Ensuring quality assurance in end-to-end business processes, Mukul heads operations function to help organization to achieve strategic goal and to effectively address risk in business function and processes.

The current global situation has had an unprecedented impact on the social and economic fabric of the world. Apart from the various losses witnessed across sectors, it is expected to cost the global economy a loss of nearly $1 trillion. In these times, businesses are resorting to flexible modes of operation to establish and restore business continuity for mitigating the impacts around monetary uncertainty, dysfunctional business conduct and the unsure trading of services. However, the increased adoption of work-from-home procedures and greater use of online services have also provided cyber criminals more opportunities to exploit.

The WHO has reported a staggering fivefold increase in cyberattacks directed at its staff as well as email scams targeting the general public since the start of the pandemic. Meanwhile, Interpol, in a recent report, highlighted a significant target shift from individuals and small businesses to large corporations, government and healthcare infrastructure. Between (January to April 2020), the international policing agency detected 907,000 spam messages, 737 malware incidents and 48,000 malicious URLs - all related to the prevalent situation. From February to March 2020, Interpol saw a 569% growth in malicious registrations, including malware and phishing and a 788 percent growth in high-risk registrations. Meanwhile, the FBI announced that the agency is receiving nearly 4,000 cyberattack complaints per day, up 400 percent from the pre-pandemic era.

It is clear that cybersecurity is a clear threat to corporates; the question is, what can be done to mitigate risks? To take our own example, to mitigate cyber risks, we have set guidelines for employees working from home, provided employees with secure SSI-VPN connection and initiated constant monitoring by the IT team. Having a well-defined plan and SOP from the outset is always beneficial rather than trying to plug the holes after an attack.

Even as the risk of cyber threats has increased, CISOs also have to grapple with shrinking budgets. Global consulting firm McKinsey says that crisis-inspired security measures will remain top budget priorities in the last half of 2020. However, it warns that budget constraints will cause CISOs to reprioritize immediate cyber safeguards over more advanced threat-intelligence upgrades, behavioral analytics, and others. Let’s take a look at some ways how corporates can have an effective defense strategy for the current situation while keeping in mind tightening of security budgets:

i) Employee awareness: The very first thing to do is to lay down proper guidelines for your workforce. Responsible and aware employees are your organization’s first line of defence. This maxim was true even before the global crisis. Employees should be educated about the dangers of cyber-attacks and phishing as well as general data-security issues. Provide regular training to ensure they know how to safeguard themselves, especially when working from mobile devices.

Only by having an aware workforce, diligent IT team, and proactive security policies can you truly protect your organization.

ii) Perimeter Security: Provide your workforce with the right tools, which are firewalled, and antivirus protected. Providing SSI-VPN connection to employees to connect and collaborate will go a long way in pre-empting security threats. This might also be a good time to revisit access privileges to your workforce.

iii) Remote Access Policies: Implement multifactor authentication wherever possible, especially for VPN access. Some other procedures to adopt are IP address whitelisting, putting limits to Remote Desktop Protocol (RDP) access and constant monitoring of remote network connections. Providing more secure collaboration tools to employees working from home is also something that organizations can experiment with for added security.

(iv) Cloud Services Policies: With most employees working from home, the usage of cloud services has increased. Having a formal strategy for the use of cloud services is thus necessary. Marsh & McLennan Companies advises organizations to define data storage policies outlining conditions required for the use of cloud services, data center storage, and local storage, particularly for sensitive information. There are also tools that IT administrators can use to monitor cloud activity and enforce security policies.

(v) Continuous Monitoring and Audit:Having the appropriate policies and tools is just the first step towards safeguarding your organization. It is important to have regular audits and 24*7 monitoring of all systems and protocols. This helps you gain visibility into potential risk scenarios and be prepared to identify and act against any breaches quickly. This insight is also key to having a ‘defence in depth’ cybersecurity strategy, where there are multiple fail-safes & defensive layers in effect simultaneously

These are just some of the critical things that are imperative to create a secure environment and protect your IT infrastructure against data theft and cyberattacks. The list is not exhaustive, and each organization will have to decide which items to prioritize depending on their needs and challenges. However, none of these efforts and policies will be effective if they are not constantly monitored, tested and updated. Only by having an aware workforce, diligent IT team, and proactive security policies can you truly protect your organization.