Can coronavirus COVID-19 impact your network? The short answer is “yes”, if your firm hastily adopts a remote work policy without considering some common sense security precautions.

1. No personal email. The only exception for this would be to contact helpdesk about being unable to access corporate email. Personal email is not typically set up to properly archive and retain messages that could later be subject to a legal hold. The very use of personal email for business purposes can potentially expose your firm to liability costs that would exceed the value of whatever business you planned to get done.

2. No personal file sharing. This is right up there with personal email. Personal anything is not allowed for business use, mmmkay?

3. No Remote Desktop Protocol (RDP) use over unsecured Internet. If I had a nickel for every person that told the network team to open up port 3389 on the firewall so that they could work from home, I’d be comfortably well off. Yes, RDP means you can access your desktop or server from home. It also opens up great work from home capabilities for attackers. They will guess your username and password. It’s only a matter of brute force time.

4. No low-security options on the VPN configuration. While I’ll allow you to use RDP through a VPN connection, I’ll only allow it if your VPN is not just secure, not just really secure, but only if it is really really secure. That means not just IKEv2 and the best AES that your system will support, but also secured authentication that uses more than a username/password combo. Let there be a certificate or software token as part of 2-factor authentication.

5. No split tunnels. It’s tempting to let a local ISP handle all the Facebook and YouTube traffic that users consume in between productivity spurts, but don’t. Either pass all that traffic through your own network, or block it with a message that VPN bandwidth is limited due to whatever reason you want to provide in order to justify blocking that traffic. My point being that a split tunnel approach allows for an attacker on the Internet to bridge their attack through your user’s PC.

Can there be more possible pitfalls? Sure. These are just the five biggest ones. If your firm is anticipating a stretch where a large percentage of employees must work remotely, then take the time to bake some security into that plan so that reducing health risk doesn’t increase IT risk.

On 12 December 2019, Chinese broadcaster CCTV announced that a new viral outbreak had started in the city of Wuhan. While the first confirmed case was on 17 November, it was not until more cases came to the attention of authorities – in a way that they could not ignore – that the Chinese government began to publicly acknowledge something new was underway. Following that 12 December announcement, the world began to transform. As output ground to a halt in much of China, factories depending on Chinese raw and intermediate goods had to slow or stop production. The lesson learned was both sharp and timely – “just in time” methods of production left firms vulnerable to disruptions in the supply chain. If firms kept a reserve of parts, those could have lasted through at least some of the lapse, if not all of it, and would have allowed for less economic dislocation.

Part of the “just in time” mentality of go, go, go all the time is the ideal of “five nines” or even “six nines” – 99.999% or more uptime for all systems. While, yes, this does mean the product always moves out the door, it also means that the things making those products go unpatched and unprotected for long stretches of time, making them prime targets for attackers. Those vulnerabilities leave the firm just one click on an email attachment away from utter ruin.

Just as there’s an argument to be made for adding some storage capacity to help weather supply chain shocks, we need to talk about “two nines” uptime as a way to avoid eventual “infinite zeroes” uptime conditions. If you give me 100 minutes each week, I can get a breathing space to apply needed patches on production servers and equipment. If I don’t need a week’s 100 minutes, let it roll up into next week – maybe I’ll need more time to apply the next patch, who knows? But let me have a reserve of time during the working year so I can do my job to patch and protect. Let me reboot gear that needs its queues cleared, let me stop and restart services on servers, let me keep things up to date so we can spend the other 99% of the time feeling more confident about the resiliency of the environment… just in case, ok?

I’m aware that executives in most nations have a fiduciary duty to maximize shareholder value. That’s a short term goal that is itself replete with abuses when it considers employees as expenses as opposed to capital or when it looks at wages as a race to the bottom. I’ll leave those criticisms of neoliberalism for another paper at another time. But here is where I criticize those fiduciary duties as regards security. Maximizing shareholder value means minimizing expenses in the short run, and security is seen as an expense, not as an investment. Current accounting structures blind the books to an ability to properly assess the value of a security system in its ability to provide long-term stability and constancy. I would love it if share prices for a firm jumped every time it announced it was undertaking a security project. Sadly, they’re more likely to drop as those expenditures for security are seen as short-term profits lost, not long-term profits gained.

