When the coronavirus first emerged, it wasn’t clear just how long restrictions like social distancing would last. By this point, it’s fairly clear that this is going to be an extended ordeal, and many firms are relying on remote work forces to protect business continuity.
Remote work has been a saving grace in these tumultuous times. Even just a few years ago, IT infrastructure would have struggled to so quickly and effectively handle such a massive increase in remote users.
The System Works… Now Make it Safe
In the first days of the pandemic, there was a mad scramble to simply get fully remote workforces up and running. The initial priority was basic operational readiness, security concerns were raised but didn’t take precedence.
For example, it was widely known from the start that video conferencing app Zoom had serious security inadequacies, but it took several days or even weeks before many organizations restricted access for their employees or provided guidance on the issue.
Several months into the pandemic, the goal has shifted to providing remote workers with an experience that is nearly on par with their office systems, including and especially in regard to security. With strong IT oversight, adherence to best practices, and proper utilization of security tools, remote work can be made safe, secure, and reliable.
Even before the pandemic, many companies, large and small, had been increasingly experimenting with flexible work and work from home options. Employees valued the freedom to work anywhere. Employers benefited from reduced office overhead. For IT departments, this development introduced a whole range of new concerns, though.
Keeping track of all the users in an office environment was already taking up a lot of mental bandwidth, and now they have to monitor, protect, and facilitate individuals connecting to their corporate networks from a wide variety of offsite endpoints that IT can’t directly control.
Admirably, many have risen to the challenge. Here’s what they are doing to keep remote work secure:
Limit Home Hardware
A big concern among IT professionals servicing home users is their inability to inspect the networking equipment in their users’ homes.
Users are notorious for making seemingly tiny mistakes that have dangerous implications, like failing to set a password for their router, using the default password, not enabling encryption, or skipping critical patches and updates. Plus, consumer-grade hardware isn’t hardened against cyber attacks to the same degree commercial equipment is.
Some IT departments have responded by quite literally shipping out office networking gear to their employees homes, but most others have worked around this problem by providing ample consultation with users to help them properly secure their home networks.
BYOD (bring your own device) policies are great for the flexibility they afford employees but require serious and thoughtful security oversight to manage.
Use a VPN
Virtual Private Networks (VPN) are a technology that allows home users to link up over encrypted channels. “In general, private networks will throw off a lot of would-be intruders, help you remain anonymous, and make it significantly more difficult to spot you,” said Nate Masterson of Maple Holistics, a personal care ecommerce site.
Note, however, that a VPN isn’t a security panacea. The Department of Homeland Security’s Cybersecurity and Infrastructure Security Association (CISA), issued an alert in April warning VPN services to be vigilant: “As organizations use VPNs for telework, more vulnerabilities are being found and targeted by malicious cyber actors.”
Limit IoT Devices
Strange though it may seem, that Peloton stationary bicycle or Samsung Smart refrigerator is now a dangerous attack vector, a weak point that hackers can exploit to enter a network without authorization.
Any device with built in internet connectivity, no matter how innocuous it appears (e.g. video doorbells, smart speakers, or even Wifi light bulbs), must be routinely monitored and potentially have certain features disabled to limit the risk of intrusion.
Provide Regular Security Guidance
Security measures that are commonsensical or second nature to IT professionals aren’t always so well understood by general users. Security personnel should be routinely sharing tips and instructions to remote workers to inform them of risks they need to look out for, for example:
- Never leave a computer with company data unattended or unencrypted
- Don’t enter your password if a person or camera can spot your keystrokes
- Make sure antivirus and firewall software is installed and running on all devices
- Don’t use USB thumb drives from strangers (they can contain hidden malware)
- Use a USB data blocker when charging a mobile device on a public port
Additionally, phishing and ransomware attacks are on the rise. Continually advise all users to look for potentially falsified communications, report them immediately, and never click anything that looks even remotely suspicious!
Require Multi-factor Authentication
Though passwords are the most common authentication credential, they aren’t the only one. Others include SMS or email confirmation, biometrics (e.g. fingerprint or face detection), and physical tokens. Using two or more drastically reduces the risk of unauthorized access.
For the passwords they do use, ensure employees use strong, randomly generated, unique access codes (password generators and password managers can help here), and encourage them to keep them secret and change them routinely.
Some organizations take things even further, such as Earl White, who runs a real estate investment company: “Employees are never allowed to share passwords in writing. Whenever a password is provided to an employee, it is done via telephone and directly inputted into the password protection service.”
Deploy a Secure Application Gateway
A Secure Application Gateway goes a long way towards simplifying the task of tracking the diverse connections to a corporate network. It’s a unified screening room that remote work devices must pass through before access is granted to the network.
Track and Log Everything
With employees logging in from unknown sources and endpoints with questionable security measures in place, the IT team has to be extra vigilant about tracking all users and data. Keep a close eye on your Security Information and Event Management (SIEM) solution for anomalous patterns.
Alerts should be in place, for example, to notify security personnel when one account is being used in multiple places simultaneously.
What Comes Next?
Some of the changes that were put in place to confront this pandemic are proving to have usefulness that will transcend this moment and become a permanent fixture in the modern workplace. Diversity of people, places, and devices is the new normal.
Corporate networks, even for small and medium-sized businesses, must adapt to manage increased complexity — and the new and multiplying security concerns it raises.
Are you concerned about the security of your remote workforce? D2 takes a pragmatic and collaborative approach to IT that helps businesses harden their security posture while sustaining their workforces, both in the office and remotely.
