Though there is some talk about a COVID-19 vaccine going into circulation as early as January, the world still does not know when the pandemic will be over. Regardless of how that develops, some of the changes caused by the extended shutdowns and social distancing measures are likely to remain as the “new normal.” One of the central expectations of this nature, and one that is reinforced by a new report from Cisco, is that secure remote working procedures will be a high priority for all types of organizations as many employees continue to work outside of the traditional office.
An increased focus on security is key as both potential vulnerabilities and attempts by threat actors have jumped considerably as workforces decouple from brick-and-mortar facilities. Though the threat level is only projected to increase if remote workers stay at home, organizations are still struggling to keep up with the change. However, the study indicates that this is not for lack of awareness or budgeting as 89% of organizations reported that cybersecurity is now the top corporate priority.
Secure remote working, endpoint vulnerabilities here to stay
Cisco’s secure remote working report (“The Future of Secure Remote Work“) surveyed over 3,000 IT decision makers from 21 regions of the world. These decision makers represented over 30 industries and a wide variety of organizational sizes, with responses collected from June 16 to September 4.
The survey took place in the middle of the current stretch of the pandemic, with organizations having had several months to adjust to remote work environments and establish their procedures. 62% of respondents said that more than half of the workforce had transitioned to working from home; 37% said that they expected to continue this arrangement even after the COVID-19 pandemic comes to an end. These numbers were very consistent regardless of organization size, but there were some regional differences — American and European countries, which generally experienced more unfavorable COVID-19 numbers, have substantially more of their workforces transitioned to remote work than Asia Pacific organizations. The UK and US also had 50% of respondents say that they plan to keep remote work policies in place past the end of the pandemic, along with 53% of Brazil and India.
This transition to a long-term remote workforce has introduced a considerable collection of new security challenges. Organizations around the world seem to have recognized this, with the overwhelming majority rating cybersecurity as either “extremely important” or “more important than pre-pandemic.” The world’s hackers know full well that these new opportunities exist, which is reflected by a marked increase in reported cyber threats: 61% of respondents say that the organization has seen an increase of over 25% in threat activity since COVID-19 measures began.
Attackers do seem to be somewhat selective in the industries that they pursue, however. The categories that have seen the largest jump in attacks are architecture and engineering, chemical engineering and education. While none of these are unsurprising due to the valuable trade secrets and internal information that they tend to have, attacks on these industries outpace some of those that were expected to be category leaders: financial services, health care and software development. However, nearly all industries across the board are seeing substantial jumps in threat activity — usually at least 50% reporting that activity is up by at least 25% during the pandemic.
While 89% of organizations are now making cybersecurity a priority issue, that does not necessarily mean they are prepared and confident as of yet. The most common response was that the organization is “somewhat prepared” (53%) for more employees working from home, with 6% reporting that they are unprepared. Preparation levels are slightly higher in Europe than in other regions, possibly an effect of the GDPR.
Changes to tools and strategies in response to COVID-19
Unsurprisingly, 96% of organizations said that the COVID-19 pandemic has caused changes to their cybersecurity policies. These changes are centered on the need for secure remote working systems: 59% pertain to increased VPN capacity, 55% incorporated new web controls and changes to acceptable use policies, and 53% have new multi-factor authentication (MFA) requirements in place. 95% of these organizations reported that they expect at least some of these changes to be permanent.
As mentioned earlier, these changes are ongoing as over half of organizations report only partial confidence in their ability to maintain secure remote working postures. 59% say that employee training and awareness is the biggest challenge at present, 50% are overwhelmed by all of the new remote access tools and their associated requirements, 35% are frustrated by inconsistent interfaces, and 31% feel they are struggling with a lack of visibility.
Organizations plan to stay the course in spite of these new challenges presented by secure remote working requirements. About 65% of respondents say that they plan to increase cybersecurity spending even after the pandemic subsides, with only about 10% committing to decrease budgets once COVID-19 is under control. The majority of organizations see this increased spend on securing remote work falling in the range of 1% to 30%, but a substantial amount (36%) expect it to be above 30%.
50% of UK and US respondents plan to keep #remotework policies in place past the end of the pandemic. #cybersecurity #respectdataClick to PostCisco reports that organizations that had already been on a schedule of making incremental and continuous investments in security measures prior to COVID-19 ended up doing the best job of handling the transition to secure remote working. Key recommendations from the study include integration of the handling of security and collaboration, the immediate implementation of a solid employee education program, and the use of a zero-trust strategy in handling employee access management across the entire network.
