In our second article deep diving into real world security stories disasters, we will discuss one issue particularly relevant in the time of COVID-19 – securely working from home. Have laptop, have home wifi – off we go! But not so fast!
Home internet connections and devices are generally nowhere near as well managed and secured as those in the corporation – and as this real life story points out this can lead to disaster.
What was the security disaster?
In a ‘work from home’ contingency mode, this major retailer sent staff to work from home to avoid corona virus exposure. Out of expedience the customer made the decision to allow staff to connect to the corporate network from home, and work using their personal devices.
This proved to be a disastrous outcome, as the corporate network was exposed to a number of different ransomware / crypto locker variants which destroyed a large amount of data.
This exacerbated what was already a very disruptive period for the customer with lower than normal productivity. After the incident, productivity was reduced to near zero, and data is still being recovered (some may be permanently lost)
Why did it happen?
The customer reacted to a difficult scenario with the right intent, but without considering the security implications of their decisions.
The business did not have a properly considered business continuity plan that both provided the business with ongoing operations, while maintaining appropriate standards.
From a technical standpoint, the customer also did not have access to modern technologies that can impose compliance standards required in order to access corporate resources.
What damage was caused?
Significant loss of productivity and data, followed by a significant period of ‘clean up’ and dealing with the broader implications of getting the business back up and running.
How was it fixed (for the long term)?
Services were migrated to Microsoft Office 365 and compliance policies implemented that require users and their devices to meet policy for certain behaviours and device health.
If you’d like to register for a free high-level consultation on how to ensure secure business continuity for your organisation just Contact Us and we’ll be in touch.
