Wednesday, April 15, 2020

Corporate Privacy & Information Security Challenges from Covid-19

This is an excellent information security article written by a respected colleague. ~Kevin
via Charles Patterson - Exec Security
The CoVid-19 response has had serious and often devastating effects on individuals and businesses throughout the world... But there are a number of side-effects from this, many of which affect privacy and information security...


Company offices may be left mostly empty with a skeleton crew, and access being granted to maintenance staff or a few lone employees who may still be carrying out basic operations or some who may have just needed to return to pick up something from their desk to help them work better from home.  This means the employees, cleaners, and other staff will be largely unsupervised and may have easy access to areas not normally permitted...

When reviewing your security during this period, here are some very important points to consider:
  • How secure was your facility during the down time?
    • Note what areas were weakened, where was less manpower deployed?
  • Who continued to have access?
    • What types of staff were still given access? Were employees still allowed back in?
  • Were any private or classified areas left open and unattended?
    • Pay particular attention to board rooms, conference areas, and C-suites. Look for any signs of unauthorized activity.
  • What incidents may have occurred during the period? 
    • Review logs of any security incidents, look for any correlations that could indicate suspicious activity.
  • Were there any areas accessed by unauthorized personnel? 
    • Investigate thoroughly any reports of employees found in unauthorized areas.
  • Did any break-ins or vandalism occur?
    • Security breaches or other incidents could be used as a cover for actual espionage activity. If a break-in or theft was reported, pay attention to any nearby areas that may have been accessed as well.
After returning to your offices, pay close attention to anything that has been disturbed, anything that may have been tampered with. Any indication of unauthorized access to offices or secure areas should be investigated thoroughly. Electronic sweeps of critical offices and confidential areas should be scheduled. more