More organizations are making the shift to remote working environments for their employees due to the current world health crisis. Those organizations and the personnel responsible for security, infrastructure, risk and governance may need guidance.
COBIT® 2019 is an excellent foundational reference for enterprises trying to ensure good governance over critical assets, networks and connectivity, endpoint security and business resilience. Select COBIT objectives and practices, along with cybersecurity best practices, are discussed herein.
Manage Critical Assets (BAI09.02)
“Identify assets that are critical in providing service capability. Maximize their reliability and availability to support business needs.”1
While the physical office is left behind when employees work from home, the network and infrastructure must be maintained and operational. Routine physical services, patch management and preventive maintenance still need to be performed on all devices critical to day-to day business.
COBIT Guidance
- Identify assets that are critical to providing service capability by referencing requirements in service definitions, services level agreements (SLAs) and the configuration management system.
- Communicate to affected customers and users the expected impact (e.g., performance restrictions) of maintenance activities.
- Maintain the resilience of critical assets by applying regular preventive maintenance. Monitor performance and, if required, provide alternative and/or additional assets to minimize the likelihood of failure.
- Ensure that remote access services and user profiles (or other means used for maintenance or diagnosis) are active only when required.
- Monitor performance of critical assets by examining incident trends. Where necessary, take action to repair or replace.
Cybersecurity Guidance
- Physical access—Threat actors may use this as an opportunity to find the gaps in physical security to gain access to critical assets. Ensure that physical protections for critical assets are in place and active.
- Remote access—Remote access to some of these assets may be essential for certain employees. Ensure that these assets have updated access control lists (ACLs) and security services are being monitored.
- Cloud—Keeping critical infrastructure in the cloud alleviates some of the responsibilities of your organization, but there are some key aspects to keep in mind, including:
- Configuration management—Ensure that cloud configurations are up-to-date and secure.
- Vendor management—Review your vendor’s responsibilities for security with these assets and fill in the gaps.
- Multifactor authentication—Require multifactor authentication for workers with access to critical infrastructure, applications or who handle highly sensitive data.
- Continuous assessment—Continuously assess capacity and load balancers to ensure optimal system perform/response.
- Communication—Establish communication lines with the IT help desk to determine any unusual trends in tickets/calls.
Manage Network and Connectivity Security (DSS05.02)
“Use security measures and related management procedures to protect information over all methods of connectivity.”2
With many employees now working remotely, it is important to shift the way of thinking about managing these incoming connections interacting with the enterprise’s established network security.Network security is essential for any enterprise to function during normal business operations. With many employees now working remotely, it is important to shift the way of thinking about managing these incoming connections interacting with the enterprise’s established network security.
COBIT Guidance
- Allow only authorized devices to have access to corporate information and the enterprise network. Configure these devices to force password entry.
- Implement network filtering mechanisms such as firewalls and intrusion detection software. Enforce appropriate policies to control inbound and outbound traffic.
- Configure network equipment in a secure manner.
- Encrypt information in transit according to its classification.
- Establish trusted mechanisms to support the secure transmission and receipt of information.
Cybersecurity Guidance
- Access controls—Ensure that all ACLs are up to date and secured. Make sure that practices such as least privilege are being integrated into these lists.
- Enable wireless encryption standards (WPA2/WPA3)
- Encryption—Leverage encryption, as appropriate, for communication (assumes no virtual private network [VPN])
- Defense-in-depth—VPNs alone are not impenetrable. Layered security is increasingly required for mobile workforce.
- Direct traffic—Employ IP address restrictions to direct traffic to specific systems, as appropriate.
- Employee Guidance—Make sure that remote employees are utilizing home network security functions.
Manage Endpoint Security (DSS05.03)
“Ensure that endpoints are secure at a level that is equal to or greater than the defined security requirements for the information processed, stored or transmitted.”3
With remote work, one of the most challenging shifts is the inability to physically manage endpoints on the network. Endpoint security, in conjunction with network connectivity security, is where weaknesses within systems will be most vulnerable during this transition. This is where employee training will be crucial in ensuring that security policies and procedures are being properly applied.