In the meantime, I’m reading headlines about increases in ransomware and other attacks using email attachments with references to coronavirus, COVID-19, and even SARS-CoV-2 to successfully penetrate those PCs bridging traffic between the raw Internet and the corporate VPN, because it was cheaper to use a split-tunnel solution than to backhaul all the Internet traffic through the corporate networks – and also because it was seen as “nicer” than banning non-business related Internet usage for devices on the VPN. I know I’m getting into just one of the technical weedpatches of issues, there are others… and if firms could see their way towards working more for the long haul than the short-term gain, we’d likely have the right solutions instead of the cheapest and easiest, which are never the strongest.

I work for a security vendor and I see into many customer environments. Often, the thought pops in my head, “If I were an attacker, I’d really get them if I [REDACTED].” And if I don’t think I can get them with [REDACTED], then [REDACTED], [REDACTED], [REDACTED], and [REDACTED] round out my top five most common ways to break into an organization and have access to quite a lot that I shouldn’t have access to.

It’s not that these methods necessarily have something to do with the product I support. Some do, like [REDACTED], [REDACTED], and [REDACTED]. But [REDACTED] and [REDACTED]? Well, that’s some other vendor that helps out with those weaknesses.

Now, as you read those paragraphs, what thoughts do you have that fill in the blanks I left? Unless you’re someone that works in the same line of security that I do, I’d dare say your top five exploits list is different from mine, in part or in whole. What’s more is that we may even have some of the same customers, and we may, between all the people that work in security at that customer or on behalf of that customer, we may actually know dozens of things that fill in those tantalizing [REDACTED] blanks.

Now, I know that the customer might want to know all the details of everything I notice, but I’m often noticing things that are out of the hands of the people I’m directly working with. They can only report up to their manager, and that communication only goes so far before it drops in urgency and loses its audience. Or, worse, it’s just added to the list of security things to fix, right behind [REDACTED], which got noticed last week in an audit finding.

So, let’s ask the question: what are the things that are the hardest to fix that leave organizations the most vulnerable? There are a number of “10 Quick Security Fixes” articles out there. Everyone knows how to pick low-hanging fruit. What I want to ask about are the projects that nobody wants, the projects that get people fired, the projects that land everyone in the [EXPLETIVE DELETED]. Because these are the ones that don’t get done, get done but badly, or get done only to such a point as a box on a checklist can be ticked, and then no more. For example, nearly everywhere I’ve been to has firewalls set up. That’s good. But when we talk about turning the firewall concept inside, to regulate traffic in a segmentation project, then I know I’m going to have an uphill fight in getting information about which apps use which ports.

Why will I have that uphill fight? Because I have to ask for netflow, that’s why. And then we need to talk to different teams about when they run their apps so that we’re sure to not block anything that runs only once per year. And then we have to deal with how Microsoft recommends that we leave open ALL. THE. PORTS.So that’s just one type of project that is practically a mission impossible.

What projects do you face that are nearly impossible, but fill in those [REDACTED] blanks?

I promise the dear reader that this will not be just a rant about how nobody takes security seriously or anything in that vein. Read on, and I’ll get to the actionable items. I just need to set some things up in order to give credence to my conclusions.

Some years ago, the Polish science fiction author Stanislaw Lem wrote an essay about weapons development titled “The Upside-Down Evolution”. In it, Lem called out several interesting trends: miniaturization, dehumanization, and deformalization. The key trend gave the essay its title: rather than developing smarter and smarter AI, the true breakthrough Lem foresaw was not in artificial intelligence, but in artificial instinct. Lem postulated that a weapon need not be coded to handle all types of situations. It only needed to be able to perform a certain range of tasks under certain conditions, nothing more.

