"CISOs should be prepared for more people working at home. They should be preparing their help desks for social engineering attacks as there may be more general connection issues, more general IT issues and more calls to the help desks."
stephen bailey, PA it expert
PA’s Stephen Bailey, IT expert, is interviewed for the Financial Times on the impact that the Olympic Games will have on IT. Stephen talks about cyber criminal activity that could pose a threat to organisations and the steps they need to take to prevent becoming victims of cyber crime.
Transcript of interview
Stephen Pritchard (SP): How well prepared are businesses for the Games. The London 2012 organisers have asked companies to recommend that some staff stay at home during the Olympics. There are concerns that the sheer volume of Olympic activity could cause disruption and some security risks, says Stephen Bailey, an IT expert at PA Consulting Group. There will always be a criminal element that sees a large event as a chance to make mischief.
Stephen Bailey (SB): There’s going to be a lot of people out there and the cyber criminal world is going to see this as a great opportunity to try and make some money or to exploit the Games and use the event as a platform to bring to the fore whatever issue it is that they might have.
SP: Would there be a political point?
SB: It could be a political point or it could just be to embarrass the government if some groups decide that there’s something that the government is supporting that they’re not happy with.
SP: How active have the authorities been in your view in terms of preparing for that type of event?
SB: They do appear to be doing quite a lot of preparation. I think a lot of the public information that is coming out there is seen to be focussing around trying to keep London running during the Games. It’s mainly around transportation and I think they need to move away from that a little bit to include things like making people aware of the dangers of social engineering, for example.
SP: Is there likelihood that if there is some form of a cyber attack aimed at the Games it could also have quite significant impact on businesses that operate in the London area?
SB: It could do. Certainly if there was a cyber attack that affected the transport system, for example the tube, by bringing down the oyster network or affecting signalling, the effects would be disastrous. Very quickly crowds would build up particularly in places that are transport hubs like Victoria station.
SP: What about the internet infrastructure? Service attacks on key points in BT’s network or other key suppliers’ networks.
SB: That would be a good place for people to attack. It would affect businesses and also people’s enjoyment of the games, which is something that the government is very keen to try and avoid.
SP: What should Chief Information Security Officers (CISOs) and company IT heads be looking at in terms of protecting their own operations to ensure that they can continue business as usual especially in the electronic realms.
SB: As well as the normal, very specific IT related things like ensuring maintenance is brought forward, that patching is up to date, anti-virus is up to date and has been deployed to all of the end points, they should also think about the people side of things. Social engineering presents a great opportunity for cyber criminals with an event such as the Games.
SP: Do you think that companies that are directly involved in the Games may be more vulnerable than those that are on the periphery?
SB: I think they will because a good way for anyone who wants to try and tarnish the image of London 2012 would be to attack some of the bits of infrastructure that are around that.
SP: Some companies that are directly involved already have moved into a phase of lockdown where they are not going to update IT systems between now and the games to ensure that their technology is stable. Is that advice that other people should follow? Is it generally a good idea to ensure that you’ve done all of your maintenance, any systems that you have are running and tested and that any critical business system updates are not deployed during that time when it might be difficult from a logistics or transportation or even bandwidth point of view?
SB: I think that’s a very good idea for a number of reasons. Having a stable network during the Games is key. Organisations will have a lot of resource away enjoying the Games and the last thing people want to do, if they become the subject of a cyber attack, is worry about what could be considered less important, for example trying to getting the cooling working again in the server room, because an air conditioning unit that was due for maintenance has suddenly failed.
SP: The government has been encouraging companies to look at whether more staff can work from home or remotely. That in turn puts pressure on IT departments and IT help desks as well as other resources. It potentially increases the vulnerability of organisations if they have not encrypted their devices and people are being encouraged or find themselves having to use these things in public areas over Wi-Fi. Again is that something that CISOs should be aware of and should be taking action to ensure that they are prepared?
SB: CISOs should be prepared for more people working at home. They should be preparing their help desks for social engineering attacks as there may be more general connection issues, more general IT issues and more calls to the help desks. They should be ensuring that their operators know what to look for in terms of a social engineering attack, but also that they drum into them to do what they normally do around ensuring the person they are talking to on the phone is a genuine person and has a genuine problem – it’s quite an important thing for them to be doing. On the subject of encrypting end points, that’s something that people should be looking at anyway and not just because the games are coming up. People should be looking at their high value assets and where they sit and whether encryption is one of the ways for protecting them. If so, they should be rolling that out.
SP: Stephen Bailey on the need for businesses to ensure that their systems are secure and resilient during the period of the games.
To listen to the interview in full, click here.