Herd immunity refers to high level of immunity that exists within a population. Many large scale vaccination programs have shown improved results from transmission of infections over large scale or herd of population. The disease must spread via contact with another member of the community. Similarly infections and their transmission in form of phishing attack, ransomware and other deadly cyber-attack are similar to IT organizations. The principles associated with herd immunity can be effectively used to patch large systems in IT world as well.
In various IT organizations system patching works as immunization similar to vaccination. And all patches should be applied according to the critically level assigned by IS security.
Various strategies used in healthcare can also be applied to protect the unvaccinated systems and technologies against cyber-attack. Are our preventive capabilities and capacities adequate? Can we rely on external service providers in a cyber-pandemic, given the demands on their resources? Are our data platforms on which applications operate are threat-resilient?
Three Critical levels and relevant patch deployment effort taken up within organizations:
Low level: In this level the effort is made to apply the patch and the percentage of system patched is not tracked.
Medium level: The effort is made to apply patch to 90% of active systems, outside the data center within 45 days. The patch is applied to 90% of active data center systems within 90 days.
High level: Patches are applied to 100% of active systems outside the data center within 45 days. And within 90 days patch is applied with best efforts to 100% of active data center system.
Digital Herd Immunity is a form of cyber security that is attained when all companies (public & private) build a security base that makes it difficult for both cyber criminals and state funded actors to launch an attack in a cyber-landscape.
Network connectivity is a requirement of every organization and servicing the systems that are deployed is not a trivial task. Lot of software updates and patches are required and there can be disruptions to normal functioning of operations. Sometimes it is difficult to patch the entire legacy system and this is the dilemma faced organizations weather to patch the entire system within the framework or step by step.
The unprecedented health crisis that came along, in Covid-19 must never take away focus of cyber professionals to adequately focus on cyber security strategies and give an upper hand to cyber criminals. This is also in the same way we are strengthening our defenses against Covid-19 and overlook the exposure to cybercrimes.
- Focusing more on dedicated targeted attacks that happens and their mitigation at a faster rate, huge difference can be made
- Cover up lot of low level attacks and a lot of people and consumers or businesses could be taking care of with some simple steps to secure themselves for any type of cyber-attacks. The herd immunity analogy will then start working.
- Cyber criminals are known to use various botnets to target large number of unprotected computers and its one of the difficult to slow down by cyber security professionals. But once the problem is identified then immunizing it globally will help protect hundreds of other devices. There are varieties of attacks laid against computer and the number is infinite. The malwares also often employs number of anti-analysis techniques that makes it far more difficult to protect a computer then a human.
The idea is to raise the bar for all the bad actors and secure all in the long run. Every year there are huge losses, which arise from cybercrimes and these losses impacts customers, organizations and countries as well. In the era of Covid 19 more individuals are compelled to work remotely and this shoulders more responsibility on part of organizations to maintain proper controls on sensitive information, data and other critical functions.
Any threat must be treated with their own forms of hygiene kit to prevent from spreading the infection. This will happen with creating awareness on cyber hygiene amongst the employees and training and skilling them. Employees and customers if they take small preventive measures on their part like not clicking links from untrusted users, or not providing accounts details to unknown sources and adhering to multi factor-authentication can be powerful tools.
Lot of companies are using cloud services, are always on high alert and confirms that their security configurations are strong and monitored round the clock for any unauthorized manipulation. The IT departments of organizations must ensure configurations are up-to-date, any anomalies or vulnerabilities discovered are patched immediately. Attempts to connect from suspicious internet address are detected as quickly as possible. Any such addresses are to be blacklisted and access to corporate network to be restricted.
(Image Courtesy: www.i.pinimg.com)