Cyber

risk alert

Cyber security in the time of coronavirus

Changing working patterns Key security advice when building

With the ongoing spread of coronavirus, government guidance is remote capacity
changing rapidly. In many countries, healthy individuals are being In this spirit, S-RM has listed below some key areas to consider
asked for the first time to avoid unnecessary public exposure, for when planning or deploying remote working capabilities.
example at large gatherings, on public transport … and in the
workplace. Securing devices
One key consideration for remote workers is that they have
As a result, many businesses around the world are now either laptops, mobile phones, tablets or other devices to work from.
planning for or actively implementing a business model involving Many companies are now issuing additional equipment to their
far more remote workers than they had ever anticipated. IT and workers, to allow them to remain fully effective outside the office.
management teams are hard at work on the infrastructure and But please be aware of the following:
organization to facilitate this. In the rush to keep businesses
working, there is a significant risk that security will not be Make sure you have effective asset management in place. Know
properly thought through. what devices have access to your network and data, plan for any
changes, and block or remove obsolete equipment from your
Good business cyber security practices, under any circumstances, network before it becomes a weak point in your security.
should consider the following:
ƒ Is the technology and infrastructure deployed secured against All company devices, especially any device taken outside the
malicious actors, outside and inside the organization? office, should be encrypted, protecting data if they are lost or
ƒ Do all company employees, subcontractors and relevant third stolen.
parties have clear instructions and guidance on how to ƒ Use BitLocker or a suitable third party solution for Windows
conduct their work in a secure manner? devices
ƒ Do any of the security measures in place block employees from ƒ Make sure encryption is active on Apple devices (it normally is!)
conducting their work efficiently? ƒ Make sure appropriate encryption is in place on other mobile
devices
If the right level of security is in place, your business will be well-
placed to fend off cyber security threats. Too little, and you are
vulnerable. Too much security, applied in the wrong ways, and
your employees will feel stifled and start finding workarounds, Continued 
ultimately still leaving the business vulnerable.
 Cyber Security in the time of coronavirus  Page 2

Individuals and businesses worldwide are now

being targeted by phishing campaigns designed to play
on fear of the virus and of the lack of reliable information
on the outbreak.

If you allow employees to use their personal devices, consider ƒ Strong authentication. The next step in securing any access
whether your corporate data is appropriately secured. Mobile is to ensure that strong password policies and multi-factor
Device Management solutions may allow you to secure data on authentication are enforced. Enforced strong password policies
these devices, or you may need to restrict what employees are are a must for all services, not just those that are meant to be
allowed to access in the first place. publicly accessible. Multi-factor authentication should be used
as much as is practical for your business. Remember that there
Don’t forget about the equipment that is still in the office! With are many types of authentication; while text messages might
employees working from home, is there sufficient physical seem like the path of least resistance, if you have time to set up
security at your sites to protect servers, desktops, and other parts an authentication app your business will be much more secure,
of your network from malicious actors? while device-based authentication might be appropriate in
places to reduce frustration for employees.
As you move devices, employees and user accounts around, don’t
forget the other parts of day-to-day security preparation – strong ƒ Think of everything. To secure a network, you have to
passwords, secured and appropriate local administrator accounts, consider all the different ways it can be accessed. How are your
and control over the applications and services on your network employees accessing their mailboxes from their mobile devices?
are just as important as ever, to name a few. Do employees need to connect to operational technology such
as factory equipment (and is it safe to let them)? How is remote
Securing your networks desktop access into your network structured? If you fail to
If your endpoints and your servers are both appropriately secured, secure these, you create vulnerabilities; if you fail to facilitate
it’s important to make sure the two can connect! Access to your them, you prevent employees from working.
network should be easy for legitimate users, but blocked (or at
least very difficult) for everyone else. Consider the following: Securing employee connections
The network may be thoroughly secured at your end, but that
ƒ Method of connection. Well-configured VPN clients on all data has to come from somewhere. As employees are based
employee devices allow secure access to the network through outside your secure environment, it is often up to them to make
a private tunnel. Other secure access solutions will be available sure they are acting appropriately. You can help by providing them
for particular use cases. If you need employees to achieve with suitable guidance (as discussed further below) on topics like:
access from the open internet, are they connecting to a
particular external firewall, or a well-managed cloud service ƒ Setting up home wifi. Ordinary home users often neglect
like Office 365? When planning user access, try to limit as far as basic security when setting up their home environments. You
possible the exposure of additional areas of your network to the can help your employees with simple advice backed by senior
internet and its many threats. leadership. Basics like changing network name and access and
administrator credentials are key, and employees should also
ƒ Restricting access. Many types of connections can be ensure appropriate network encryption is in place, remote
configured to further secure them against malicious actors. If access is disabled, and that the software is kept up-to-date.
you are using a cloud service like Office 365, consider restricting
access where possible to particular devices, particular IP ranges, ƒ Accessing other networks. You may want to consider providing
or to particular types of connections. Firewalls and other guidance to your employees about (not) using public wifi, about
services will offer many similar options for carefully managing how network names can be spoofed, and how man-in-the-
access rules. Consider restrictions inside your network too; middle attacks can be launched on public wifi networks. A lot
preventing connections or user accounts from going beyond of the guidance on using public wifi for business purposes is
certain areas will reduce the risk from one unsecure employee now very similar, but by specifically setting out your own rules
or unforeseen vulnerability. and guidelines you can make sure your employees have a clear
understanding of best practice. Don’t forget to mention the
other risks of working in public places, relating for example to
Bluetooth connections and to simple over-the-shoulder spying.