Combined with miniaturization and dehumanization, limited weapons systems – artificial insects, in Lem’s parlance – also allowed for the deformalization of war. No more a matter of exchanged ultimatums and formal declarations, war in Lem’s future would be constant and acts of aggression difficult to attribute. Consider a swarm of artificial insects each carrying a fractional amount of fissile material that converge on a location to create a critical mass for a nuclear explosion. If all the artificial insects are destroyed in the explosion, who could say what actor or actors was behind the event? Could it be an attack by a foreign power or a false flag attack used to justify an attack on another foreign power? Or could it be done to frame a third party?

Once deformalized like that, warfare would be constant. Natural disasters could be no more than just that, or they could be the products of an attack by a hostile party. There would be no way to tell the difference.

While we are yet to see Lem’s artificial insects on a grand scale, we *do* see the next closest thing – cyberattacks.

Cyberattacks check all the boxes of the upside-down evolution. They are mere digital streams of signals – miniaturized. They are often products of algorithms – dehumanized. They are always out there, always attacking in the ways they are set up to attack – deformalized. And they only do that *one* set of operations that they have to do – artificial instinct.

Lem’s essay did not go into matters of defense except to say that the need for uniforms, marching, parade drills, and generals all went by the wayside. At best, those were worthless vestiges of another age. At worst, they hindered responses that had to be just as rapid and ruthless as the attacks. Lem only considered nation-states, but we now live in an age with a myriad of players having access to these attacks – and a myriad of defenders still trying to fight the last war.

Old-timers will remember Clifford Stoll’s epic, The Cuckoo’s Egg. The story is of a human tracking and trapping another human. At the time, the FBI was uninterested in the case, as no large sum of money was involved (less than $1) and no classified files were accessed by the attacker. While we may look back on that and shake our heads the way modern combat veterans would react to how various World War One generals dismissed the power of the machine-gun, that was the FBI still fighting the last war.

Well, Stoll went on to write in 1995 that the Internet was just a fad and would never catch on as a platform for commerce and information exchange. Yes, he still kicks himself over that article, but at least he’s aware of the irony and how outdated that thinking was. And though I talk of a mindset fighting the last war, that was the 1986 mindset. People today may have moved beyond that, but not much. Most are still expecting a Stoll-like boffin to do the investigative work to catch the baddies and bring them to justice. That’s because the events described in The Cuckoo’s Egg are those of a previous war.

To be perfectly honest, most firms aren’t even thinking about fighting a war. They’re not built to do so. At no point is there an MBA class on Sun Tzu’s Art of War that ever tells the students, “You know, this really isn’t allegorical when it comes to IT.” I know this because I have yet to work with a customer in the business world that doesn’t underline the principle that security won’t interrupt business as usual.

I’m sorry, but that’s quite the paradox, Mr. Customer. Do you want business as usual without security, or do you want to change how you do business in order to have security? Are you still forming soldiers into phalanxes of spearmen for operations on an open field of battle, or do you plan to tell them about the need to disperse and entrench so as to avoid being overwhelmed by large-area effect weapons? If still the masses of spearmen, I have a rude surprise waiting for them when the drone with a fuel-air explosive arrives on the scene…

… and even that analogy is out of date, as the actual attacks coming at us every day are not even needing drones in order to do their damage. Worse, because we put emphasis on doing business first, we’re only looking at security as a bolt-on. That means the underlying systems will always be more vulnerable that necessary.

So what keeps this article from being another mass of groanings about how things are? What are my fixes, my takeaways that businesses can put into place? All right, all right, I’m ready to get to my point.

You’ve got to apply upside-down evolution to your systems. Doing so will give them higher immunity and better resiliency against attacks. It will mean more interruptions to business, but of less total time than what would happen to your business if there was a successful denial of service attack against it. Moreover, the interruptions will be localized, not general.

