Cybersecurity and Your New Remote Workforce

For many organizations, COVID-19 has been a literal transformative agent. Our organizations have nearly in a single day gone from environments the place teleworking was an exception, to the place it’s the norm.

We’ve gone from selective, partial externalization of key companies, to near-total externalization. We’ve shifted from BYOD being accepted — although maybe grudgingly — to the place it’s a key a part of holding the enterprise operational. Briefly, distant work is the brand new regular.

As any pupil of human nature will inform you, individuals are inclined to view “the brand new” with reservation. There’s a temptation when issues are new to imagine the worst about them. For safety professionals, this implies we regularly view new issues as riskier than issues we’re accustomed to.

For many who have been within the trade for a couple of years, recall the issues many safety professionals had when cloud applied sciences have been first gaining traction. Or, earlier than that, when OS virtualization was first making inroads into datacenters.

Cyber Dangers and Rewards

This isn’t to say that there aren’t dangers — simply that when one thing is new, we are inclined to broaden the dangers in our minds. Over time, whereas recognizing new dangers, we notice that modifications can result in enhancements.

For instance, within the early days of virtualization, danger areas appeared fairly pronounced: we fearful about digital machine escape, segmentation assaults, mobility of workloads, and many others. Over time, we realized that whereas these dangers are actual, so too are alternatives for helpful impacts. For example, utilizing snapshots to help patching efforts, utilizing orchestration to assist automate coverage enforcement, and leveraging clones for safety testing, i.e. letting us take a look at extra totally with out disrupting manufacturing.

The purpose is, it’s the uncommon occasion or expertise that’s solely draw back or upside from a safety viewpoint. All of this will likely appear apparent, however I’m bringing it up as a result of there was important consideration paid within the commerce press about methods distant entry negatively impacts safety. This view isn’t essentially false. There completely will be methods an externalized workforce can exacerbate undesirable safety outcomes. That mentioned, there are potential upsides too — methods to harness the distant work to, over the long run, enhance safety posture.

Entry Pathways

Let’s think about first conventional VPN, e.g. IPsec VPN. Within the early days of COVID, many organizations realized that there was a key distinction between a couple of “highway warriors” accessing inner assets through conventional VPN and the whole thing of a big workforce doing so concurrently.

For a lot of organizations, VPN options collapsed beneath the utilization scale. In response, organizations have wanted both to rearchitect how these options are deployed or constrain utilization such that solely a subset of the workforce can entry them.

In some circumstances, even when assets like messaging, e mail, and collaboration instruments may very well be accessed by finish customers immediately through the cloud, specifically through the general public Web, organizations nonetheless required customers to hook up with them through a conventional VPN. In lots of conditions, this was for safety causes; comparable to to permit accesses to be logged and to attenuate alternatives for knowledge leakage outdoors the perimeter.

As a sensible actuality although, these approaches have confirmed infeasible given the sheer quantity of site visitors any sizable workforce will generate. This has prompted these organizations to open new entry paths to permit customers to eat these cloud companies immediately.

These outcomes will be helpful from a safety viewpoint. In conditions the place a legacy VPN was getting used as a safety mechanism for cloud entry, organizations have wanted to as a substitute rely extra closely on cloud-based options to realize the identical ends.

For instance, by shifting logging and coverage enforcement factors from contained in the community to the cloud service. This may be advantageous from a safety perspective because it helps the group centralize log info and make use of instruments which can be extra built-in into the cloud service.

In conditions the place VPN entry was “gating” entry to security-relevant performance, comparable to patch deployment or AV updates, organizations have needed to transfer to a mannequin the place these patches will be deployed to finish customers with out VPN entry, thereby probably rising the alacrity with which they are often put in for distant customers.

Knowledge Containment

BYOD has caused a scenario the place containment of knowledge is a should. In any case, many in our workforce shouldn’t have entry to firm-provisioned laptops or cellular units. Because of this to maintain the group functioning we’ve needed to enable BYOD entry in conditions the place we might not have accomplished so previously. This has created a scenario the place we’ve got to focus not on gating entry to knowledge from units that we’d not belief to the identical diploma as internally-provisioned endpoints, however as a substitute to make it possible for we do two issues:

1. Authenticate person entry to the info, as a substitute of focusing solely on the system.
2. Restrict alternatives for the info emigrate to, and dwell on, the untrusted system within the first place.

Over the long run, this consideration to learn how to constrain knowledge — the place it may be used, the place and the way it may be saved, and many others. — in the end can work to enhance posture total.

BYOD customers gained’t be going away after COVID is gone. By taking a “data-centric” view now, we will use our time to construct higher methods for normative entry as soon as our workplaces open again up. This may encourage us to undertake a extra “zero belief” method the place we deal with ensuring entry to knowledge is acceptable — and containing the place and the way that knowledge can circulation.

Enterprise Continuity

This last commentary might be as apparent as it may get, however for a lot of organizations we’re residing in what is basically a months-long, prolonged enterprise continuity take a look at. That means, we’ve had to determine learn how to conduct enterprise with out ongoing entry for a lot of staff to our major places and amenities.

Nearly with out exception, there will probably be stuff you’ve realized about your individual preparedness that may make their means again into your small business continuity and/or catastrophe restoration planning. Don’t underestimate the utility of integrating these classes into your documented plans whereas they’re nonetheless recent in your thoughts.