Results from the March 30, 2020, Gartner CFO Survey indicate that 74% of businesses intend to shift some employees to permanent remote work following their initial experience responding to current global conditions.

Regardless of recent world events, many workers already spend time on the job, while physically separated from the corporate campus. Sometimes they will use a work-provided computer, while other times they may opt for a personal device for convenience. In either scenario, it is imperative that businesses ensure remote workers are enabled with access to the tools they need to be productive, while keeping workers and corporate information safe.

Key Challenges to Enabling Remote Work

Businesses are having to enable remote-work capabilities faster than ever, yet their traditional security methods aren’t built to support this use case. Forcing remote work into a traditional, perimeter-based security model results in performance issues, a reduction in productivity and a poor overall user experience.

There are a number of challenges that companies will need to overcome to ensure that employees are enabled to work remotely, while remaining secure and productive:

• Identifying authorized users.
• Managing devices and publishing best practices for a diverse workforce.
• Ensuring devices, managed or not, comply with the needed security standards.
• Operationalizing remote security monitoring.

A new, cloud-delivered approach is needed to support the real-world use cases of working remotely.

Managing and Securing Access to Applications

Companies of all sizes have been grappling with secure access management in increasingly cloud- and mobile-first environments for several years. Aside from a few legacy services, the majority of heavily-trafficked enterprise applications are software-as-a-service (SaaS) based, sitting outside of the organization’s perimeter. For many organizations, identity has had to become the new perimeter, because the traditional perimeter has become increasingly ineffective in providing robust, consistent security for their application infrastructures.

Establishing a user’s identity is key to managing security within a remote working setup. The use of multifactor authentication (MFA) and single sign-on (SSO) provides a high level of assurance to a session that isn’t granted with basic usernames and passwords.

Identity alone is not enough. The device also needs to be assessed. A user’s identity should not vouch for the health of the device they are using; they may have unwittingly installed malware or their operating system (OS) may not be patched. Companies need to start moving to a contextual security model that is able to assess multiple data points to determine the risk associated with an access request.

The need for Zero Trust access security becomes clear, particularly in light of today’s crisis. Many security professionals are now pushing for access control policies that can incorporate some information about the device, its risk state, the location from which the request is initiated and other salient details on the user and application before a request can be granted. A user’s identity then determines what they should have access to, obscuring services irrelevant to their level. This is a big change from the checks in place with legacy solutions, but a significant step forward to improve the organization’s security posture. 

Managing Devices Used by Remote Workers

Part of business continuity is about maintenance and ensuring that existing technologies are patched and up to date. Unified Endpoint Management (UEM) tools will play an important role in how remote workers are managed over the coming months, enabling information technology (IT) teams to enroll new devices, including bring your own device (BYOD), as well as configure devices so they comply with corporate policy. This can be anything from installing VPN profiles, enforcing encryption or provisioning new content and services. 

Enforce Acceptable Usage Policies

In today’s modern workplace, employees can access any site, anywhere at any time. This can also mean the wrong sites in the wrong places and at the wrong times. If left unmanaged, such services as Netflix, YouTube and Spotify, can tear through your data allowance and rack up costs. Organizations need to ensure personalized usage is capped or blocked based on what is considered “acceptable usage.” This can help preserve productivity and security and ensure compliance with the growing number of regulations that affect data management.

Organizations need to invest in good documentation so employees know how to get online and how to access and use approved tools. Acceptable use policies need to be documented, as well as approved devices and apps. This will help reduce help desk strain by proactively distributing instructions that detail how employees should connect remotely.

Although maintaining policies is important, having employees read and follow all instructions can be difficult. In addition to having written guidelines on what usage is not acceptable, businesses should also manage policies from the cloud that only allow the correct tools to be used or appropriate browsing to occur. Building intelligence into these policies allows them to be dynamic and change based on the context. When there are changes, they are applied instantly from the cloud rather than waiting for apps to update or employees to read documentation. This approach means end users and administrators don’t need to worry about regulations and compliance; it is taken care of by the acceptable use policy that is applied automatically. 

Protect Remote Workers and the Data They Need 

Uncertainty is a cybercriminal’s best friend, and this current state of global uncertainty presents the perfect opportunity. We’ve already seen a number of phishing and malware attacks using this particular moment’s headlines as a guise. As millions of people look to make sense of the situation, it’s very easy for them to be lured in by scams pretending to provide new information, answers or even potential remedies.

With conflicting misinformation available, people are stressed, vulnerable and afraid. Awareness training alone will not suffice in these circumstances; cyber protection for workers needs to be upped. Many of these threats are new, taking advantage of social media and other vectors for rapid dissemination. Unless security products are able to respond rapidly to a sudden change in tactics and protect against zero-day attacks, then this could prove a gaping hole in security.

Additionally, the number of devices connecting to corporate services will likely continue be on the rise. If companies don’t already have a BYOD policy in place, they may be forced to adopt one due to a lack of inventory or capability for employees to work remotely. Personal devices may not live up to the security standards required by companies. Systems may need updating, malicious applications may be installed or credentials may have been phished. Operating beyond the corporate perimeter means companies need a security solution fit to operate in a less predictable environment.

Operationalizing Security for the Distributed Organization

The number of tools administrators need to monitor and operate business security and regulatory compliance has expanded in recent years. An IDC survey reported that more than half of businesses use more than 10 network and application components to add a new external user group to an organization. Managing policies and threat hunting can be similarly difficult as teams navigate through multiple tools.

For security solutions to be effective and efficient, they need to work together to form an integrated ecosystem. Utilizing existing enterprise directory systems is a simple way that policy coordination can be managed. Syncing existing enterprise directory systems is a simple way that policy coordination can be achieved, as any user groups or individuals change, policy configurations in each security tool are updated automatically. Stream logs from different security services into a centralized SIEM or SOAR provide administrators with condensed visibility, enabling end-to-end threat hunting.

The Future of Remote Working

Nearly every company is being forced to address remote-working inefficiencies and insecurities that have been perceived as minor niggles for the past decade. With mass adoption of remote-working practices, they can no longer be tolerated, as the new age of working is here, probably to stay. In these circumstances, technology can be friend or foe. Companies that can adapt the quickest, and provision technologies that keep employees the most productive and secure will have the best chance of survival.