Idioma:Castellano English

During this lockdown due to COVID-19, many companies from all sectors have been pushed into using the famous remote work. Setting aside the organizational problems associated with remote work for companies not familiar with this practice — like managers who don’t believe workers are actually working if they can’t see them sitting at their desks, slow or non-portable computer equipment, and so on — what worries me most is the companies that have gone for lowcost remote work setups, with the associated risks we’ll get into now. So much time talking about digital transformation, industry 4.0 and all those concepts… and when it comes down to it, we get it wrong .

Business Continuity Management

It’s not my intention to talk about Business Continuity even though I’ve spent many years working with the standard used as the basis for Business Continuity Management, ISO 22301. And I don’t intend to talk about this because nobody could have foreseen a business disruption of such magnitude that it would keep workers, suppliers, carriers and customers at home for more than a month. There was simply no precedent of this kind, which is why the Probability coefficient in risk analysis led us to rule out this type of threat. What bugs me is that for months now people have been talking about ‘digital transformation’, about modernizing industries toward a 4.0 approach (I think we skipped 3… or at least I never got the memo) and about the inclusion of technology across all sectors… and I’m afraid that in many cases this wasn’t entirely true. Many companies have been forced to suspend operations, put workers on furlough, and do little more than throw up their hands, because in reality they were nowhere near this so-called ‘digitalization’. Some of these are the very same companies that had been selling us the concepts of digital transformation in talks and events. What a joke. Others, in order to support their workers and appear modern, have rushed to open up their corporate servers to the Internet without the minimum security analysis and requirements that would have been advisable, so running a search on Shodan we can find abominations like these: Shared folders exposed to the Internet: No firewall or anything of the sort, just the shared folder accessible from anywhere so workers can keep accessing company resources. Accessible remote desktop: Windows Remote Desktop has had various vulnerabilities throughout its history that make it inadvisable to expose it directly to the Internet… yet there are no fewer than 36,109 IP addresses with remote desktop accessible from anywhere. BONUS TRACK: We can dig even deeper and find, for example, Windows XP with remote desktop accessible from the Internet, despite the fact that vulnerability CVE-2019-0708 was never patched by Microsoft. Speaking of Windows XP: Support for Windows XP ended in 2014… yet there are still services published on the Internet from a Windows XP machine, with all the vulnerabilities that entails. 2,300 SQL databases exposed in Madrid alone: Sure, we don’t have the username and password, but the sheer number of MySQL versions exposed in Madrid alone includes some with serious vulnerabilities that allow remote root access. Not to mention the typical security cameras with no username or password, or with default credentials like admin/1234… though this worries me less right now, since nobody can leave their house, so at least in theory they can’t rob us at the office.

Chernobyl, the series

I don’t know if you’ve watched the Chernobyl series that aired on HBO a few months ago, but it perfectly captures the idea I wanted to convey. Without trying to spoil the series, since the Chernobyl nuclear accident is history, one of the mistakes that led to the reactor core exploding was rushing things: the night shift had to carry out a safety test that couldn’t be run during the day by the team that actually knew how to do it properly, so it was carried out in a hurry and without the correct instructions. Just as it’s been proven that it’s not a good idea to run a nuclear plant’s safety test at night with an inexperienced team (it’s usually best to postpone it to the next day or to a more suitable time window), we shouldn’t be putting a server into production, opening up a service to the world without checking its security, or installing apps on our devices without checking them first, just because we’re in a rush to work remotely from home — otherwise we’ll run into problems like the ones we’re seeing these days. They learned their lesson at Chernobyl — the person in charge of operations at reactor 4, the one that exploded, spent 10 years of his life doing forced labor… and that was in the old Soviet Union, so you can imagine those 10 years weren’t exactly a walk in the park. Don’t rush into rolling out technology in your company without the same security measures, checks and tests you’d apply at any other time.

¿Necesitas ayuda con tu domótica?

Te ahorro tiempo, dinero y disgustos. Sesiones de consultoría desde 60€.

Ver opciones

Conversación

7 comentarios

Fco Javier Soler dice:

14 abril, 2020 a las 08:01

Gracias Sr Sahuquillo, tal y como lo cuenta, asusta bastante, aunque sea muy real. Espero que las empresas cambien su mentalidad a raíz de esta crisis.
Un saludo

Responder
1. csahuqui dice:
  
  14 abril, 2020 a las 08:39
  
  Gracias Javier por tu comentario! Yo también lo espero, sería muy triste no aprender la lección para poder mejorar en el futuro… ya no solo por si viene otra crisis similar, sino para mejorar nuestros negocios y hacerlos más robustos y resilientes
  
  Responder
Fernando dice:

14 abril, 2020 a las 12:14

Muy bueno Carlos, desgraciadamente se nos ha llenado la boca de teletrabajo pero como bien dices sin estar preparados, yo, como optimista redomado que soy, estoy convencido de que de todo esto vamos a sacar muchas enseñanzas que nos permitirán afrontar mejor las situaciones que seguramente están por venir… para cuando un webinar de esto??? Gracias!!

Responder
1. csahuqui dice:
  
  14 abril, 2020 a las 17:13
  
  Gracias Fernando! No sé si da para webinar ya que al final son ‘pajas mentales’, pero coincido contigo, de esto se van a sacar muchas lecciones aprendidas… espero que algunos empresarios hayan visto que es posible confiar en el teletrabajo, y no solo porque el empleado puede ser igual de productivo desde su casa, sino porque es más barato para el empresario que ahorra costes del puesto de trabajo, puede reducir oficinas, etc y para el empleado porque no tiene que pagar gasolina o transporte público y perder tiempo no-productivo en desplazamientos.
  Además a algunos ya nos está enseñando que vivíamos demasiado deprisa, corriendo a todas partes para llegar a mil sitios.. cuando en realidad muchos de ellos eran prescindibles. Y por supuesto que estábamos gastando demasiado.
  
  Ya te digo que no sé si da para un webinar serio, pero… y si nos inventamos un nuevo tipo de webinar que se haga con una cerveza en la mano y hablando todos a la vez como si estuviéramos en un bar? Jajajaja
  
  Responder
Alvaro Garcia Izquierdo dice:

15 abril, 2020 a las 10:52

Buenisimo post, como siempre

Responder
1. csahuqui dice:
  
  15 abril, 2020 a las 12:25
  
  Muchas gracias, Álvaro! Me vas a ruborizar 😀
  
  Y ya puestos, podrías darle un apretón a tu blog, macho, que lo tienes un poco abandonao y es la mar de interesante.
  
  Responder
  1. Alvaro Garcia Izquierdo dice:
    
    21 abril, 2020 a las 13:11
    
    Jajaj, si, estoy aprovechando la cuarentena para ello.
    Pero no me da la vida, trabajo, familia…ya tu sabesss
    
    Responder