Business Recovery and Continuity in a Mega Disaster: Cybersecurity Lessons Learned from the Covid-19 Pandemic
暫譯: 大型災難中的商業復甦與持續性：從新冠疫情中學到的網路安全教訓

The COVID-19 pandemic has had so many unprecedented consequences. The great global shift from office work to remote work is one such consequence, with which many information security professionals are struggling. Office workers have been hastily given equipment that was not properly secured or must use personal devices to perform office work. The proliferation of videoconferencing has brought about new types of cyber-attacks. When the pandemic struck many organizations found they had no, or old and unworkable, business continuity and disaster recovery plans.

Business Recovery and Continuity in a Mega Disaster: Cybersecurity Lessons Learned from the COVID-19 Pandemic reviews the COVID-19 pandemic and related information security issues. It then develops a series of lessons of learned from this reviews and explains how organizations can prepare for the next global mega disaster. Following are some of the key lessons learned presented:

• The lack of vetting for third party suppliers and vendors
• The lack of controls surrounding data privacy, especially as it relates to the personal identifiable information (PPI) data sets
• The intermingling of home and corporate networks
• The lack of a secure remote workforce
• The emergence of supply chain attacks (e.g., Solar Winds).

To address the issues raised in these lessons learned, CISOs and their security teams must have in place tools and methodologies to address the following:

• The need for incident response, disaster recovery, and business continuity plans
• The need for effective penetration testing
• The importance of threat hunting
• The need for endpoint security
• The need to use the SOAR model
• The importance of a zero-trust framework.

The book provides practical coverage of these topics to prepare information security professionals for any type of future disaster.

The COVID-19 pandemic has changed the entire world to unprecedented and previously unimaginable levels. Many businesses, especially in the United States, were completely caught off guard, and they had no concrete plans put into place, from a cybersecurity standpoint, in how to deal with this mega disaster. This how-to book fully prepares CIOs, CISOs, and their teams for the next disaster, whether natural or manmade, with the various lessons that have been learned thus far from the COVID-19 pandemic.