Continuity News
Gryphon Partners is pleased to introduce Continuity News, a newsletter focusing on a wide spectrum of emerging threats and offering mitigation strategies that can enhance readiness of both businesses and individuals. To learn more about Continuity News and related products, please write us at info@kathryncostellophotography.com
Current Issues Affecting Continuity
As we know, Continuity programs allow for the vital business operations to continue uninterrupted in all circumstances. These programs minimize damage and allow management to be in a good position to direct reconstruction of damaged infrastructure. This newsletter highlights a few current threats and mitigation strategies.
This newsletter will not duplicate reporting, but will summarize the incident(s) and identify their impact on continuity.
All industries
The recent “ransomware” attacks that affected most of the globe, all industries and private citizens demonstrates how cyber is an actual physical threat. When medical systems and utilities are attacked, there is an actual threat to life. This ransomware targeted critical infrastructure more than other industries – those organizations that they thought would be most likely to pay.
In continuity, we don’t concern ourselves with the cause of the disruption – we focus on reducing threats of all kinds to continuity and develop strategies to mitigate the effects. In this case (as with most non-sophisticated cyber-attacks) the effects can be easily mitigated.
All of the affected systems met at least one of these criteria:
- The systems were running a counterfeit version of Microsoft Windows
- The systems hadn’t been updated
- The system administrator had not backed up critical data
Mitigation strategies for continuity
- Use only official versions of software. Counterfeit versions will not get required security updates and may have additional malware installed by the counterfeiter.
- Automatic updates should be turned on. The flaw that allowed this ransomware to attack these systems had been resolved several months earlier. Microsoft and most other vendors release updates on a regular basis.
- All critical data must be backed up in multiple locations, the backup must be tested and personnel must be trained on how to clean infected systems and restore data.
- Extremely critical data should have back-up computers that are not normally connected to public internet – but must be updated regularly.
A proper continuity strategy would turn a cyber-attack like this into a mere annoyance rather than a catastrophe.
Aviation
Following the laptop ban in aircraft cabins from certain countries to the US and the UK, the US is contemplating expanding that ban to even more countries.
Electronics guidance is not new. Following the bombing of Pan Am flight 103 in 1988, governments and airlines implemented testing of electronics. At that time, however, electronics weren’t small enough to allow for explosives to be hidden in a functioning electronic device.
Now, ICAO, the United Nations International Civil Aviation Organization, is considering global guidance for in-cabin electronics. While this guidance cannot be mandated for countries, it does raise significant issues for international aviation and airport operations http://www.travelweekly.co.uk/articles/278814/laptop-ban-icao-considering-global-guidance-on-cabin-electronics
These guidelines could affect the security of airport operations and raise the following questions that may not be addressed by the guidance:
- How will affected electronics be handled at checkpoints?
- How will airports deal with security scanning abandoned electronics? How will they be stored and/or disposed of.
- How will airports handle additional crowds that are waiting to check their electronics? Will this checking of electronics occur before or after security screening? If before security screening, what additional security will be required to prevent an incident at this chokepoint?
Continuity programs should be in place for all businesses and Government institutions. These programs also need to consider all unintended consequences of policies and procedures.