We can all agree that COVID-19 changed things forever. There is no going back to normal. The “new normal” is aimed at our constant on-demand digital inter-connectivity, even during the world slowly going back to enjoying the outdoor life once more. For years cybersecurity has been strongly implemented in our work environment to be future-ready but was it pandemic ready? Is COVID-19 a test to see if humanity and our great technological achievements are ready for such extreme circumstances?
I am a huge fan of fictional work Sneakers, The Stand, Digital Fortress, Cuckoo’s Egg, based on what I would call prediction and “reality checks”. In a matter of days, many of us at the VIP boot of command and operation centers have witnessed the consequences of the pandemic, although we have all the best expertise out there for COVID-19, a micro-biological entity, shut it all down without being an actual technological threat, ironic, right? Where fictional writers and creators imagined what pandemics would look like in their respective era or in a futuristic Épopée our advanced 21st-century technology was not necessarily taken to account. Therefore, no one was ready for the impact on our communication barriers.
That being said, I have been in the AV (Audiovisual) industry for more than 20 years now. I have experienced the rise of videoconferencing from its worst to its best performance – analog Centrex, ISDN, to IP-Based H323/SIP, then software-based using an all-digital system maintaining high-quality voice and video added to content sharing. Before video technology, we have been integrating telecommunications using landlines, then VOIP as IP based network was finally the best path for the coming era. And with all the advancements in firewall and VPN technology, I feel we are fortunate to be the smart monkey ruling this Earth. Soldiers of the human race, kicking doors, and heading left for action.
One thing is certain, isolation, social distancing, and cut off from the outside world, paradoxically cybersecurity will have to open doors to prevent the world from “ending”. Firewalls must be better than ever, and that is the dilemma. What better example of security flaws on a large public scale than what we witnessed with ZOOM? In April 2020, CBC described the event involving the software-based company as having numerous cybersecurity issues; people attending unsecured meetings, racial slurs messages and pornography images displayed during educational webinars and high-end government meetings, wrong meeting and pin code, and hackers getting onto their servers abroad sea stealing more than 500,000 of accounts sold on the dark web. That’s one case, within the immensity of the Web, I am sure they are not the only ones who were in this position.
And for others, like some of the Government of Canada’s institutions (CCCS, DND, CBSA, GAC, and others), cloud-based solutions like Office 365, had to be enhanced and arrayed widely to thousands of employees to maintain operations for workers at home. In a matter of days, with a snap of a few clicks, I.T. enabled the portfolios (which surprised a lot of people, especially in a department like National Defence), operating a multiple network environment, different classification levels, always working within that secured space where wireless is prohibited and cut-outs from the outside world is actually… a requirement.
It is interesting to note, what DND developed for remote workers was witnessed by our neighbor to the South. The US Defense Department demonstrated great results with their CVR (Commercial Virtual Remote Environment), allowing DoD teleworkers with secured unclassified capabilities such as chat, video, VMR, file collaboration, and data storage. CVR was ready for operation by March. By the date of April 15, user count went from almost none to 450,000 and reached 1.2 million by July.
Where there is chaos there is reborn, yet nobody wished COVID-19 was real. I sympathize with all the families out there, colleagues, who had to go through some terrifying moments with scary days and nights. That being said, we must learn from this situation.
Going back to cybersecurity, we must embrace our technology and shift to the next gear. Like any supercomputer that man has ever built, we do not push it to 100 per cent in the first few years. We test, innovate, analyze, perform maintenance, and upgrade. This pandemic is the exact same thing, on one end, here is the super-computer our body, COVID-19 is a biological virus threatening young people, adults, the strong and weak in the chain. And like any entity, we have to test, innovate, analyze, perform maintenance and execute upgrades to keep going forward and be tougher. And on the other hand a phantom menace of COVID-19, the cybersecurity being exposed to hackers, virus, fraud, usage, and demand overload, and sadly shameless profiteer. Self-isolation, applying mandatory mask protection, and social distancing – isn’t that just like a fix, a “software patch” we apply while we wait for the next big upgrade? That is the key lesson we must retain and learn to apply in cybersecurity. As we know, most of our telecommunication breakthroughs are now engaging IP-based network and we have been applying upgrades for decades, I believe that method is the right one, but we must not stop there, we will perform and become more effective to crush that threatening rising curve.
It is interesting to look into social distancing from a cybersecurity perspective, as it involves some of the most recent remote computer access system innovations. Large facilities that must engage onto cost saving, better space allocation, reduced risk of physical access – those are already integrating computer farm and cloud-based server to enlarge the number of accessible systems without implementing more hardware onto the working environment and above all reduce the risk of unauthorized access by limiting the physical approachability. That is to say, if you can remotely access a computer system, you can access a telecommunication device, a PVR, a satellite monitoring station, yet what goes on the “NET” can be viewed and controlled remotely.