Automate your responses to any breach of standards, and make those responses harsh. Do not exempt anything. I grant that the last sentence is more a starting negotiation position than a final state, but I stand by it, all the same. When the endpoint or server or application goes wrong, shut it down immediately and get it fixed just as fast. Then, when it comes back online, it is fresh and ready to defend itself.

And if your shutdown actually caught an attacker, so much the better. The swift action meant limited damage. Do you know how Taiwan had such a low infection rate in the recent pandemic? It shut down ALL travel to the island. Nations that made exceptions got hit hard. Taiwan made no exceptions, and that swiftness and harshness saved lives.

What is your return on investment? Your business stays open, allowing you to continue to get returns on all your other investments, that’s the ROI. The coming years will see attacks that are more miniaturized, more dehumanized, more deformalized, and more artificially instinctful. Trying to stay open 24/7 in that world will be like leading those spearmen in a charge against a tactical nuclear warhead. Automate, be strict, and accept small downtimes now instead of permanent downtimes later. Fight the current, upside-down evolution-born war, not the one where we trace a 1200 baud modem connection back to Bremen after months of investigation.

I’ve been back in IT for 7 years now, after over 10 years teaching high school. With 14 years of IT experience and 16 in teaching, I can tell you all something that you’re not going to like, but you need to hear it. A lot of people that learned how to lie their way through high school have figured out how to lie their way through a career, and they may very well be working for you, over you, or as a peer. I can spot them when I see them, but an untrained eye and ear is almost always baffled by the BS these people know how to put up to screen their incompetence.

I’ve seen some people with below-average skills muddle through in various areas of IT. As long as they can stay in their lane, they do well enough to justify getting paid to do their work and there doesn’t have to be much worry about damage that they can cause. But when the work moves to security, things get very complicated and multidisciplinary very quickly, and those people with below-average skills find themselves in a stressful situation.

When we put people into stressful situations where their knowledge and expertise play an important role in getting a successful outcome, we want people to be honest with us and to let us know when they need more help and guidance. Often, employers want to see their best employees get better. Frequently, we make mistakes that we have to learn from – but the learning is a good thing, and a positive in career development.

But what about people who don’t learn from their mistakes? What about people who aren’t honest about their shortcomings? They know they’re in over their heads and that they have to use survival strategies to keep from getting fired. What are their typical go-to behaviors that keep them employed, no matter what damage they may do?

1. Control Information Flows
This is a major survival strategy, one of the best. If all information passes through the employee, that employee can control what form it takes when it gets passed along. Did a vendor explain a complicated solution that they can’t understand? Tell the manager that the vendor has no clue what’s really going on. Does the manager want to speak directly to the vendor? Poison the well by saying things like “good luck, I can never reach the guy, and when I do, he just blows smoke…”

I’ve worked with people who somehow seemed to never get along with other teams, ever. They were impossible to work with, they didn’t know their jobs, they didn’t do their jobs, they were complete train wrecks. Could I talk directly to those other teams? Well, wouldn’t you know that when the people who never got along with those teams tried to send invites, they never got a response? Wow, what dumb luck, that. I guess these guys are tough to work with…

… except they’re not. Seriously, I’ve seen this before when kids never got notes back to their parents or the parents didn’t seem to care about the notes. So I called the parents directly to work things out. Suddenly, I’m talking to people who care and who had no clue how their kid was forging signatures on report cards for years. They think he’s got good grades because he’s also been forging the report cards! Truly, it’s amazing what modern color printers can do these days…

But, yeah, when I was told that the other teams were impossible to work with, I didn’t waste time arguing. I said that that was just unacceptable and got hold of a manager to let him know that we couldn’t get our project going without help from the other teams. When the manager set up meetings, it was like day after night. I found the other teams were a delight to work with and a fount of valuable information. And that the guy who threw them under a bus was himself unable to keep up with the discussions we were having, even on a basic level. Once the information flow control is broken, it’s much harder to stay incompetent.

