In a few days a large part of Sweden has moved home. Management teams all over the country are working on keeping the business running, and rightly so. But in the rush I see a lot of security decisions being made without anybody noticing that they are security decisions.<\/p>\n
\u2018Let people use their own computers.\u2019 \u2018Open up remote desktop so they can reach their workstations.\u2019 \u2018Skip the second factor, it\u00b4s too hard to roll out right now.\u2019 Every one of those might be the right call for a few days. The problem is that they tend to stay.<\/p>\n
So here is my advice to management. Accept that you need to take some risks right now, but write them down. Every exception should have an owner and an end date. Ask your IT department what was changed this week and what the plan is to close it again. Make sure the security team is part of the crisis group, not only informed afterwards. And give your users clear instructions: Which tools are allowed? Who do they call if something looks strange?<\/p>\n
The attackers are watching the same news as you. They know that a lot of new and hastily opened doors appeared this week.<\/p>\n
A crisis is a bad time to build security. It is a very good time to find out what you are missing.<\/p>\n","protected":false},"excerpt":{"rendered":"
In a few days a large part of Sweden has moved home. Management teams all over the country are working on keeping the business running, and rightly so. But in the rush I see a lot of security decisions being made without anybody noticing that they are security decisions. \u2018Let people use their own computers.\u2019 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[11,4],"tags":[38,63,34],"class_list":["post-1207","post","type-post","status-publish","format-standard","hentry","category-business","category-security-architecture","tag-business","tag-crisis-management","tag-remote-work"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1207","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1207"}],"version-history":[{"count":1,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1207\/revisions"}],"predecessor-version":[{"id":1235,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1207\/revisions\/1235"}],"wp:attachment":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1207"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1207"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1207"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}