A featured contribution from Leadership Perspectives: a curated forum reserved for leaders nominated by our subscribers and vetted by the Construction Tech Review Advisory Board.
Salvador Caetano Group
Importance of Integrating Security Measures in On-boarding Candidates for Remote Work
It’s pretty much undeniable that the pandemics acted as a catalyst for digital transformation. We (digital leaders) led the processes of finding, deploying, and providing connectivity, collaboration, and support solutions to organizations that saw their office spaces empty, and had no clue on how to face this desertion. Then, two amazing things happened:
• It seemed that we pressed the fast forward button on the organization side in what comes to the digitalization of business processes.
• The end-user was accepting - let me repeat – accepting (and even embracing) the change. The end user became grown up and learned how to deploy, connect, and troubleshoot its own IT equipment and its connectivity. No more than spoiled children sitting at the office blaming the field support technician about their lack of productivity.
This has happened like that because THERE WAS NO OTHER WAY!
Yet, a lot of things just got behind. Today, we face more security issues and data breaches than ever, and there is hype in all IT and Business communities about cybersecurity. The cybersecurity budget and initiatives are the ultimate benchmark object in networking events and business lunches. And while everyone seems to agree on the human factor as the weakest link, I sense a lack of creativity in countermeasures to increase the security maturity level of the end user. Security awareness training is, in most cases, too generic, provided in e-learning modules, and has a very automated progress track. I have seen several colleagues sending emails, chatting with friends, cooking, etc., while the training videos were playing, just to be able to mark them as completed. Why does this happen? Because, unlike the above, they do not have the feeling that THERE IS NO OTHER WAY! We (leaders) are failing on that. In Gartner’s report on top trends in cybersecurity for 2022, we find in top seven: “Human error continues to feature in most data breaches, showing that traditional approaches to security awareness training are ineffective. Progressive organizations are moving beyond outdated compliance-based awareness campaigns and investing in holistic behaviour and culture change programs designed to provoke more secure ways of working.”
We are failing in the recruitment processes since we are letting the talent shortage shape the process. We compete for the attention and preference of the candidate in a way that we tend to accept the unacceptable. How many of us hired people that we only have seen in a blurred image in a ViCo interview? Based on an unverified CV and some storytelling? Big risk!
In the shoes of a manager of some cloud provider, as an example, I would not feel comfortable hiring a 100 percent remote Infrastructure Specialist with access to bridgehead servers without doing some vet! Remember the “Cloud Hopper” case? The first two steps from a high-level analysis (by Reuters) are:
• Infiltrate the service provider, usually via a so-called “spear phishing” email designed to trick employees into downloading malware or giving away their passwords;
• Once inside, map out the environment, establish footholds and find the target: the system administrator who controls the company ‘jump servers’, which act as a bridge to client networks.
These two steps were easily achieved. Several employees were easily lured!
That’s why vetting is a must! Remote hirings, for 100 percent remote jobs, have an increased risk. Take it into consideration. Put a risk score tag in every role and direct your initiatives accordingly.
We must compete for the attention and preference of the candidate in a way that we tend to accept the unacceptable.
• A zero-trust security model. Adopt it. It helps to prevent unauthorized access to sensitive data and resources. By adding context to the access requests, we gain deeper insights and better incident response. Also, in most cases, there is no need to move or reallocate data. It fits into hybrid, multi-cloud environments.
• Protect sensitive data. And don’t overprotect non-sensitive or public data. It comes with a cost. Adopt strong encryption policies for data at rest and in transit at or to cloud infrastructures;
• Identity access management, endpoint detection and response, and unified endpoint management (IAM, EDR, UEM) are tools that help with the visibility that the security team has on suspicious activity. Blocking, or quarantining the source of the suspicious activity for deeper inspection, can save your day. Also, BYOD policies are easier to deploy and secure.
• SOAR, XDR, and SIEM are also terminologies to consider. All these strategic initiatives need to be tuned and correctly orchestrated, or else there the big risk might be the excessive amount of information generated from events and turn into a flood.
• Be creative in the definition of security awareness programs. Keeping in mind the increased risks we just mentioned, redesign your programs. There are a lot of tools and tactics to consider, like gamification and role-playing. Whatever the approach, the need is to transmit the feeling that there is no other way because there isn’t.
