How to liberate hybrid workers while locking down the business
One of the many consequences of pandemic lockdowns that forced people to work from home was a spike in cyber threats, specifically phishing attacks that targeted employees who might be more susceptible to email scams when away from the office. Now that most companies are looking at a hybrid combination of home and office working, it’s incumbent on businesses to mitigate those risks and others.
The paradox in liberating employees to work from anywhere is that the business must be rigorous in locking down the technologies that enable them to do it. Some steps for achieving this are more straightforward than others, like moving to the cloud. Providing remote access from the cloud is much simpler and more cost-effective than doing it from an office. Most organizations will have some hosted applications at this stage, typically Microsoft 365.
Cloud platforms provide a more integrated approach to security and do away with legacy VPN networks and clunky sign-in processes. Subscribe to Microsoft 365, as many organizations now do, and there’s no need for a VPN. Encryption and security are built-in with multi-factor authentication, enabling people to work securely from anywhere – from their homes, at the café or the airport.
Moving workloads to the cloud also relieve the IT department of refresh cycles and patching processes that ensure apps and services are always up to date and secure. It’s a good first step but there is still plenty of work to do.
Never trust, always verify
Every organization should put a security framework in place and adopt a zero-trust approach. The ‘never trust, always verify’ mantra is a guiding principle to follow as you navigate the complexity of hybrid working, which breaks down the traditional office perimeter. The need to have controls to protect employees, devices, applications, and data becomes more challenging,
Authentication and authorization controls are the foundation for making hybrid working secure. Authentication is about ensuring the person logging into your systems is who they say they are. Abnormal behavior can be an early indicator for a stolen ID – someone seeking access at a time that wouldn’t be typical of them, for example, or via a device that’s not familiar. It is a level of trust based on context.
Once you’ve identified the person and you trust they are who they say they are, it’s about authorizing access to the apps and services they need to do their jobs. This relates to personae profiling – explored in other blogs in the ‘Let’s Make Hybrid Work’ campaign. It’s an example of why Ergo favors a holistic approach to hybrid working, with six interconnected components that help achieve the right balance between liberation and locking down.
Best forms of defense
The good news is that wide-ranging tools are available to layer security across an organization’s infrastructure and lock it down; however, these tools are distributed among the workforce. Access and identity management tools are crucial, particularly for people working remotely, ensuring you can verify who is logging into systems and apps. Moving to a pass wordless environment is the best way forward; personalized virtual smart cards are another way to go. Multi-factor authentication should be enabled for all critical systems.
To aggregate and analyze activity across the security layers that encompass everything from the hybrid worker’s device to the cloud, you need a SIEM (Security Information and Event Management) solution, a single data source for detecting threats and triggering a response to an attack or a breach. Typically coupled with an MDR (Managed Detection and Response), a 24/7 managed security service, it gives organizations end-to-end coverage, from detection to investigation, containment and response.
At Ergo, we recommend Azure Sentinel as a SIEM and tap into Microsoft’s security resources. Microsoft has invested $20 billion in cloud security over a five-year period, and processes 24 trillion security signals every 24 hours from endpoints, products, services, and feeds from around the globe. More data means better intelligence, arguably the most important weapon in the war against ransomware, supply chain attacks like SolarWinds, and other emerging cyber threats.
What to do after a breach
The hard fact of life for every business is that there’s a good chance you have already been breached, and if you haven’t, you are more likely to be when you move to a hybrid working model – zero trust principles assume the worst. As SolarWinds demonstrated, a new kind of threat can undo all the benefits of cloud-based infrastructure and layered security. This is why threat remediation is so necessary.
Integral to security management is having the tools to detect a virus in your systems and mitigate spreading and infecting other parts of the business. Being able to remediate an attack as quickly as possible is vital, which includes identifying and fixing the vulnerability that allowed it to happen in the first place.
Businesses also need to think about wrapping the most robust defenses around their most valuable assets. A risk management assessment will reveal what they are. It could be personal information in customer-facing organizations, like banks, where there are strict regulatory requirements around data management. In a pharmaceutical company, intellectual property may be the crown jewels that need the most protection.
People still the weakest link
Policies and procedures, shared with and signed off by employees, will be a big part of the security framework. People remain the weakest link because it’s hard to protect against them clicking the wrong link or revealing too much about their jobs on social media, unwittingly attracting the attention a hacker.
Phishing scams are part of an endless stream of social engineering scams designed to make us slip up. More and continuous training is needed, particularly as home working has exposed people to more risk. Device management is key, whether it’s through desktop virtualization or issuing employees with company laptops laden with endpoint security. But human error will never be eliminated, which is why breach remediation is so important.
A tried-and-tested DR (Disaster Recovery) plan is also imperative, particularly if the worst consequences play out. This takes us back to where we started, and how the cloud has changed the landscape, not just for business-as-usual activity but also for business continuity plans. Mirrored virtual infrastructure enables faster recovery time objectives with a lot less investment and complexity.
The number of zero-day attacks, where new vulnerabilities come to light, reached an all-time high in 2021, and there’s little reason to expect this year will be any better. The sheer volume and sophistication of threats means that the best-practice security outlined above may not be enough to prevent or fully contain a breach, but implementing a thorough security framework is still the very least organizations should do.
