Month: July 2020

The Cybersecurity and Infrastructure Security Agency (CISA) has released Teleconferencing Guidance for education.  Remote classroom teleconferencing has continued to grow.  As a result it has been a tempting target for cybercrime.

Recommendations for K-12 Schools

School districts are increasingly using teleconferencing tools to deliver their services.  These tools have increased in availability and capability.  Their use however, comes with risk as the volume and sophistication of cybercrime continues to grow.  As a consequence, schools and school districts must assess risks to both school IT networks and individual users.

Threats to Teleconferencing

Cyber threats are posed by nation-states, criminal organizations, and people inside an organization.  Common tactics used include:

• Exploiting unpatched software vulnerabilities.
• Eavesdropping.
• Hijacking video teleconferencing with inappropriate content.
• Use of teleconferencing applications to infiltrate other applications.
• Penetrating sensitive meetings through social engineering to deceive people into divulging private information.
• Some products may share or sell customer information to third parties.  This data sharing can unintentionally expose student and school information.

Teleconferencing Guidance for Teachers and Students

CISA guidance for teachers and students include:

For Teachers

1. Only use organization-approved software and tools to host and schedule meetings.
2. Consider sensitivity of data before exposing it (via screen share or upload) to video conferences. Ensure that only data needed to be shared is visible.
   • Close or minimize all other windows and consider turning off alerts for incoming messages.
   •  If displaying content from organizational intranet sites in public meetings, hide the address bar from participants before displaying the content.
   • Use common sense—do not discuss content you would not discuss over regular telephone lines.
   • When having sensitive discussions, use all available security measures.
   • Ensure all attendees of the meeting are intended participants.
3. Do not attempt to install software not approved by your school.
4. Do not make meetings public unless they are intended to be open to anybody.
5. Have a plan for what circumstances constitute termination of a meeting, who has the authority to make that decision, and how the meeting will be terminated.
6. Require passwords and use a waiting room to control admittance of guests.
7. Provide links to meetings directly to specific people and share passwords in a separate email.
8. Manage screensharing, recording, and file sharing options. Limit who can share their screen to avoid any unwanted or unexpected images. Consider saving locally versus to the cloud.  Change default file names when saving recordings.  Make sure to consult with your organization or district’s counsel about laws applicable to recording video conferences and sharing materials through them

For Everybody

1. Make certain that your audio and video surroundings are secure and do not reveal any unwanted information.
2. Move, mute, or disable virtual assistants and home security cameras.  Do not conduct meetings in public places.  Consider using headphones.
3. If using a personal device
   • Require passwords to log in to device.
   • Only use elevated privileges when performing administrative functions on the device.
   • Close all non school related windows before and during school activities.
   • Keep operating systems and relevant applications up to date.
   • Turn on automatic patching and Anti-Virus software.Check and update your home network.  Use complex passwords for your home Wi-Fi network.  Enable router with encryption protocols such as WPA2 or WPA3.  Disable legacy protocols such as WEP and WPA.
4. Check and update your home network.  Change default settings and use complex passwords for your broadband router and Wi-Fi network and only share this information with people you trust. Choose a generic name for your home Wi-Fi network to avoid identifying who it belongs to or the equipment manufacturer. Update router software and ensure your Wi-Fi is encrypted with current protocols (such as WPA2 or WPA3), and confirm that legacy protocols such as WEP and WPA are disabled.
5. Be wary of links sent by unfamiliar addresses, and never click on a link to a meeting sent by a  suspicious sender. Verify that meeting links sent via email are valid.
6. Do not share student credentials or links, with strangers who may use them to disrupt classes or steal information. Do not share passwords with anyone.
7. Carefully review meeting invitations sent for sessions. Check to see if the meeting originated from a known teacher or other school employee.  Verify that the address has the district’s or school’s name in the URL.

Teleconferencing Guidance and Cybersecurity Practices for K-12 Organizations

CISA recommends the following Security Practices for K-12 Organizations:

• Assess organizational needs and determine the appropriate products.
• Establish organizational distance learning policies or guides to address physical and information security.  Based on these documents, develop easy to understand (e.g. one-page) summaries for teachers, students, and parents.
• Limit and minimize the number of authorized collaboration tools to reduce the overall amount of vulnerabilities.
• Maintain the latest versions of software and remove all obsolete versions from managed devices.
• Instruct users to join web (browser) based sessions that do not require installation of client software. 
• Prohibit end users from installing client software on school- or district-managed devices.
  (including removing local administration rights).
• Prevent system administrators from using collaboration tools on the system while logged on with administrative
  privileges.
• Prohibit the use of collaboration tools and features that allow remote access and remote administration.
• Clearly educate employees legal, privacy, and document retention implications of using teleconferencing tools.

CVG Strategy

We all have family and friends who are teachers, students, or education administrators, and we acknowledge the difficulties they are enduring during this pandemic.  Therefore we are providing this Teleconferencing Guidance for education for our community.

