With 59% of workers who can work remotely still doing so at least sometimes, the return to full-time office work has yet to return to anywhere near pre-2020 levels. Moreover, though initially intended to minimize health risks during the pandemic, most workers (71%) yearn for some blended or flexible office provision rather than returning to the pre-COVID norm. This suggests that the proportion of remote and hybrid workforces will remain significant in many verticals moving forward.
However, this enlarged remote and hybrid workforce creates several serious cybersecurity issues for enterprise security teams, including:
- Broadened attack surfaces: Enterprise security generally sets strong perimeter defences that leverage monitored networks, encrypted communications, and firewalls to keep company devices, data, and users safe. The move to remote working means that new devices and networks have to be covered, in addition to the software that enables remote working itself, such as communication applications and remote desktop protocols (RDP). All of these give attackers multiple new ways to hack your system.
- Focused attacks: Cybercriminals have recognized that the move to remote work presents an opportunity. As a result, they have greatly ramped up attacks targeting individual workers, such as phishing, password spraying, and social engineering attacks which have all at least doubled since 2020. These attacks also prey on the fact that remote workers will rely on help desks more, using partial credentials to impersonate workers and change passwords.
- Weaker approach to security: Understandably, workers feel more relaxed at home, but this also has negative consequences for security. With the merging of home and office, workers may not perceive threats the same way and become laxer about how or where their passwords are stored or to whom they give out information.
- Vulnerable home networks and personal devices: Workers logging in to an enterprise network are creating a potential backdoor for hackers to do the same and, at the least, are vulnerable to Man-in-The-Middle (MiTM) attacks where traffic is intercepted going both ways. Remote work also means that personal smart devices access the same network used for work, children’s devices, and home IoT appliances, creating numerous potential malware injections or network snooping vectors.
Various security best practices should be followed to overcome the challenging security picture that remote and hybrid working presents to IT security teams. In this blog, we’ll look at the most important ones.
1. Using Cloud-Hosted Applications
The less data that’s held locally, the safer it is. Home devices and networks can be easily hacked, but if all work data is automatically cloud-hosted, it won’t be accessible. A separate login to a cloud-hosted workspace also creates an extra layer of definition between work life and home life.
2. Connect through a Secure VPN
A virtual private network (VPN) uses tunnelling to create a virtual point-to-point connection between the enterprise network and a home user. This allows administrators to provide users with access to specialized resources after securely authenticating themselves. It can be used instead of an RDP.
3. Implement Multi-Factor Authentication (MFA)
Authentication is one of the weakest links in any security posture due to how vulnerable passwords are as an authentication factor. Multi-factor authentication (MFA), especially passwordless MFA, seeks to improve security by requiring users to provide different identifiers such as something they own (a device or login key) or something they are (a biometric feature such as face scans or fingerprint).
4. Integrate Mobile Device Management (MDM)
Mobile device management gives IT administrators the power to apply uniform security protocols and policies across all devices being used in the company. This is essential for remote workers who may mix personal and work devices as it ensures that work devices maintain appropriate security standards.
5. Create Clear Policies
Suddenly moving to remote work and the lack of clarity around returning to the office has caused a considerable strain within many companies. Security also suffered, and a major lesson learned by IT teams is that creating extensive documentation on how people should maintain security standards makes it a lot easier to adhere to best practices.
6. Provide Staff Training
Along with home working security policies, staff should also be given training on keeping themselves and the company’s equipment safe. This should include advice on using different kinds of networks, remote locking their devices, and identifying and reporting phishing attempts.
7. Use Endpoint Security
Enterprise endpoint security can now perform comprehensive security checks on any endpoint device (desktop, laptop, smartphone.) This enables better data protection and malware protection. While it doesn’t secure against attacks completely (such as MiTM or password-based), it can significantly bolster remote working defences.
8. Perform Penetration Testing
Regular pen testing will allow your IT security team to identify flaws in your security posture. In the case of remote working, spoof phishing attempts can also highlight to workers how susceptible they are to these types of attacks.
Conclusion
Working from home increased significantly in many industries during the pandemic, and it seems to be here to stay, at least in a hybrid form. This creates many issues for enterprise security teams due to increased attack surfaces, vulnerable home devices and networks, and lax approaches to security. Unfortunately, cyber attackers have followed suit by significantly increasing the number of attacks targeting home workers.
The solution is for enterprises to implement best practices, requiring MFA for sign-in, using cloud-hosted work applications, and leveraging VPNs. However, for home working to become as secure as office-based, it will require a significant paradigm shift, both from security teams and workers.
Cory Porteous
Director of Marketing
Office Interiors
