Key Cybersecurity Takeaways in a Hybrid Landscape

Engaging in a Cybersecurity Discussion at the Maryland Virtual Digital Government Summit

A University for Maryland study found that a cybersecurity attack happens every 39 seconds, leading to about 2,000 attacks every day. I recently joined IT colleagues at the Maryland Virtual Digital Government Summit alongside Ciena's Matthew Otwell and Maryland's Daniele Loffreda for a panel discussion on cybersecurity. Matthew, Daniele, and I discussed crucial aspects of cybersecurity as demand for cybersecurity has increased rapidly in the past year due to the COVID-19 pandemic. Although it would be nearly impossible to eliminate all cybersecurity attacks, providing resources to fight against them will significantly lower the number of successful attacks. Security experts must continuously learn new ways to prevent attacks and share their knowledge to improve security within their organization and across government agencies.

Recently U. S. President Biden issued National Security Strategic Guidance to prioritize security. The Biden Administration is looking to ensure that all American citizens are protected from cybersecurity attacks, breaches and other unintended consequences of the current environment. The White House wants to modernize and create an innovative country that can conquer cyber challenges without hesitation. The White House is prioritizing partnerships to develop an increased level of cybersecurity. The Department of Homeland Security's Cybersecurity and Infrastructure Security Agency (CISA) is increasing the required minimum spend on cybersecurity through FEMA grant awards, including accelerating state and local government agencies' critical improvements to fund these efforts.

Security in the hybrid landscape

Several agencies have announced a new hybrid working environment where employees may spend part of the week at the office and part of that week working remotely. Moving to a remote work location introduces a whole new set of cybersecurity challenges. During the panel, we discussed rapidly growing security worries in a "work from anywhere" landscape. For example, some employees may choose to log in from the public unprotected WiFi of a local coffee shop. There have also been reports of employees traveling to foreign destinations and logging into agency systems from outside of the United States in violation of agency data policies. While this may be convenient for the employee, unprotected or foreign networks can expose sensitive data to malicious actors. Care must be taken to prevent access to the most sensitive data from public, unsecured networks. The panel also discussed that the virtual backgrounds used during online calls prohibit managers and coworkers from seeing a work location and who may be listening to a confidential call.

Secure applications

Security and data breaches can occur on devices beyond a computer or a phone. Printers, routers, and home WiFi can also be at risk. The panel members and I considered each of these devices as entry points of access for attackers. Forbes contributor Carrie Rubinstein mentions that employees must be aware of the strength of their password, who knows it, and who is seeing it typed in. Many companies have begun using fingerprint readers and Multi-Factor Authentication (MFA) to create a more secure environment. These applications allow for increased security and efficiency when logging into devices — even from remote destinations. Cybersecurity is a continuous improvement cycle, and with modernization, new developments can be created to stop breaches.

Training for success

The panel and I spoke in detail about employees being the first line of defense for the company against cybersecurity attacks. When an employee believes they may have come across suspicious emails or alerts on their devices, they must immediately report it to stop the spread to other employee devices. Training for leaders and employees can be extremely different, but both are important in establishing a proactive cyber posture. Training is a part of the continuous improvement cycle. As hackers become more competent and security becomes stronger, training must become more extensive. Daniele had an excellent suggestion that training should include testing to ensure that employees and managers are adequately educated.

Being alert for out of the ordinary actions

Phishing (or email sent from hackers intended to attack the computer by tricking the reader into participating in unsecure actions) is one of the leading cybersecurity breaches. In a remote work environment, these incidents are increasing as the hybrid landscape is more accessible. Hackers have become much more sophisticated, and users need to be on the lookout for potential attacks. For example, the slightest difference in email format or language might be a telling sign that an attack may occur. If an email is addressed with the recipient's first and last name or the language has incorrect grammar, there is a significant chance that a hacker sent the email. The previously cited Forbes article lists three risks to be aware of during the transition to hybrid work. One of them is phishing. Rubinstein states, "Phishing attacks are largely recognized as the top cause of data breaches."

Partner with federal leaders

Government must develop better security measures to support remote and hybrid work. Security threats are increasing in frequency and potency, especially throughout the pandemic. The Federal government has instituted significant security measures over the years, but State and Local governments have limited cybersecurity. To beat hackers, the government needs to be vigilant and stay ahead of cybersecurity threats to keep at least one step ahead.

Constantly improving security

Security must be a dynamic process of continuous improvement. There is a constant need for new ideas in cybersecurity. As hackers develop increasingly innovative ideas, security experts need to create new ways to implement secure landscapes. Events and dialogue — such as the Maryland Digital Summit — allow IT professionals to engage and share best practices so that collectively we can protect our networks and state and local governments.

Explore more about NTTDATA's cybersecurity services for government.