Business Recovery and Continuity in a Mega Disaster：Cybersecurity Lessons Learned from the COVID-19 Pandemic

The COVID-19 pandemic has had so many unprecedented consequences. The great global shift from office work to remote work is one such consequence, with which many information security professionals are struggling. Office workers have been hastily given equipment that has not been properly secured or must use personal devices to perform office work. The proliferation of videoconferencing has brought about new types of cyber-attacks. When the pandemic struck, many organizations found they had no, or old and unworkable, business continuity and disaster recovery plans.

reviews the COVID-19 pandemic and related information security issues. It then develops a series of lessons learned from this reviews and explains how organizations can prepare for the next global mega disaster. The following presents some of the key lessons learned:

• The lack of vetting for third party suppliers and vendors
• The lack of controls surrounding data privacy, especially as it relates to the personal identifiable information (PPI) data sets
• The intermingling of home and corporate networks
• The lack of a secure remote workforce
• The emergence of supply chain attacks (e.g., Solar Winds)

To address the issues raised in these lessons learned, CISOs and their security teams must have tools and methodologies in place to address the following:

• The need for incident response, disaster recovery, and business continuity plans
• The need for effective penetration testing
• The importance of threat hunting
• The need for endpoint security
• The need to use the SOAR model
• The importance of a zero-trust framework

This book provides practical coverage of these topics to prepare information security professionals for any type of future disaster.

The COVID-19 pandemic has changed the entire world to unprecedented and previously unimaginable levels. Many businesses, especially in the United States, were completely caught off guard, and they had no concrete plans put into place, from a cybersecurity standpoint, for how to deal with this mega disaster. This how-to book fully prepares CIOs, CISOs, and their teams for the next disaster, whether natural or manmade, with the various lessons that have been learned thus far from the COVID-19 pandemic.