Now more than ever, businesses are adapting to long-term remote work policies. This causes staff to greatly rely on personal devices to access corporate networks, which often contain sensitive data. But being away from the office, and the in-house security infrastructure presents new opportunities for malicious actors to breach your network.
Furthermore, newer technologies, such as the IoT, present complex security challenges for businesses to protect company and client data from exploitation. This dynamic environment also increases the complexity associated with data regulations and policy compliance.
With a myriad of devices entering the scene, this article explores how business owners and CISOs can implement new strategies and tools to protect against this evolving threat landscape while employees are working remotely.
1. Take advantage of cloud-based IT systems
Adopting a cloud-based IT strategy is advantageous for many businesses. It’s a particularly favorable solution for businesses with remote workers who would otherwise be using disparate browsers, email clients, video conferencing tools or general data handling apps.
Cloud-based systems can integrate all necessary business applications into one single computing environment. Within this secure platform, users can be verified, devices authorized, and all data processed and stored in the cloud. Cloud solutions eliminate the need for third-party software and eradicate pathways for malicious actors who would otherwise take advantage of software which is either outdated or unvetted by security teams.
Of course, data held within the cloud can also be compromised. Many cloud solutions incorporate AI-based tools to detect unusual activity and protect against unauthorized access, such as behavioral analytics and device authentication practices.
Cloud solutions are frequently paired with a professional VPN which provides remote workers with an extra layer of security while away from the office. A VPN will encrypt and tunnel all internet traffic to a remote server, which is a safer way to connect to the internet. Transmitted data will remain unreadable to snoopers and hackers as they’re unlikely to break through the wall of encryption.
Overall, cloud-based systems are more cost effective as they eliminate much of the physical IT infrastructure that would require on-going maintenance and upgrades. They also provide greater scalability for businesses who anticipate future growth, offering nearly unlimited data storage without investing in physical storage.
2. Use available security for IoT devices
IoT devices continue to gain popularity in both personal and business environments. Unfortunately, this new technology adds additional risk and opportunity for hackers looking to circumvent security parameters. IoT devices may improve data management and increase profits, but they pose a whole new level of cybersecurity challenges.
There are a number of vulnerabilities that exist within IoT devices. For example, failing to update the devices’ firmware or devices that lack adequate encryption when receiving updates provide pathways for malware and ransomware to enter a network. Insufficient monitoring of how each device is set, such as leaving ports open, neglecting to use a firewall, or not disabling file sharing can weaken the overall network. Even human errors such as creating weak passwords that are easy to guess is still a common way attackers exploit networks.
The world of IoT is rapidly evolving and security has to keep up. Thankfully, there are tools available now to address IoT security such as AI-based behavioral analytics, vulnerability scanning and endpoint detection and response (EDR). These technologies are being increasingly adopted to tackle the challenges that IoT networks present.
3. Implement NAC and MDM solutions
Network access control (NAC) is a type of cyber security technology that allows an organization to define and implement policies that control the access of endpoints to a network - while at the same time providing visibility of each device trying to gain access. NAC provides security posture assessments for the endpoints, highlighting the risks, and can control access based on the level of risk tolerated by the organization.
An important element of NAC is controlling risk associated with mobile devices. Many organizations allow or provide mobile device usage on a corporate network. These devices are often used for both business and personal use and introduce additional risk to the organization. Implementing a mobile device management (MDM) system is a risk mitigation control which gives companies more centralized control over employees’ devices to ensure they remain compliant with BYOD policies.
MDM solutions work on smartphones, laptops, tablets and also IoT devices. They provide companies with the ability to manage apps remotely, troubleshoot devices, and obtain location and usage data.
This solution boosts security, as any device that could be deemed compromised, such as a lost or stolen device, can even be found via the location tracking, or even remotely wiped if necessary.
Of course, as a result of MDM solutions giving greater control, with bigger insights into how devices are being used, it’s important to maintain respect for employee privacy and ensure trust is maintained.
4. Don’t forget PAM and 2FA
As important as access control is when employees are in house, that urgency really gets ramped up with remote workers. It’s essential that you implement available access control technologies like privileged account management (PAM) and two-factor authentication (2FA) for all your remote workers.
PAM enables you to tailor access to specific roles and adhere to the doctrine of least privilege. Whether it’s service, application, root or administrative access that’s required, a PAM system will keep your remote workers where they’re supposed to be.
No company should let their remote workers login without two-factor authentication. Phishing and email compromise are growing rapidly with the increase in remote work. One easy and inexpensive way to protect against these threats is with 2FA. In the event the bad guys get the login credentials, it won’t do them any good if you use 2FA.
Final Words
As the operating environment and threat landscape evolves, it is critical that organizations implement a layered security approach to mitigate risk. No one security appliance or approach is full proof. Instead organizations must implement multiple technologies throughout the network to help identify, detect and respond to threats. In addition to the technologies mentioned here, organizations should also incorporate external vulnerability assessments and scans to mitigate risks into which they normally wouldn’t have visibility.
The way people work is changing and remote and mobile work is increasing in popularity. This new normal is presenting additional risks with heightened attention by both adversaries and network defense professionals. The good news is your security partners can help you understand your risks and choose the best risk mitigation, network access control and mobile device security solutions for your needs.
Looking for a vulnerability scanner? Learn about Fortra Vulnerability Management.