The global health crisis accelerated the digital transformation efforts of organizations. The urgency was driven by the sudden change in work environments that may permanently alter business operations.

In an email interview, Back End News asked Vertiv, a provider of critical infrastructure technologies and life cycle services for information and communications technology systems, how can companies establish a reliable and flexible infrastructure to ensure business continuity.

The immediate imposition of work-from-home arrangements caught IT departments off-guard failing to properly secure certain channels within an organization. An individual employee’s computer, in some cases, does not have the necessary security required to operate corporate data and information.

Phishing, social engineering will persist in remote work setup

Ensuring business operations continuity with remote work setup

“Network protection now requires close cooperation from information security, IT, business continuity, disaster recovery, and crisis management teams,” said Jason Lim, country manager, Philippines, Vertiv. “Many IT teams are developing a virtual desktop infrastructure (VDI) at top speed so that their companies can adopt Desktops as a Service (DaaS) platform. They are also reviewing additional applications and workloads that can rapidly move to the cloud to improve business continuity and performance.”

Even if lockdowns have been lifted, some companies are considering making remote work a permanent or by-shift option.

“As companies build their VDI, they should carefully review their network connections, capacity needs, firewalls, and other security requirements,” Lim said. “Many applications will need the security of a virtual private network (VPN) while others can be migrated to the cloud for direct access.”

For companies that have just jumpstarted their digital transformation recently, Lim said they must look into data backups, batch processing, and disaster recovery which will provide immediate, as well as long-term, value. Organizations facing capacity constraints may choose to ramp up Infrastructure as a Service (IaaS) and Platform as a Service (PaaS) deployments.

Security

Companies’ security posture may have to be expanded since data and communications would have to be dealt with within a cloud environment. And reports from cybersecurity firms indicate that threat actors are taking advantage of the current situation and vulnerabilities. Threat visibility is almost non-existent with employees working remotely.

“Cyber attackers often target third parties because they have weaker security than their enterprise customers and often have privileged access to email, systems, and files,” explained Lim. “In addition to performing regular risk assessments of key vendors, enterprises should require multi-factor authentication for third parties, reinforce the policy of least access granted, and automatically discontinue network access when it is no longer needed to reduce the possibility of a breach.”

Among the most common attacks is phishing which remains to be a challenge for companies, more so now that communication with IT teams is limited. Lim shared some of the phishing risks companies and employees must be familiar with:

Brand impersonation: Employees may receive professional-looking emails with updates and be directed to click on seemingly authentic websites or download attachments with malware.

Authority figure impersonation: Attackers may send targeted emails, impersonating business functions such as IT, human resources, or finance. They may also pose as individuals such as a company’s chief executive officer. These emails often direct recipients to download a malicious file. Examples could include a company’s latest updates on current world news or an announcement of new IT and payment processes.

Pandemic-related scams: These requests which are more obviously aimed at access to finances can include shopping websites offering hard-to-obtain products such as masks and hand sanitizer; medical organizations seeking payment for a friend or relative or offering insider access to a vaccine or drug; airline and hospitality businesses offering refunds; and charities appealing for contributions. The goal of these attacks is to persuade employees to pay for a fraudulent good or service they’ll never receive or solicit funds for a non-existent charity.

Basic IT hygiene

Educating and empowering employees of security risks can help mitigate attacks. As simple as strong passwords, encrypted Wi-Fi networks, and devices, segregating corporate and personal devices, as well as regular security patches, are tasks that can be delegated to remote workers.

“We recommend that companies provide tip sheets to help employees do basic IT hygiene before connecting to company networks,” Lim said. “Any application that has single-factor authentication (passwords) should be disabled until it can be replaced with multi-factor authentication. Also, companies should review administrator access privileges to make sure they’re current and limited to only the systems the IT team needs to do its job. As information security teams know, administrator privileges are the holy grail for cyber attackers, because they enable pervasive access to networks.”

Vertiv manages networks and critical infrastructure, protects companies from unplanned downtime, and rapidly addresses evolving risks and threat situations. It enables IT administrators, data center or critical or control room managers, or others that require specialized, secure access with the ability to control the function of online applications, systems, and other digital continuity resources.

“Vertiv also helps enable partners’ IT teams as well as considering empowering end-users to connect to systems and applications without latency and securing key assets is vital to avoid costly unplanned downtime,” Lim said. “Vertiv is improving its reseller recruitment and also arranging enablement training using a variety of tools tentatively by the second quarter of this year.”

Management must be able to provide a single point of access for tracking servers, embedded technology, power equipment, and other critical network assets. Lim noted how even large companies struggle to manage growing device fleets that can create unknown gaps and risks.

“Vertiv can help by keeping software and firmware up to date, ensuring all device passwords are reset and compliant with up and coming regulations like the California IoT Security Law,” he said. “Vertiv teams can also provide the partners with visibility into other risks and threats like legacy technology that isn’t compliant with modern security protocols and encryption standards.”

Remote monitoring

Lim specifically noted a new type of business continuity risk that companies are grappling with — threats to the health and well-being of their IT teams.

“Remote monitoring and AI-driven security information and event management (SIEM) solutions can help identify real threats from false alarms, as well as help prioritize them,” Lim said. “Remote monitoring can also help IT teams track data center health, such as evaluating the condition of power and cooling systems and enabling workers to proactively replace systems and parts that demonstrate signs of stress before those issues lead to critical failures.”

Lim said now is the time for companies to take advantage of connected systems for improved visibility of critical environments and adopt technology that helps them achieve service level agreements regardless of physical location.