CVG Strategy cybersecurity experts are committed to keeping organizations’ information secure.  We help businesses and organizations implement ISMS solutions that fit unique requirements and provide the training required to make them work.  Contact Us today to see how we can help.

Business Executives Have Concern About Remote Workplace Cybersecurity

Remote Workforce Cybersecurity is a growing concern for businesses who are adapting to the Covid-19 pandemic.  Although many tools are available to secure vital data, the remote employee still poses the greatest threat.  The challenge therefore is to train employees how to regularly use effective cybersecurity practices.

Effective IT Tools and Policies

A number of tools are available for cybersecurity.  These include the use of Virtual Personal Networks (VPN)s, encrypted data protocols, dual authentication, and providing employees with properly set up equipment.  Policies can also help to mitigate cyber vulnerabilities.  These include prohibiting data from being on employees’ personal devices and establishing protocol for meeting software usage.  All of these, however are only as effective as the daily habits of the employees that are accessing secure data.

Information Security Management Systems

An Information Security Management System (ISMS) is  a comprehensive approach to keeping corporate information secure.  It involves people, processes, and IT systems to coordinate business security efforts.  ISO 27001 (ISO/IEC 27001) is a standard for developing an ISMS that ensures comprehensive integration of internationally recognized best practices.  Because it employs risk management and continual evaluation for improvement it is a dynamic tool capable of adapting to a cyberthreat environment that is growing in scale and complexity.  As with any management system, continual training is critical for effective implementation.

Improving Remote Workforce Cybersecurity Practices

Although cyber-criminals are using increasingly sophisticated tools phishing remains a leading form of attack.  Employees should be trained to think before they click on suspicious emails and links.  Other basic practices include proper password etiquette.  Passwords should be should be strong and unique.  Follow this link for The National Institute for Science and Technology’s guidance on Choosing and Protecting Passwords.

People can be brilliant and still not regularly practice common sense.  Instilling good practices involves continual education.  While it is easy to point the finger elsewhere, you may well ask yourself how well you practice cybersecurity basics.  To find out take the Federal Trade Commission Cybersecurity Basics Quiz.

CVG Strategy

CVG Strategy cybersecurity experts are committed to keeping business information secure.  This is more critical than ever as remote workforce cybersecurity practices increase vulnerability.  We can help your business implement ISMS solutions that fit your unique requirements and provide the training required to make them work.  Contact Us today to see how we can help.

IBM Security has released its organizational cyber resiliency report for 2020.  This year’s report, based on research from the Ponemon Institute is based on a survey of IT and cybersecurity experts from around the world.  The National Institute of Science and Technology (NIST) defines cyber resiliency as a merging of systems engineering, resilience engineering, and systems security.  Its goal is to develop systems with the ability to anticipate, withstand, recover from, and adapt to an increasingly hostile cyber environment.

Key Takeaways from the Cyber Resilient Organization Report

IBM’s organizational cyber resiliency report is an extremely detailed analysis of the current situation.  There are however, many key takeaways that can provide guidance for businesses attempting to critical cyber concerns.

Cybersecurity Incident Response Plans

Most organizations surveyed had suffered business disruptions during the last two years.  While it’s impossible to thwart every attack a well developed plan can greatly mitigate the effects.  Because the amount of cyber threats has markedly grown, many organizations have implemented Cybersecurity Incident Response Plans (CSIRP).  Effective CSIRPs involve all levels of an enterprises.  They include regular reporting to C suite stakeholders and incorporate regular reviews.  This is consistent with a well developed Information Security Management System (ISMS) such as ISO 27001 or NIST 800-171.

Automated Tools for Cybersecurity

Most participants reported that they had accomplished better resilience by employing automation tools.  Organizations that noted effectiveness used more than 20 tools when investigating or responding to a cybersecurity incidents.  While these tools can provide security, organizations that used too many tools (over 50) reduced their effectiveness.  These tools included technologies such as analytics, automation, AI, and machine learning.

Improved Cloud Service Implementation

More than two-thirds of companies in the United Kingdom, Germany, France, the United States and Canada sited value in the the use of cloud services.  These included organizations in healthcare, retail, and public sectors.  The leading reasons given for improvement due to cloud services were the benefits of leveraging a distributed environment, economies of scale, and availability of service level agreements.

It is important to note however, that poorly configured cloud services can severely endanger an organizations data security.  About a third of respondents reported negative results from investing in cloud services.

Sharing of Threat Intelligence

While a majority of participants agree that sharing intelligence with government and industry peers provides benefit, most do not share information.  Among reasons given were a lack of resources and cost.

CVG Strategy Cybersecurity Consulting

CVG Strategy cybersecurity consultants can help you tailor and implement effective CSIRPs that:

• Incorporate all sectors of an enterprise.
• Provide reporting to and participation of executives.
• Identify top threats to your specific industry and assess risks.
• Develop accelerated responses to specific attack types.
• Optimize the implementation of automated technologies.
• Incorporate regular reviews for evaluation and process improvements.

Contact Us today to see how our team of experts can bring their extensive experience to improve your cybersecurity processes on time and on budget.