to ask organizations to focus on one primary word, resiliency. Often organizations use the excuse that they are moving too quickly to take the time to plan. “We don’t have time to do that.” Well, resiliency will come in several forms. First, organizations should consider building a business continuity plan. BCP’s are not necessarily focused on technology, but one more logistical and operational. Consider it a “what if” plan. Granted, not many BCPs had a “What if there is a global pandemic chapter” but, for those who had a BCP in place, I’m certain it made their changes in 2020 more efficient.

BCPs get organizations thinking. As a plan is built, often trends emerge. A common theme may be the ability to work from anywhere based on a wide variety of “what if” scenarios. Like, what if the internet goes down? What if there is a storm, hurricane or tornado? What if the water main down the street breaks and we can’t come to work? While we say BCPs don’t get too involved in technology, oftentimes technology plays the role of hero to help overcome challenges. Cloud technologies could help organizations overcome many of the challenges I outlined.

Lastly, organizations need to take another and much-more serious look at their cyber security posture. Things have changed, so their security needs have likely changed as well. Assessments can help create a roadmap to improve their security skills to ensure their business remain protected in this “new normal.”