Enabling secure remote working is once again a top priority

Barriers to remote working torn down by Covid-19 pandemic

Unsurprisingly, remote working has been adopted quickly by those working in IT, sales and marketing, business administration and management, and software development. But not all industry sectors and countries have been quick to adopt remote working for a variety of reasons, including the nature of job roles, national and corporate culture, and concerns about productivity and security. However, the Covid-19 pandemic has changed that.

Since the start of the pandemic, most companies have been forced into either expanding their remote working capabilities or enabling them for the first time to return as many employees as possible to productivity.

In the post-Covid era, many organisations will have to adapt to enabling employees to work from home as well as from the office as and when required. As a result, organisations will have to focus on improving their remote working capabilities, particularly in terms of ensuring that people can switch easily and securely between the office and working from home.

This is likely to drive adoption of a zero-trust approach to security or at least the adoption of SASE solutions that potentially enable flexible and secure connectivity to corporate resources.

A more detailed discussion of zero trust can be found in this opinion piece entitled, Zero-trust: Now is the time, and a more detailed discussion on SASE can be found in this opinion piece entitled, Security Think Tank: SASE – marketing buzz or the future of security?

Hybrid working has fast become a way of life

The pandemic has accelerated the adoption of remote working capabilities for many organisations, and we expect that remote working will be more common in the post-Covid era than ever before, with most organisations adopting a hybrid working model in which employees spend less time in the office each week than they did before the pandemic.

The hybrid model allows a greater degree of flexibility by enabling employees to choose to work in the office, at home or elsewhere, depending on the work they need to do and when they would like to do it.

While organisations that previously had a strong office working culture are trying to resist the trend towards working from home, most organisations have realised that it provides the opportunity to scale back the size of their workspaces, it enables them to recruit more easily without traditional geographical restrictions, and it improves the employee experience.

In fact, in the face of the great resignation, many organisations are admitting that they are adopting hybrid working models to retain and attract talent because employees are increasingly deciding whether to accept job offers based on whether the company concerned offers flexible working.

Cyber security implications of increased remote working

The relevance and impact of remote/home working can be summarised as follows:

• There has been a sharp increase in remote/home working since the start of the pandemic that has attracted a huge increase in cyber attacks on remote workers.
• The US Cybersecurity & Infrastructure Security Agency (CISA) has reported that virtual private networks (VPNs), which many companies rely on to allow remote access, are under attack and can no longer be considered safe.
• CISA has also identified the use of single-factor authentication, which means just a username and password to grant user access with nothing else required, as an “extremely risky” practice.
• Remote/home working requires new approaches to cyber security, which means most organisations will have to adapt their security accordingly.
• End user organisations will have to pay more attention than ever before to keeping remote workers safe, especially those working on their own devices such as laptops and smartphones. The trend of giving remote workers a budget for purchasing devices of choice is helping to drive bring-your-own-device (BYOD) adoption even further.
• Security vendors will have to adapt existing offerings or introduce new ones to support remote working, particularly employees who are working from home and accessing resources on-premise and in the cloud via home Wi-Fi and the internet.

Recommendations

In light of the fact that remote working is increasingly a standard requirement and because enabling it can be risky if not done with security in mind, end user organisations with remote workers should:

• Ensure automatic security updates are enabled for all remote/home workers as well as all other users, endpoints, and servers to ensure systems are always fully patched.
• Re-evaluate data security tools/strategy in the context of remote/home working to identify and fill any gaps in data security across collaboration and remote working tools, and BYOD devices.
• Adopt a zero-trust approach to security to require strict user and device authentication and authorisation throughout the network to verify the identity and access rights of the person or entity requesting access.
• Optimize the security tools set to support zero-trust and risk mitigation and retain only those tools that really help to achieve these goals to reduce complexity and increase effective security.
• Implement multifactor authentication (MFA) at the very least to reduce reliance on passwords as the only method of authentication and protect against credential theft through phishing and investigate options for adopting passwordless authentication.
• Implement encryption for all storage and transfers of sensitive data so that even if the data is exposed it will be useless to attackers without the decryption key.
• Update or deploy data leakage prevention (DLP) to prevent the unintended exposure of sensitive data, and cloud access security brokers (CASBs) to extend company security policies to cloud infrastructure.
• Implement a privileged access management (PAM) solution to monitor, log and control all activities by privileged users.
• Implement effective endpoint protection, detection and response (EPDR) solutions for all devices and a unified endpoint management (UEM) solution to improve security around BYOD devices.
• Consider using a cloud-based desktop as a service, virtual desktop, and secure remote access solutions where employees are using their own laptops instead of enterprise owned and maintained devices to ensure security policy enforcement.
• Evaluate whether SASE cloud architecture is the right approach for your organisation to enable workers to access cloud-based and on-premise services securely from anywhere on any device.
• Plan for the worst by implementing systems and processes or services to enable the organisation to detect, respond and recover from breaches, including a defensive SOC, SOAR and resilience capability.
• Educate employees about security risks by implementing regular, short, focused awareness training to improve understanding of threats, attacks and their role in improving security.

Remote working, particularly working from home, is here to stay. In the post-Covid era, organisations are adopting more flexible policies on where and when people work due to increased demand from employees. It is therefore important that enabling remote working in a way that is safe and secure is a top priority for all organisations.