Join Rea & Associates for a brand new webinar series that addresses the shifting business infrastructure in today's marketplace. We are pulling together industry experts and service professionals to help you discover how to shift your business in response to current events and drive maximum results. During this high-level webinar, you will learn about the workplace of the future and the shift to a normalized telework infrastructure, COVID-19's impact on cybersecurity and data protection risks, and so much more. Register for this webinar to: - Learn more about the risk of remote work and considerations associated with permanently shifting to a Telework environment. - Gain insight into the macro effects of COVID-19 on cybersecurity risk, including: --- The impact it has had on cybersecurity budgets, personnel (i.e. budget and personnel cuts). --- The impact it has had on risk as employees and company data as more company digital assets move offsite. - How old cybersecurity and data protection threats are making a comeback and how cybercriminals are looking to capitalize on the fear and anxiety associated with the pandemic. - The changing business environment and recommended next steps as businesses continue to endure in the midst of a "COVID-19 world." Access Rea's COVID-19 Resource Center at https://www.reacpa.com/service/covid-19-resource-center. Or, learn more about Rea & Associates at https://www.reacpa.com.

2. Introductions – Addressing the Symptoms of Telework Amid
the COVID-19 Pandemic
• Employee Work Preference - Permanent Shift to Telework?
• Macro Effects of COVID-19 on Cyber Security
• Telework Threat Landscape Update
• Best Practices & Tips
• Live Q&A
Agenda

3. Introductions
Brian Garland, CPA, CISA
Ma n a g e r
Re a & A s s o c i a te s, I n c .
Cyb e r S e r vi c e s Di vi s i o n
CybersecuritySpeaker
Direct Line
614.923.6584
Email –
brian.garland@reacpa.com

4. Introductions
Conner C Mundy,
I T Co n s u l t a nt
Re a & A s s o c i a te s, I n c .
Cyb e r S e r vi c e s Di vi s i o n
CybersecuritySpeaker
C e l l
440.897.4077
Email –
conner.mundy@reacpa.com

5. Poll Question
For your organization, do you
feel the migration to telework
is a temporary or permanent
shift in how your organization’s
employees will operate?

6. Employee Work Preference - Permanent
Shift to Telework (or remote)
• Cybersecurity Risk and Change Management
• March 20, 2020 (Friday) vs March 23, 2020 (Monday)
• Implementing solutions in emergency change management
conditions
• IT Management of 3 networks vs. 300 networks

7. Corporate owned devices on home networks
• Home networks are historically less secure than their
corporate counterparts
• Home networks 3.5 times more likely to have one malware
family
• 25% of devices on home networks have one or more
services exposed on the Internet.
• Source: BitSight survey of 41,000 US Based organizations (April 2020)
Employee owned devices used for work
• Lack of monitoring, security, potentially compromised

8. Employee Work Preference - Permanent
Shift to Telework (or remote)
• Likely a hybrid workforce
between on premise and
remote, at least for 2020
and into 2021 for most
organizations
New
Normal
of Cyber
Security

9. 50% of the workforce believe flexible
working options will increase during 2020,
81% expect to continue to work from home
at least one day per week post pandemic.
With estimated savings of $4.5 trillion per
year in the US by 2030.
By comparison, studies have also projected
cybercrime and related cyber costs could
cost up to 90 trillion by 2030
(Atlantic Council and the Zurich Insurance Group)

10. Poll Question
How quickly has your
organization's budget
for cybersecurity/IT
been restored to pre-
pandemic levels?

11. Macro Effects of COVID-19 on Cyber
Security
Impact of budget
revisions/reductions on IT
Internal staffing
(from leadership to
level 1 support)
• CIO
• CTO
• CISO
Managed security vs
break fix
Strategically focused
vs. Firefighters

