January 2024 - Securing The Remote Workforce

Remote working became a necessity as the COVID-19 pandemic emerged in 2020. Businesses needed a remote workforce to survive an unprecedented time in history.

The rise of remote working brought on plenty of challenges for chief information security officers. CISOs had to figure out how to ensure proper security practices were still followed, but outside of the primary work environment.

Rather than focusing on what goes on in the workplace, CISOs had to cover a much larger space. Each employee’s home had the potential to be a security risk, thus, CISOs had to adjust to protect the company without any physical presence.

Fast forward to today, and employees have returned to the office. However, for many organizations, a form of remote work has now become standard.

This means CISOs must continue to instill strong security measures for any employee that works remotely, whether it’s full time, or in some type of hybrid environment.

In this article, we will cover the challenges and threats remote work poses for CISOs and their organizations, as well as the best practices they can implement to protect their company.

The Threats Brought on by Remote Work

Here are some of the top challenges and threats CISOs must consider when handling remote work:

• Phishing and social engineering attacks: With employees both sending and receiving an increased number of digital communications, the potential for a person to fall victim to a phishing attack or other scams is substantially increased.
• Use of personal devices: Employees will rely more on their personal devices in a remote work environment, and these devices may not be properly secured, increasing risk.
• Insecure Wi-Fi connections: Employees may choose to work in public spaces, such as a coffee shop or a library. These places often have a public Wi-Fi network for patrons to connect to, but these networks are often not very secure. Due to weak, or absent, encryption, anyone who works while connected to these networks is at risk of a bad actor having the ability to snoop on their activity.
• VPN vulnerabilities: A number of remote access solutions from Ivanti (formerly Pulse Secure), Cisco and Fortinet have all had critical vulnerabilities recently. These vulnerabilities have led to significant breaches at major organizations.
• Endpoint management issues: CISOs may find it difficult to secure and manage all of the devices that are outside of the corporate network. Endpoint management solutions may only work when the devices are at the office. Software patches and security updates may not get deployed properly with the devices primarily being remote.
• Unsecured home networks: Even though home networks are a safer option than public Wi-Fi, they still lack the robust security measures of corporate networks, which leaves sensitive data at risk. Proper asset management is near impossible when factoring in employees home networks.

How to Mitigate Remote Work Risks

As you can see, remote work brings many issues for CISOs to solve, but there are best practices that can help mitigate the aforementioned risks:

• Secure multifactor authentication methods: To best protect your organization, be sure to use strong multifactor authentication methods. This means avoiding SMS text messages or any MFA method centered on voice or sms, and instead focusing on hardware keys and passkeys. Authenticator apps should be used as a backup measure.
• Social engineering hardening: Be sure to train system administrators and the IT help desk on the various social engineering scams employees may face. It’s also a good practice to implement an out of band verification system for all communications.
• Device trust: Set up a process for BYOD device enrollment, and implement device certificates or other device authorization solutions to ensure only authorized devices can connect to corporate resources. Conduct device posture checks to assess the security status of a remote device before granting access, and adopt a zero trust network architecture, which assumes that no device or user can be trusted by default.
• Addressing home networks: It’s impossible to conduct any form of asset inventory while employees work from home. Thus, make sure to set up a corporate Wireless Application Protocol, ensure employees are always connected to a VPN, set up endpoint firewalls and conduct scans of home network public IPs.

Remote work may never be as prevalent as it was in 2020, but it is ultimately here to stay. CISOs need to take all of these risks and mitigation strategies into account to protect their organizations in this new paradigm, as ignoring them could prove to be costly not only for the company at large, but for their own jobs as well.