2. Escalate Emotions
Not really bullying all the time, although bullying would fall into this category. Emotional escalation goes like this: you’re about to be shown up as a fraud by a line of discussion, so you start to make things personal. You get mad. You come out and demand to know if the other party in the discussion is casting aspersions on you. Are you being insulted? Are you being called an idiot? A liar?

Kids do this all the time, with the benefit of an often-sympathetic classroom audience. But this stuff works just as well in one-on-one situations.

Most people back away and never bring that up again, as it’s embarrassing. The next most common response is a corresponding escalation, verbal battle, and then having to apologize for having said things you later regret. Maybe the person who starts the escalation can get a response so toxic and nuclear that it’s the competent responder that gets let go and not the incompetent instigator.

If you back down, you lose power and respect in the relationship. If you escalate, you lose possibly your job. To win, you have to take a different path, the one teachers are taught to take: abide.

To abide means to follow the rules, but to remain unchanged, to endure. Remember that “follow the rules” means following the rules of the company, not this guy’s personal bending of the rules for his survival. Companies have rules on civil conduct. It’s very easy to say, “There’s no need to raise your voice. If I’m doing anything wrong, let’s take it up with HR/our manager/some other authority.” That usually prompts consolation, apologies, and other rapid de-escalations so that it does not go up the chain of authority to someone who might issue a reprimand for the escalation.

If you accept the de-escalation at face value, be prepared to be blindsided by this guy controlling the flow of information and getting you fired before you get him fired.

If this happens in a meeting that got recorded, get a recording of the meeting ASAP. If this happened in front of other people, get their witness statements ASAP and document your own recollection ASAP. If this was one-on-one, go to your HR/manager/some other authority ASAP before this guy gets to them and fires torpedoes into your career. When this guy raised his voice to you, he declared war. Machiavelli teaches us that war does not end until one or both parties are vanquished or no longer have the motive and capability to attack each other.

3. Odd Working Hours
Why is so-and-so late or not coming in today? Does so-and-so claim to have been in a very early or very late meeting with a team that nobody else has any real contact with? If that’s the case, it’s time to develop some contacts to see if the meeting actually exists and if so-and-so does anything useful in it.

If a teacher falls for excuses like this, the kids will never show up to class and will skate by because their sob stories earned them makeup work exemptions without penalties and other goodies like that. You have to do a little digging, if you want to be sure of things…

If the meeting actually exists, well, you may not have much to go on except to watch out for the other behaviors. If the meeting doesn’t exist or he isn’t really needed in the meeting, then you’ve got evidence this guy is faking things. Not only does the meeting mean he basically gets paid to take a nap during that time, it also means less total time in front of people who can call him out on inaccuracies. Double bonus, there.

Long lunch hours because of bad service? Having to leave early to avoid traffic? Coming in late because of traffic? Missing meetings when remote because of a home emergency? If these excuses come up once in a great while, then they’re either genuine… or the person making them just needed a 2-hour vacation and maybe you just let that slide. But if these happen frequently, it’s a strong sign that the person making the excuses has every intention of reducing interaction so as not to be fired for incompetence, and he knows that most people are sympathetic enough to let even a habitual behavior like this go on, if it’s wrapped up in a good enough story.

I once worked with a guy who didn’t show up for work for 2 days. The manager called and was devastated when he got the reason: the guy’s wife had just been diagnosed with cancer and he was overwhelmed by it all. He got a few free days off of work, not charged against his PTO, and we bought him and his wife a nice bouquet. Now, this guy never was one for punctuality in all the time he worked there, and his lunches always seemed to go long. But, he also bought lunch for guys on the team frequently, so it was “our little secret”.

Another set of missed days came up and the manager called again. Again, he was devastated by the reason, as it was the same one from a few months ago: his wife had just gotten diagnosed with cancer. This time, the manager’s devastation was in realizing that he had been played for a fool. A quick call later to the wife revealed that she did not, in fact, have cancer. Nor had she ever had cancer. She had, however, kicked the husband out of the house because he was always turning up drunk after these multi-day benders and she’d had had enough of that garbage.