12. Macro Effects of COVID-19 on Cyber
Security
• Helpdesk ticket
fatigue

13. Data Transformation
Cyber Risk and Telecommuting
Dispersion
of Data
Visibility into
Controls
REMOTE
TRADTIONAL

14. The Macro Effects of COVID-19 on Cyber
Security
Migration of corporate data offsite
• On what devices is your data accessed?
Altered? Transmitted? Stored?
• Especially in environments where
employee devices are used for work

15. Transitioning Back to Office
• Triage and cleansing of devices
• Employee certification that all data that left the network
during remote work is recovered and back within confines
of environment and controls
• Don’t neglect on premise devices as well (trusted zone
risk)

16. Poll Question
When the state mandated
shutdown occurred, how
effective was your incident
response plan or business
continuity plan, if implemented?

17. Poll Question
Has your organization gone
through an IT risk assessment in
past year? If so, did it include a
review of your remote access
polices and procedures?

18. Threat Landscape “Blast from the Past”
Old Threats Making a Comeback
• What is Phishing? Social Engineering? Brute Force?
o Phishing
o The fraudulent practice of sending emails purporting to be from
reputable companies in order to induce individuals to reveal personal
information, such as passwords and credit card numbers.
o Social Engineering
o The use of deception to manipulate individuals into divulging
confidential or personal information that may be used for fraudulent
purposes. Phishing is one type of social engineering.
o Brute Force
o Consists of an attacker submitting many passwords or passphrases
with the hope of eventually guessing correctly. The attacker
systematically checks all possible passwords and passphrases until
the correct one is found.

19. Threat Landscape “Blast from the Past”
Old Threats Making a Comeback
The FBI reported that cyber complaints
have gone from 1,000 daily to 4,000 daily
during the current Covid-19 pandemic
Since Feb Phishing attacks are up 600%
according to Barracuda Networks

20. Threat Landscape “Blast from the Past”
Old Threats Making a Comeback
• Phishing attack and fake web site examples

21. Threat Landscape “Blast from the Past”
Old Threats Making a Comeback
• Brute Force Attack 0365
MFA
20%
HOW DO USERS
AUTHENTICATE TO THE
COMPANY NETWORK?
40%
8+ character
passwords/passphrases

22. Poll Question
Who utilizes cloud
applications in their
environment for critical
services? (i.e. Office 365,
Google G-Suite, etc.)

23. Office 365 Cloud Solution Threats
• Phishing Attacks around Office 365 accounts
-Fake calendar invites poisoned with malicious code
-Fake account update web links
-Fake conversation with legit user account
• Poor O365 Environment Setup
-Brute Force Attacks on user creds
-Emailing forward threats
-Mobile Devices Accessing data

24. Home Office Threats
• Peer to Peer collaboration with unsecure solutions
• Access corporate cloud services through personal devices
• Struggle with the proper disposal of paper items.

25. Home Office Threats
• Share network traffic with other household items
• IOT Devices
• Gaming Systems
• Off the Shelf Routers

26. This is Not a Corporate Network
Company
DevicePotentially Unsecured

27. Recommendations
• Perform an annual risk assessment, with a focus on remote
access policies and procedures. The unknowns far exceed the
knowns if this is your first transition.
• Establish a information systems security framework with
controls tied to organizations business objectives
• Establish formal policies and controls tied to the goals of the
business

28. Free Resources Provided for our Listeners
• User Activity Review
• Controls Review
• And More
Free Microsoft
Office 365 Audit
Report
• Preliminary gap analysis
compared to industry
standards
Cyber Security
Self-Assessment
Survey

29. Rea Partnerships & Resources
Cyber Ohio
DHS
Cybersecurity &
Infrastructure
Security Agency
National
Cybersecurity
Alliance
Common
Vulnerability
Scoring System
NIST
Cybersecurity
Framework

30. Questions?
Brian Garland
Direct Line: 614.923.6584
Email: Brian.Garland@reacpa.com
Conner Mundy
Direct Line: 440.897.4077
Email: Conner.Mundy@reacpa.com