Working remotely, either from home or from elsewhere, isn’t something new. It has been used by many companies worldwide over the past decade. That said, it was typically restricted to only a couple days a month or to specific IT-savvy departments. But as we have seen throughout time, adversity and crisis lead to change and sometimes revolutions in industry, social systems, countries and/or sometimes the entire world. COVID-19 has brought about this level of change. It's caused the world to rethink how we work to ensure the safety of humanity while maintaining production and an economy There are several trends we are beginning to see. Indeed, the world is becoming more physically distant which is leaving families, companies and many other social avenues more reliant on technology than ever before. Employees are taking home laptops or bringing their own devices to work from home. Families are having Easter lunch on teleconferencing platforms such as Zoom. Even professional sports leagues are turning to technology to attempt to stay on schedule, e.g. the NFL used a completely digital draft for its upcoming 2021 season. All these new technologies and communication methods create new problems in our new world. They require updated safety and security controls to ensure integrity, confidentiality, and availability.
Mitigating Risk and Vulnerability
As many companies switch to teleconferencing to keep their business intact, there is a need to assess and monitor the status of the software and tools being used. Now more than ever, our adversaries are going on the offense. Making sure that you are patching and mitigating vulnerabilities within your companies’ tools is going to be the difference between being secure and providing your foes with a vast attack surface to leverage. We don’t have to stop at patching and understanding vulnerabilities when securing these tools. Many companies will also monitor for any unexpected changes in the critical files for these tools and software. This can be very effective at providing insight into the integrity of your tools. Before the recent pandemic, most companies were already under extreme pressure when it came to keeping up with patches and vulnerabilities. Now more than ever, cybersecurity teams are working around the clock to not only mitigate and patch vulnerabilities in existing systems but also in the new systems and tools introduced as a new normal due to COVID-19. Amongst the many things to consider as we onboard or implement new systems and software on to the companies’ network is ‘risk.’ We need to examine how the ways in which we have prioritized or valued risk have evolved. This is not only due to the introduction of new systems and tools but also because of the new paths and endpoints to which your data will be transmitted, with your information being valued more significantly now than it ever was before. End users will need new types of training and controls set in place to ensure companies minimize the risk of new tools and new environments in a new world.
End-User Training and Policy Compliance
Not only are companies telecommunicating more. They are now also performing their BAU tasks at home on a regular basis. This means that many more endpoints are being deployed to end-users who may not be properly trained on security and working from home. These endpoints are being deployed at such a rapid pace that there may not be proper security and monitoring in place. It is critical that companies harden their systems before deploying them in the field to ensure they are secure and compliant with whatever security policy there might be. There is also a need to continuously monitor these endpoints for changes to critical components or even to be able to check that all systems have antivirus installed. There are several products out there that can assist in providing security and continuous monitoring for your endpoints being deployed into the field. As the times change, so does the need for updated training and support for the end-user. Companies’ training will now need to be geared towards best practices and risks of working from home. The need to monitor our end-users will never end. It has just become much more difficult as companies introduce BYOD (Bring Your Own Device) programs and as end-user become more nomadic within their work environments. Monitoring a device that isn’t connected to your network and that you don’t physically have access to will always prove to be an obstacle. This is why new and more intensive training will be a significant future requirement to ensure that our new mobile end-user is secure even when we aren’t able to monitor them.
VPNS and Proxy Servers
Other hurdles being exposed as we navigate through these new terrains are issues with bandwidth, VPNs, and how to ensure availability is as close to 100% without compromising security. Many companies are either utilizing their existing VPNs or setting up new ones to ensure that employees have the required access to internal networks so that they can properly perform their jobs. Just like anything else related to the internet, the more something is being utilized, the slower or less reliable it becomes. There are ways to unload some of the work a VPN is doing on to other tools or systems, such as a proxy server. You might want to utilize a proxy server to send the traffic related to security and the agents residing on your endpoints to monitor them. Maybe we want to monitor the actual VPN or proxy server themselves to ensure they aren’t being compromised or leveraged for attack. This is all possible when you deploy the right tools in your environment. As users begin to shift their work environments to their homes, everyone begins to see a shift in the availability and bandwidth available for those who are already at home. It is not only the at-home worker eating up our VPNs and network bandwidth; there are kids for whom summer has started early, people who are newly unemployed, and other challenging situations. Companies will have to focus on proper network utilization to ensure that the availability of the network is as close to 100% uptime as possible. Here’s the thing: you can have the most secure, up-to-date, well-staffed, state-of-the-art company, but if your network and availability aren’t a priority, everything will fail. If your resources aren’t available, then your means to profit will become stagnant and non-existent. Companies will have to shift focus to monitoring their VPN and network traffic for any deviations from what’s expected and accepted.
The Future is Remote
I am not here to preach an overhaul of IT or cybersecurity programs but to point out that IT security has changed forever in 2020. The goal is to tell you that our IT/Security programs of the past aren’t a thing of the past but are the foundation on which we need to build our future programs. The time has come to adapt to what has become an inevitable future of remote users and of company overheads being geared toward working from home.