We know the private sector is big on wireless and cloud-based systems, the job hunter and developer society, Leftronic, provided statistics in October 2019, which showed that more than 90 per cent of private industries have cloud-based systems, while 60 per cent of organizations use remote storage for confidential data. Yet our governments are being very careful for a lot of reasons. Nonetheless, with COVID-19 for instance, we know Canada will need to step one gear up and engage more of these cloud-based and computer farm technology to maintain departments and their remote workers. With a grain of salt, they can raise the accessibility of an unclassified network environment but it is a different ball game when it comes to secured networks.
Within each department of government, I do see great efforts to maintain a secured communication process, providing a “tool kit” to managers and supervisors, but in an era where there are thousands of BYOD software and digital utility, it can be difficult to select the right one. Recently, DND published the “COVID-19 Business Resumption – Supervisors’ Communications Toolkit” one Annex has a great résumé for a standard of procedure (Annex C: Best Practices for Online Engagements), no matter what application or software client you use what comes out of it is that you have to get acquainted with these tools and make sure you first employ their functionality and always prioritize the security. Are you familiar with the process? Is your remote working environment physically and virtually safe?
As CTV News reported in May, fraudulent websites, online services offering financial solutions (scams) have led to thousands of takedowns on the World Wide Web. Opening our doors to remote access tools has great power, but we must be ready to accept the great responsibility. And what about this scenario – COVID-19 pushing foreign country professional cyber hackers to steal digital knowledge and gain access to research conducted in North America about a cure to provide a vaccine to humanity, does that sound like a fictional book? It does right, but this is real life, a true story that happened this year, not in a Richard A. Clarke’s book or in a futuristic Spielberg movie of the year 2225. Worldwide news channels and editors such as CNBC and Forbes detailed the situation as “… the U.S. and U.K. accused Russian hacking group linked to the government, dubbed “APT29” or “Cozy Bear,” of targeting “various organizations involved in COVID-19 vaccine development in Canada, the United States and the United Kingdom, highly likely with the intention of stealing information and intellectual property relating to the development and testing of COVID-19 vaccines.”
Of course, Russia denied the allegations. Cybersecurity must be reinforced, no matter how important remote access is required because you never know who is watching and listening. That was chapter one, chapter two was in a matter of a week or so after the Russian situation. The Los Angeles Times received the unsealed event of the U.S. Justice Department leading accusations against China, stating they were targeting trade secrets from private companies around the world, worth millions of dollars mainly aiming at firms working on vaccines for coronavirus. In our fast-evolving technological world, the future is today and the new threats are already aiming at potential breaches, what’s next?
With social distancing and health measures technologies such as a finger, facial and voice recognition take on more massive integration into the professional industry. We may not be far from the day when we will hear: “Ok Google, drop the bomb” since these innovations are heavily targeted by hackers. Cryptographic Man in the Middle and Security assertion markup language attacks are now scripted to acquire fingerprints, voice, and facial analysis data, and we all know these are very popular with cloud-based login protocols and whoever implants these MiM & SAML interceptors can acquire a lot of information about who you are and inevitably they can virtually pretend to be you doing online banking next door. These attacks are popular among mass login virtual portfolios such as stock market and national events such as elections. The U.S. Defense Department stated cybersecurity as being a top priority mission for their upcoming 2020 elections. We can imagine how much data such an event generates? Army General Paul Nakasone of the U.S. Cyber Command said that the lessons learned from the 2016 election of cyberattacks led by Russia, China, and other countries, which was combatted by a united effort between DoD and multiple agencies such as the FBI and Homeland Security, have helped them developed insights about theirs adversaries’ maneuvers. “We know our adversaries better than they know themselves,” he said. About COVID-19, he explained the secured remote communication associated with safe personal interaction created a great powerful agility in the face of a pandemic.
Where we are heading next is surely comprised of new innovations and risks toward cybersecurity, with COVID-19 still menacing like a wandering ghost in a haunted mansion. It is with great relief we see our government tactically driving many efforts and assets to be ready for the next wave of cyberattacks. Not all of us are comfortable and aware of all the counter strikes Canada maintains against antagonists but as a day to day user in cyberspace, I do encourage any type of workers, supervisors, office, and teleworker to consult the Canadian Center for Cyber Security online resources. CCCS excelled in maintaining its portfolio providing abundant advice and guidance about how cybersecurity should be taken seriously, but above all help us with physical and virtual interaction and maintain our daily operation safely and successfully.
To learn more, go to: (https://www.cyber.gc.ca/en/guidance/focused-cyber-security-advice-and-guidance-during-covid-19).