Continued 
 Cyber Security in the time of coronavirus  Page 3

ƒ Communications channels. Make sure your employees have

a clear understanding of how they should communicate with
you, with third parties and with each other. Make clear that
Make sure employees are clearly
work emails should be confined to work accounts, and which informed, at least a week in advance
messaging services they should use (do you have a specific
business solution, or are they on WhatsApp?). If you don’t
if practicable, about what devices they
make sure there are clear lines of communication available, can use, what services they can access,
before long your employees might well be texting each other
passwords or customer names, with all the attendant risks. If
and how they should do so.
you do provide clear solutions, you can effectively monitor them
for any potential threats, for inappropriate data movement, and
for other business purposes.
Communications of this type are not just a matter for technical
ƒ Watch out for Coronavirus phishing. As with other major world IT or Cyber Security teams. Communication with employees
events, the COVID-19 outbreak represents an opportunity for regarding remote access should be overseen by executive
malicious actors, from simple scammers to government-backed management-level staff. While the technical teams can provide
hacker groups. Individuals and businesses worldwide are now the appropriate solutions and guidance that employees need,
being targeted by phishing campaigns designed to play on this information needs to be effectively prepared and packaged
fear of the virus and of the lack of reliable information on the so it can be delivered in clear and simple language, using an
outbreak. Extra vigilance should be exercised by all regarding appropriate method, and at an appropriate time. Importantly,
any communication, hyperlink, attachment or request for the guidance or policy should be clearly backed by the senior
information relating to coronavirus. Warning your employees leadership of the organization, to ensure that it has the authority
about this will reduce the threat to them and to you. and clarity needed to convince employees to follow the advice
given.

As much as practicable, make sure you provide sufficient

Individuals and businesses worldwide information to third parties as well, including any customers who
are now being targeted by phishing need to access your network. They will also need to know how to
contact you, how to access relevant services and infrastructure,
campaigns designed to play on fear and what you expect from them in terms of their own security.
of the virus and of the lack of reliable Make sure your planning and requirements are clearly in place,
then let them know clearly and decisively what you want – and, if
information on the outbreak. the situation changes, consider when it will be most effective to
update them.

Planning for the worst

Informing your employees Any cyber security professional knows that no one is ever
The points above are all important areas where you can provide absolutely safe from a malicious attack. Combining the increased
guidance to your employees, but in fact clear and effective exposure from remote working with the confusion and short
communication is one of the most important steps you can take in deadlines of responding to the changing coronavirus situation
any area. Even if you have a clear plan and a secure infrastructure only increases that risk.
in place, without clear information employees will make mistakes,
or else assume you don’t have a plan and start taking (potentially If you have effective cyber incident response, crisis management
unsecure or counterproductive) measures of their own. and/or business recovery plans in place, it is important to review
them in light of your new operating environment. Can you access
Make sure employees are clearly informed, at least a week in all the equipment you will need to test or reset? Is your data still
advance if practicable, about what devices they can use, what being backed up to a secure site? Can your users still effectively
services they can access, and how they should do so. Keep them report phishing or other indicators of cyber incidents? How are
up to date if this changes. Some employees may not have the you going to maintain communication between the key crisis
access they need; you need to find a solution before they come up managers if all your laptops and mobiles get encrypted with
with their own! If access isn’t in place yet, employees should know ransomware? If your plan isn’t tested yet, now may be the wrong
when implementation is planned so they can act accordingly, and time to start – but at a minimum do all the relevant staff at least
if at all possible, what alternative solutions are available in the have a clear understanding of the plan, and how your current
interim. situation has altered it?

