Are you working from home?

[Posted on Behalf of Pushkal Mishra, AVP IT & CISO HDFC ERGO Health Insurance Ltd.]
While the world is battling with COVID-19, Information security professionals have a double duty to do.

1. Take all the precaution to keep the Coronavirus away on the personal front

2. Manage the IT risks that come along while facilitating Work From Home (WFH) for the organizations they work for

Let’s focus on point No. 2 here. With COVID-19, the organizations have reached an inflection point where things have changed dramatically to facilitate this “new normal” of WFH. Standardized office perimeters disappeared and now anyone can connect from anywhere. The pandemic has struck the organizations around the world like a perfect storm and the onus is on IT to enable the business during the lockdown and facilitate them with necessary tools & technologies to work from home.

Most of the organizations never designed themselves to go mainstream that way. Consequently, there were a Tsunami of things to be taken care of, at times, at the cost of security! As a result, the attackers are now exploiting those loopholes to their advantage. We’ve already seen plenty of unwanted security incidents across the board.

Through this article, I would like to bring your attention to some of the things that could be done to control the IT risks of working from home. You can view them in terms of short term and long term focus.

Short term (within 3 months):

8669832283?profile=original
First of all, conduct the security risk assessment of the Remote IT infrastructure that includes VPN (Virtual Private Network), VDI (Virtual Desktop Infrastructure), Terminal Services, Public facing applications, and cloud workloads as these are some of your entry points. You need to reassess your risks because pandemic has changed the context, for example, organizations in the pre-COVID-19 era considered VPN as DR measure to support business in case primary connectivity (or office premise) goes down but tables have turned and VPN is now the primary mode of connectivity and has taken the precedence over the standardized office cubicle way of working. So Remote IT infra has climbed up the ladder of asset criticality matrix of the organization. Which means it will now have rather aggressive recovery objectives and SLA than before and it will also be the primary point of attack

Seriously consider phishing risk as there has been an upsurge in the number of phishing emails taking advantage of the anxieties of people during this pandemic. So many potentially dangerous domains have been created for phishing emails. Please educate your users in an engaging way. Try internal phishing simulation as people learn better that way than educational emailers. While you are at it, also educate users on home WiFi and mobile security Initiate vulnerability assessment and penetration testing of your critical applications both in Blackbox and Greybox mode

Check on your brand reputation across cyberspace for any potential business risk of dark web threats, brand infringement/intellectual property leaks, rouge applications, fake campaigns/scams, PII data exposures etc

Long Term (6 months or beyond):
8669832296?profile=original

Review your data loss prevention program & associated technologies. Think this through from unmanaged endpoints accessing the managed network. Reorient it to suit the current situation
Review your security incident and event mgmt program & associated technologies. Add use-cases that are pertinent to today’s context (e.g. more use-cases on VPN if that is your primary mode of corporate connectivity)

Develop capability for endpoint incident detection and response as we are living in the times where perimeters are fading fast and traditional corporate endpoints are now “internet endpoints”. These endpoints may be subjected to a variety of security issues owing to software security, configuration issues, backdoors, etc, and can eventually lead to disruption of services. So isolating, containing and recovering capabilities at endpoint can be a good strategy

Strengthen your business continuity mgmt program as it is now needed a lot more than ever before
By no means is this an exhaustive list. You can add to it as per your risk mgmt program (such as ZeroTrust/SASE, Data-Centric security etc). Although these are few good points, to begin with.

Votes: 0
E-mail me when people leave their comments –

You need to be a member of CISO Platform to add comments!

Join CISO Platform

Join The Community Discussion

CISO Platform

A global community of 5K+ Senior IT Security executives and 40K+ subscribers with the vision of meaningful collaboration, knowledge, and intelligence sharing to fight the growing cyber security threats.

Join CISO Community Share Your Knowledge (Post A Blog)
 

 

 

CISO Platform Talks : Security FireSide Chat With A Top CISO or equivalent (bi-monthly)

  • Description:

    CISO Platform Talks: Security Fireside Chat With a Top CISO

    Join us for the CISOPlatform Fireside Chat, a power-packed 30-minute virtual conversation where we bring together some of the brightest minds in cybersecurity to share strategic insights, real-world experiences, and emerging trends. This exclusive monthly session is designed for senior cybersecurity leaders looking to stay ahead in an ever-evolving landscape.

    We’ve had the privilege of…

  • Created by: Biswajit Banerjee
  • Tags: ciso, fireside chat

CISO Meetup at BlackHat Las Vegas 2025

  • Description:

    We are excited to welcome you to the CISO Meetup during BlackHat USA 2025 in Las Vegas! Join us for an exclusive networking, meaningful conversations, and community building with top CISOs and cybersecurity leaders from around the globe. 

    Meetup Details:

    Location: Mandalay Bay, Las Vegas …

  • Created by: Biswajit Banerjee
  • Tags: ciso, black hat, black hat 2025, black hat usa

6 City Playbook Round Table Series (Delhi, Mumbai, Bangalore, Pune, Chennai, Kolkata)

  • Description:

    Join us for an exclusive 6-city roundtable series across Delhi, Mumbai, Bangalore, Pune, Chennai, and Kolkata. Curated for top cybersecurity leaders, this series will spotlight proven strategies, real-world insights, and impactful playbooks from the industry’s best.

    Network with peers, exchange ideas, and contribute to shaping the Top 100 Security Playbooks of the year.

    Date : Sept 2025 - Oct 2025

    Venue: Delhi, Mumbai, Bangalore, Pune,…

  • Created by: Biswajit Banerjee