Maintain Business Continuity with e360 During COVID-19 Outbreak

1. Identify user requirements. Do they just need e-mail and some websites? Do they just need a VPN? Can you simply add a collaboration tool like Cisco WebEx or Microsoft Teams? Do you need to provide virtual desktops or virtual apps (keeping data off unsecured endpoint while centralizing administration)? Do you need to provide enterprise file share tools such as Microsoft OneDrive/Teams, Citrix Files, VMware Workspace ONE, Google Drive and others? These are the questions you must ask, and the solution may still come down to what we deal with in our End User Computing practice every day:

• Security: Is your organization willing to take the risk with data on endpoint (secured, semi-secured, or unsecured)?
• IT: Is your organization able to deliver/install all the necessary applications on users endpoint and keep it secure?
• End Users: Will the corporate applications perform well enough to do their job? (Users may expect performance to be “in the office” speed and not understand the difference when accessing data remotely)

2. Leverage and extend what you already own. If you must deploy new technology quickly, you can rest assured there will be shortcuts in deployment (e.g. turning off security features because of lack of licenses) or normal processes will be skipped (e.g. not updating a CMDB that results in no backups occurring). Leveraging and extending technologies you already own will make it easier for IT staff to support, and in handling any conversations with vendors about licensing/procurement options. Also, new technologies will have new requirements that you may not have setup resulting in delaying the initial deployment while requiring change to your existing environment. While it may not always be the most effective at scale, an already known and functional solution is worth it to avoid the risk of a new solution.

3. Understand scale. Increasing a large workforce to work remotely will put a strain on infrastructure and resources within your organization and may also be affected by external resources. Here are some question to ask yourself:

Internal

• Is there enough network throughput on your external internet connection or remote access solution?

• Do you have enough compute and storage infrastructure for the additional capacity?

• Do you have enough licenses for the additional demand (e.g. MFA licenses, Microsoft RDSH/VDA Licensing, anti-virus, security tools, software deployment licenses, VPN licenses, etc.)?

External

• Will additional hardware (compute, storage, etc.) be available when I need to acquire it?

• If you order more software license, how long will it take to obtain the licensing? If you initiate a BC plan, but it takes 72 hours for an order to process, is that an issue?

• Most likely you are not the only one going through the planning so external consultants or access technical resources might difficult as you and other organizations compete for resources.

And while cloud might be a way to address scale, does your organization have all the requirements in place for delivering services from the public cloud the same way you deliver services from on-premises? Will the processes be different? Do you have the same network, security or monitoring tools in-place to ensure a seamless experience? Hopefully some of these are already in place, but if not, then hopefully you have time to consider them.

4. Educate your users/management on how to work remotely. Users don’t typically respond well to change. Working remote will be very different for everyone in the organization. Managers are used to seeing people sitting at chairs from 8AM to 5PM. Workers are used to walking over to someone to ask question. Workers will also get distracted with the everyday workings of the home (and possibly new situations such as quarantines or sick family members at home). You must educate users to focus on task completion and timelines, while at the same time educating managers to understand task completion timelines and goals. If it takes 1 hr at 6AM, or 15 minutes every hour from 1 to 5PM, task completion and timeliness of your remote workers is the most important aspect of working remotely. (This is advice from an organization who has a remote workforce for 30+ years with about 75% of users working from their homes.) 5. Ensure that cybersecurity risk is not unduly compromised for the sake of expedience and cost savings. When moving to an alternate site or remote work solution it is imperative to understand the evolving threats and risks of this new environment and manage them accordingly. Priorities such as expedience and cost should be balanced with security using a well-defined risk management approach.

It can be very easy to turn off multi-factor authentication to reduce complexity or reduce licensing costs. The risks of this decision must be known, documented, and accepted by a defined set of stake-holders. It can be easy to stand up a VPN for remote access without first defining data flows and the associated risks. It can be easy to change security policies to allow untrusted devices to access documents and the network to quickly address the user community

These decisions should be made with a clear definition and understanding the threats, vulnerabilities, and overall risk to the organization.

7. Plan what your post business continuity plan will look like.