Almost half of security pros being redeployed during pandemic

Almost half (47%) of security practitioners say they have been redeployed away from frontline security duties during the Covid-19 coronavirus pandemic, to assist with other aspects of operational IT, such as deploying mobile working solutions, potentially putting their organisations at greater risk of falling victim to a cyber attack.

This is according to a largely informal study of 256 cyber security professionals conducted by industry association (ISC)². The organisation’s Covid-19 cyber security pulse survey found that the job function (80%) of the vast majority of security professionals had changed to some extent during the past few weeks, and virtually all (90%) were now working remotely full-time.

The report also found that 50% thought their organisations could be doing better at securing their remote workforces, 15% thought they did not have the right resources needed to do so (34% said they did, but only on a temporary basis), and 23% said they had seen an uptick in cyber attacks against their organisations since transitioning to remote working.

“The goal of the survey was to take the pulse of the cyber security community as many of their organisations began to shift their employee bases and operations to remote work setups in March and April,” said Wesley Simpson, COO of (ISC)².

“While this was certainly not an in-depth study of the situation, it does provide a current snapshot of the issues and challenges our members may be facing during this unprecedented time.

“Sharing this information helps our members and other professionals in the field understand the challenges their peers are facing, and hopefully realise they are not alone, even if many of them are feeling isolated as they adjust to working from home.”

Many respondents highlighted some of the challenges they were facing during the coronavirus emergency, with many talking about a lack of hardware to adequately support remote workers, while others saw conflict around organisational priorities for the quick deployment of remote technology and appropriate security measures to protect it.

“Security at this point is a best-effort scenario. Speed has become the primary decision-making factor. This has led to more than a few conversations about how doing it insecurely will result in a worse situation than not doing it at all,” said one respondent.

Another said: “Covid-19 hit us with all the necessary ingredients to fuel cyber crime: 100% work from home [WFH] before most organisations were really ready, chaos caused by technical issues plaguing workers not used to WFH, panic and desire to ‘know more’ and temptation to visit unverified websites in search of up-to-the-minute information, remote workforce technology supported by vendors driven by ‘new feature time to market’ and not security, employees taking over responsibilities for Covid-19 affected co-workers (unfamiliarity with process), and uncertainty regarding unexpected communication supposedly coming from their employers.” 

However, some viewed the pandemic as a chance to highlight the possibility of future improvements around cyber security processes. Some respondents said there was now a clear need to rethink security policies and maybe even make some compromises, while others said they had seen end-users paying more attention to security.

One commented: “Employers now face the prospect of doing what they should have done long before: enact contingency plans for large-scale remote work due to natural or man-made disasters. Enabling remote work also has the benefit of appealing to potential employees when recruitment is a concern.”