COBIT Guidance
- Configure operating systems in a secure manner.
- Implement device lockdown mechanisms.
- Manage remote access and control (e.g., mobile devices, teleworking).
- Implement network traffic filtering on endpoint devices.
- Provide physical protection of endpoint devices.
Cybersecurity Guidance
- Full disk encryption—Ensure that this is enabled on all endpoints (where applicable) to prevent data loss due to physical theft or loss.
- Patch management—Ensure that the operating systems and applications on endpoints are up to date.
- Virus and malware protection—Confirm that these utilities (built-in or third party) are up to date and enabled on all endpoints.
- Policy reminders—Remind employees of acceptable use and data protection policies with regard to enterprise assets and/or bring your own device (BYOD).
- Employee guidance—Ensure that all employees are trained in enterprise policy and procedures surrounding endpoint use and security.
Manage Business Resilience (DSS04.02)
“Evaluate business resilience options and choose a cost-effective and viable strategy that will ensure enterprises continuity, disaster recovery and incident response in the face of disaster or other major incident or disruption.”4
Business resilience for enterprises is going through the ultimate test right now due to the COVID-19 pandemic. It is important to utilize business continuity planning (BCP)/disaster recovery planning (DRP) policies and procedures and to monitor and update them where policy deficiencies are observed.
COBIT Guidance
- Assess the likelihood of threats that could cause loss of business continuity.
- Identify measures that will reduce the likelihood and impact through improved prevention and increased resilience.
- Analyze continuity requirements to identify possible strategic business and technical options.
- Identify resource requirements and costs for each strategic technical option and make strategic recommendations
Cybersecurity Guidance
- Emergency access—Implement emergency access protocols (e.g., breakglass), if appropriate.
- Resilience—Continually update BCP/DRP processes and procedures with lessons learned.
- Collaboration and productivity—Establish and encourage the use of collaboration tools to maintain or improve productivity.
- Security Awareness—Educate employees about possible threat actors utilizing social engineering tactics to take advantage of the current crisis.
Conclusion
Unexpected events happen. Natural disasters, global pandemics, political upheavals and other unpredictable forces impact ongoing business concerns. Good governance is paramount to ensuring business continuity during disruptions, and COBIT 2019 and cybersecurity best practices can assist. COBIT 2019 and cyber best practice contain guidance and tips enterprises can use right now to help navigate the unprecedented, rapid shift to remote working caused by this global health crisis.
Lisa Villanueva, CISA, CRISC, CPA, PMP
Is an IT Governance Professional Practices Lead with focus on COBIT and IT governance content at ISACA®. Prior to joining ISACA, she was an IT risk and security professional in the financial services industry. Her experience includes driving global identity and access management risk and controls initiatives, leading global Sarbanes-Oxley tests of controls, control self-assessments, server and database vulnerability remediation programs, and executing internal and external IT audits for various bank, broker/dealer, credit bureau, finance and insurance clients. She is also a CompTIA Certified Technical Trainer (CTT+).
Dustin Brewer, CSX-P, CCSP, CEH, CHFI
Is ISACA’s principal futurist, a role in which he explores and produces content for the ISACA community on the utilization benefits and possible threats to current infrastructure posed by emerging technologies. He has 17 years of experience in the IT field beginning with networks, programming and hardware specialization. He excelled in cybersecurity while serving in the US military and, later, as an independent contractor and lead developer for defense contract agencies, he specialized in computer networking security, penetration testing, and training for various US Department of Defense (DoD) and commercial entities. Brewer can be reached at futures@isaca.org.
Endnotes
1 ISACA®, COBIT® 2019 Framework: Governance and Management Objectives, USA, 2018
2 Ibid.
3 Ibid.
4 Ibid.