One of the outcomes of COVID-19 has been our newfound openness to remote work. According to a recent PwC survey, 41% of workers would now prefer their workdays to be fully remote, compared with 29% in January 2021, signaling the desire to work remotely is only ramping up. For cybersecurity teams, this new reality brings with it more threats to tackle—and to be able to do so effectively, they must make sure their strategies change and adapt along with the threatscape.
While the majority of workers now find themselves working in a hybrid environment, the option to work remotely has presented possibilities that weren’t a reality in the past, such as working from abroad for extended periods of time. Earlier this year, UK fintech company Revolut announced its 2,000-strong staff would be allowed to work abroad for up to two months a year when travel restrictions are eased.
Now that workers are returning to the office, it’s become evident that certain jobs are more suitable to be done remotely than others. These “anywhere jobs” can be performed from anywhere in the world, as long as an internet connection exists. While some companies have embraced the WFA (work from anywhere) mindset long before the pandemic, others are now beginning to accelerate their digital capabilities. From late March to late July 2020, over 60% of firms adopted new digital technologies such as remote-work platforms and resource-planning software.
Sounds too good to be true? Not necessarily, but most industry shifts bring with them challenges. In this case, companies opening the door to remote work are going to have to rethink security.
Without access to office services, remote workers are also using their own personal Wi-Fi, or even worse, unsecured public networks. An unsecured router can be an access point not just for an Advanced Persistent Threat, which is a sophisticated hacker operation targeting a specific business, but also for even the most basic of hackers.
Working in different time zones, employees may find themselves having to make cybersecurity decisions on their own if the IT department is not available to immediately assist them. Verifying the legitimacy of a suspicious instruction through a different communications channel can also be tougher for an employee from a different time zone.
Therefore, it is vital to create clear communication channels between CISOs and employees who might be unaware of the security risks posed. Employees should not feel that they are left to deal with risks on their own devices. Remote workers have more control over their workday, and if we’re going to consider that a perk it shouldn’t come at a cost.
VPNs are no longer the solution for a remote workforce
Employees working remotely often use a VPN provider, which allegedly allows them to protect the connection, since the network traffic is encrypted, even if their personal network is compromised. But the current state of play espouses us with the sunset of VPNs, which often provide all-network access and have a devastating potential if hacked.
Zero Trust access solutions are the heirs of VPNs. Their main benefit is replacing all-network access with near-surgical, per-app permission granularity, minding user role, and request context. The Cato SASE Cloud, which belongs to Cato Networks, is an example of such a cloud-native solution. It can accommodate users without the need to deploy dedicated VPN infrastructure, making it especially convenient for workers who work remotely from their first day on the job.
Security solutions to facilitate remote work
Companies are adapting to a new remote reality in which workers are working not just from their homes, but also in public places, with the added risk of stolen laptops. One solution is passwordless authentication, which replaces traditional passwords with device-backed OTPs and biometrics. Another way to protect data is to require employees to back up their data in cloud storage, meaning access to the data can be blocked if needed.
Multi-factor authentication (MFA) for remote access to workstations is another time-proven way to prevent unauthorized access, as it forces the hacker to get their hands both on the access credentials and the device used for extra protection, such as the phone receiving the access code by SMS. Proper permissions management as part of a zero-trust network access solution for remote work is another key task for security teams to get right.
Special attention should be made to configuring security solutions to work in accord with the new reality. Contextualizing user activities should take into account their device, normal behavior, time of day, and yes, their location too. While user location is no longer expected to be limited to the company’s home country, identity management, workload protection, and zero-trust solutions should still flag frequent, unreasonable location changes around the globe.
As workers enjoy more flexibility to work from wherever they want, security teams must learn to mitigate the threats that come with such a shift. They must adopt a completely different mindset, striving to be as agile and flexible as the employment model of the enterprise they are serving, and anticipate threats coming from vectors that were not on the radar before.