It shouldn’t have taken that second time through the excuse to notice that the excuses weren’t real, and that there’s a difference between letting something slide every now and then and letting those things slide all the time.

4. Look! A Distraction!
So here’s the scene… we’re having a technical discussion or we’re in a working session… and this person starts with the small talk. Before long, nobody’s working on anything technical and we’re instead considering the truly weighty matters of the world that everyone has an opinion on but nobody can prove.

I knew when students were drawing me out to tell stories. To be honest, if we had the time, I’d tell the story. But I always held everyone accountable for their work, on schedule. It’s pretty much the same in business.

During lunch or dinner or in the elevator, this stuff is fine. If we’re all chatting in the five minutes before the main call starts, no problem. It’s team building or something like that. Building camaraderie or whatever. But if we’re on the clock, time is money, and we’re being paid to do the work we said we’d do.

Now, it’s one thing to have a discussion of sports, issues, the paranormal, and like topics as we wait for a power cycle or other time-consuming operation to complete. We may have already done all our email for the day, it’s 2AM on an overnight change cycle, and we know the patch takes 2 hours to download and apply. We are going to talk about non-work related stuff and that’s fine.

But when we’re in the middle of the business day and are doing non-trivial tasks, these distractions are attempts to steer things away from where they’re vulnerable – technical topics – and to areas where you are vulnerable. After all, if you spend time chattering away on the company dime, aren’t you as guilty as the distractor? Or maybe even more so, if he can claim he was only making small talk, but you’re the one who derailed the work session…

5. Activate the Blame-thrower!
I’ve played enough FPS video games to know that the guy with the flamethrower is pretty much going to get us all killed. Either his fuel tank gets shot and explodes or, more likely, he opens fire from a position of cover (so as to avoid the fuel tank being shot) and then kills all the team members in front of him. A blame-thrower works on the same principle, but with the lethality transferred to the career rather than the person’s life.

I’ve also had plenty of students that, when brought before the principal, start to spew the wildest stories about one and all. That’s why I know how to deal with this behavior.

When something goes wrong, an honest person admits where one contributed to the failure. A dishonest person plays up the confessions of others and makes none of their own. If directly confronted, they will let the blame fly out towards everyone. If it’s groundless, the accusers will have spent time proving it so. If there’s a shred of truth, no matter how small, then, “See! I told you so! It’s not my fault!”

In teaching, the response had to be direct: “This is not about others. This is about what you did.” The same thing applies here. Don’t allow the person to use questions that start with “What about…?” in their defense. Don’t allow speculations or random accusations, either. Chances are that this guy’s got a personal file on everyone he works with, all stored in his mind, and when he’s pressured, he knows how to dangle details that put others in a bad light. The hope being that the questions coming at him stop because of other concerns or because the questioner fears that the next set of details will be personally directed. If someone says to a dishonest person using the blame-thrower tactic, “Let’s keep this all between just us”, the blame-thrower wins.

If you’re the victim of a blame-thrower, you have to fight fire with fire, I’m afraid. But your fight doesn’t start all at once. The ground must be prepared. When I was a teacher, I spoke with a principal about potential serious discipline issues as they manifested themselves to me. I spoke with other teachers and department chairs. When the eruption happened, nobody was surprised.

For your defense, as soon as you have a suspicion, talk about it with your manager. That way, when you have to defend yourself, it’s not a surprise to your manager. Your manager will have a situation in which an incompetent employee is wrongfully accusing a competent employee who has previously been concerned about said incompetence. The decision in that situation is much easier to make than one in which the accusations of incompetence suddenly emerge. Do you want your manager to respond to your defense with a question: “Why didn’t you tell me this sooner?” If not, tell your manager sooner.

Hopefully, the above descriptions set of some thoughts in your head about times you were dealing with someone covering up their own incompetence and help give you some tools for dealing with that so that you protect yourself and your career from the pitfalls these behaviors create.