Continued 
 Cyber Security in the time of coronavirus  Page 4

If you don’t have these plans in place, you likely don’t have time
to build them right now, but it is important to at least consider
the basics. Do you know where your key data is stored? Do you
If you have effective cyber incident
know what services are key to your business survival? Do you have response, crisis management and/or
backup communication channels, independent of your network?
Do you have similarly separated, and regularly updated, data
business recovery plans in place, it is
backups? important to review them in light of your
Most of all, in your current situation – who will be needed to
new operating environment.
respond to a crisis? Who else needs to be informed? How are they
going to coordinate, and who will replace them when they need to
get some sleep?

Evolving
As stated earlier, the global situation, and advice from
governments, is changing rapidly. As time passes, businesses
may have more time to implement additional measures and
better adapt to the new situation; or new events may force them
to continue to react. In either position, please bear in mind the
following:
ƒ Cyber security should be a part of your IT and business
planning, not something added on at the end where it will be
ineffective or will get in the way
ƒ Always keep your eye on the prize of your key data, assets and
services that need protection
ƒ Always consider your whole network or organization –
be careful not to miss gaps in your defenses, or legitimate
About the authors
John Coletti is Chief Underwriting Officer & Head of North America
business needs that you are inadvertently blocking
Cyber and Technology for AXA XL, a division of AXA. He can be
ƒ Communicate with your employees – use clear and simple
reached at [email protected].
messaging, make sure the information provided is well-founded
Aaron Aanenson is director of cyber security for S-RM. He can be
and authoritative, and explain how they should act in order to
reached at [email protected].
do their jobs effectively

To learn more, contact your AXA XL Cyber S-RM is a global consultancy that helps clients manage
underwriter. regulatory, reputational and operational risks.

The information provided to you in this document is confidential and prepared for your sole use. It must not be copied (in whole or in part) or used for any purpose other than to evaluate its contents. No
representation or warranty, express or implied, is or will be made and no responsibility or liability is or will be accepted by S-RM, or by any of its respective officers, employees or agents in relation to the accuracy or
completeness of this document and any such liability is expressly disclaimed. In particular, but without limitation,no representation or warranty is given as to the reasonableness of suggestions as to future conduct
contained in this document. Information herein is provided by S-RM Intelligence and Risk Consulting LLC on our standard terms of business as disclosed to you or as otherwise made available on request. This
information is provided to you in good faith to assist you in mitigating risks which could arise. No implied or express warranty against risk, changes in circumstances or other unforeseen events is or can be provided.
S-RM Intelligence and Risk Consulting LLC accepts no liability for any loss from relying on information contained in the report. S-RM Intelligence and Risk Consulting LLC is not authorised to provide regulatory
advice.
AXA XL is a division of AXA Group providing products and services through three business groups: AXA XL Insurance, AXA XL Reinsurance and AXA XL Risk Consulting. In the US, the AXA XL insurance companies
are: AXA Insurance Company, Catlin Insurance Company, Inc., Greenwich Insurance Company, Indian Harbor Insurance Company, XL Insurance America, Inc., XL Specialty Insurance Company and T.H.E. Insurance
6366_03/2020

Company. In Canada, coverages are underwritten by XL Specialty Insurance Company - Canadian Branch and AXA Insurance Company - Canadian branch. Coverages may also be underwritten by Lloyd’s Syndicate
#2003. Coverages underwritten by Lloyd’s Syndicate #2003 are placed on behalf of the member of Syndicate #2003 by Catlin Canada Inc. Lloyd’s ratings are independent of AXA Group. Not all of the insurers do
business in all jurisdictions nor is coverage available in all jurisdictions. Information accurate as of March 2020.
AXA, the AXA and XL logos are trademarks of AXA SA or its affiliates. © 2020