BTB Security's statement and security guidance - COVID-19

To our valued customers,

There is no higher priority than the safety of our customers and employees. We are in close communication with medical professionals and have been closely monitoring direction from the Centers for Disease Control (CDC), the World Health Organization (WHO), government agencies, and external advisors to stay on top of this evolving situation.

Initially, we were maintaining a liberal work from home policy, and a stringent “sick policy” at BTB Security. In preparation, BTB Security took measures to ensure that 100% of staff, including threat operations had the ability to work from home. As of 3/19/2020 at 7 AM EST, all BTB Security staff have been operational from home.

We’re continuing to monitor the coronavirus situation, as well as how our customers are reacting to it, to be flexible with the needs of both our customers and employees. We’ve invested in the processes and tools that make it easy for any or all our employees to work remotely anywhere, so we’re looking at a minimal impact operationally.

Please contact us directly with any additional questions, and as always take care.

Guidance on working from home for our clients:

  • Know your data - ensure the business understands what data employees leverage, where it is, and how the employees access the data. How can you protect what you aren’t aware of?
    • Consider the potential usage of non-sanctioned technologies (e.g., non-corporate file sharing services like a Dropbox or Google Drive)
  • Reinforce awareness principles – mature organizations have already been communicating with their employees on IT and InfoSec hygiene, use this as an opportunity to remind employees that the threats remain, just in “some different clothes” (e.g., using Coronovirus in the phishing email subject).
  • Stress IT Hygiene – keep systems up-to-date, security tools installed, and when available, leverage VPNs to increase corporate control.
    • NOTE - VPNs alone do not necessarily protect the asset, rather when supported with appropriate controls improve visibility for activities on the asset (e.g., corporate Internet content filter).
  • Continue security monitoring – maintain visibility for security threats, investigate and respond. Use this as an opportunity to identify gaps in visibility, and invest time in closing those gaps.
  • Consider risks of rapid changes – rapidly deploying new technologies unfamiliar to technical and non-technical staff alike may be necessary (e.g., collaboration tools, endpoint security tools); however, rapid and expansive changes lend themselves to unintentional misuse, abuse, and/or misconfiguration. Balance necessary and immediate investments with education now, and revisit their utilization and function periodically (e.g., weekly, monthly, quarterly).
  • Acknowledge exceptions and provide sanctioned workarounds – this is unprecedented, and employees may get “creative” with corporate assets to educate and/or entertain themselves and their families. This introduces some risk, but the messaging should be balanced and reasonable (e.g., less “finger-wagging” and more “here’s how to go about it”).

Related Posts