Pandemics are fairly rare, so organizations may not give them as much attention as other kinds of potential business interruptions. That means that pandemics such as COVID-19 (Coronavirus) can catch them unprepared. Of course, pandemic planning is highly dependent on the type of organization that is involved. This makes appropriate policies and procedures very different for different organizations.

Close contact (within 6 feet) between individuals is the number one factor in the spread of pandemic viruses. Any business environment that brings people into close contact are the most susceptible to the flu. For example, essential job types such as health care workers and first responders are obviously at very high risk since they are dealing directly with affected persons in many instances. Other businesses that are essential for day to day living such as banks, grocery stores and other retail organizations also pose a high risk of infection to customers and employees. After all, people in these businesses pass closely by one another, and what is worse, must stand in line to pay for their purchases or to do their banking business. Employees such as tellers or check out/counter workers have it worse since they must come in close contact with a large number of different people during the day.

Protecting yourself and your staff is most problematic for such organizations and workers. This is largely because of the manner in which flu viruses are transmitted. The number one vector is droplets from coughs or sneezes. These are introduced into the environment by people that don’t or can’t cover their mouths and noses when they cough or sneeze. If these droplets are inhaled or get in your eyes you may become infected. More insidiously, coughs or sneezes can also produce micro-droplets or aerosols. These can be so small that they are largely unaffected by gravity and may waft about the environment for some distance, and can even be small enough to penetrate dust masks and tissues. These are very hard to protect against, requiring high efficiency respirators/masks and face shields or goggles. In addition, infection may also be possible from touching infected surfaces and then touching your eyes, nose or mouth.

There are also many non-essential organizations or businesses that pose a high to medium risk of infection by pandemic viruses. These include concert venues, airlines, conventions, casinos, cruise ships, churches, and other venues where people are in close contact. There is an answer for these organizations, as unsavory as it is: simply cancel these types of gatherings. Unfortunately, the economic consequences of canceling such things can be very high (as can be seen in the recent downturns of the stock market). On the bright side, pandemics are usually of fairly short duration. This allows most businesses and organizations to recover once the threat has passed.

In contrast to these types of organizations are those that have little or no interaction with the public or suppliers. For example, offices and organizations that provide services over the internet or telephone are considered to be at low risk. They basically have to worry most about infection spreading among their employees. Fixes for these types of organizations include teleworking (preferred), employee awareness training, putting barriers or distance between employees, mandating that workers who are sick (or who suspect that they may have been infected) take sick leave/work remotely and ensuring that basic health and sanitation measures are in place at the workplace. In addition, anyone who becomes sick at work should be provided with a face mask and sent home or to a health care facility immediately. Businesses should also pay special attention to personnel that live with or have close contact with those who are at very high risk such as health care professional. These personnel should work remotely or should be tested for infection if at all possible. The latest studies suggest that Coronavirus may possibly be spread by infected people that do not yet have symptoms, or those whose symptoms have disappeared.

The number one rule for all people is this: if you are sick or think you may have been exposed to a pandemic virus, stay away from other people. If you must interact, wear a face mask (N95 or better if possible) and clean your hands often. And remember, you should continue to be careful for some time after your symptoms disappear. You may still be infectious.

One thing I notice while doing information security work is that organizations tend to segment IT responsibilities into separate departments or areas of responsibility. There will be employees or groups responsible for networks, applications, servers, desktops, databases, help desks and information security. This is perfectly understandable given the complexity of handling even modestly-sized information systems. Such specialization allows individuals or groups to concentrate on their areas of responsibility and become efficient and expert in their specialties.

However, this very segmentation of duties usually has a big downside for information security at such organizations. The problem is that for an information security program to be successful it must be managed in a holistic manner, accounting for and amalgamating each mechanism and process in the entire program. If not, neglected systems or systems that are misconfigured for the environment occur and suddenly there are exploitable security holes in the network. And like a dike holding back the sea, just one hole can lead to disaster. That is why it is imperative that each IT function be fully aware of what all the other IT functions are doing. In other words, they need to communicate among themselves in an inclusive and professional manner.

Unfortunately, human weaknesses such as ego, hubris, complacency and ignorance come into play when trying to facilitate such intercommunication. Often in the organizations I’ve worked with, the information security department is well aware of the problems I detailed above but are helpless to correct them. This is because IT security departments are usually treated like poor relatives by the other IT departments and senior management. They just don’t have the clout needed to get their programs and processes implemented in an effective manner. To other IT departments and management, information security processes are just a roadblock to functionality and a drain on the budget.

Or perhaps, even if IT and senior management are interested in backing information security, the corporate processes in place for requesting and implementing changes to network systems and processes are so ponderous and full of contention that they lose all effectiveness. It may take weeks or months to implement one simple policy change for example.

That is why I champion the need for a C-level individual (or group) to deal with the problem. I would call them information security coordinators or something similar. Their job would be to bring departments together to discuss what they do and how it could affect the security of systems and information. It would also be their job to coordinate this information and identify holes in the information security program. With C-level authority, they can then better remediate the identified problems without undue bureaucratic entanglement or having to deal with rice-bowl mentality. One thing I learned well when I first started in this profession is that without senior management backing and approval, an information security program is going nowhere!

More and more businesses are allowing the use of mobile devices for business purposes. Mobile/portable devices used for business are not only laptops and smart phones, but include devices such as meter readers, bar code scanners, medical devices and PDAs. Most of these devices communicate remotely using wi-fi, Bluetooth or cellular communications. They can also contain a variety sensors and mechanisms such as microphones, cameras, radios and GPS systems. Just looking at this list of capabilities, it is obvious that mobile devices can be very dangerous to the security of private business information.

Whether these devices are the property of the individual user or are issued by the business, robust security mechanisms must be maintained to provide any sort of proper data protection. That means designing and implementing both mobile device security policies and technical security mechanisms.

Mobile devices security policies should address the responsibilities of both the hosting organization and the individual users. The hosting organization is responsible for determining what types of mobile devices are acceptable in their environment, which individuals/job types should be allowed to use them, which individuals will implement and oversee the program, proper training programs for providers and users, acceptable and unacceptable use of devices, security and monitoring techniques and discipline measures for failure to comply. They should also ensure that mobile device use is included in their incident response and disaster recovery programs.

Technical security measures may vary according to the types of devices in question and how they are to be used. On the less dangerous side are personal mobile devices such as smart phones used by individuals for tasks such as web surfing and social media. To protect their information, the organization should set up separate networks for such use that in no way connect to their production networks. They should employ security mechanisms adequate to protect the network and users, and should ensure that users understand the acceptable and unacceptable uses of this privilege.

On the other side are those mobile devices that are used for processing, storing or transmitting private business information. Use of these devices should employ security mechanisms commensurate with those used on the internal network. There are many mobile device management (MDM) solutions out there designed to aid businesses in this endeavor. However, ultimately, information security is the responsibility of the organization itself, not the managed services or application providers. Because of this, those executives and line personnel responsible for the program should have a clear understanding of the capabilities of the mobile devices and security solutions that are available, and the particular uses that mobile devices will be performing in their environment. To be sure that your business is getting this right, I suggest taking the time to perform research of the devices and security solutions available followed by risk assessment and business impact analysis. Like a good pair of shoes, they should be a perfect fit!

If you have any questions, comments or would just like to talk more about it you can reach us at info@microsolved.com.