Security: COVID-19 Is Changing How America Works
The COVID-19 pandemic doesn’t have to mean security takes a back seat for remote workers. Here are a few tips
With COVID-19 forcing millions into a new normal that requires working from home (WFH), IT teams were forced to quickly adjust to changing circumstances and implement secure remote access solutions for millions of employees to remain productive and safe.
While some businesses are looking to re-open, many jobs that only require a computing device and internet connection will remain remote for much longer. Remote working facilities and workforce mobility trends make working from home more common than ever. While smaller businesses are leveraging Microsoft 365, Google Docs and other SaaS work and collaboration tools, many millions of users access their “office” through the corporate VPN from their kitchen tables. Regardless of whether sheltered users are accessing SaaS apps or applications from the cloud or data center, the cybercriminals and targeted attacks are taking advantage of vulnerable and unsanctioned endpoints—introducing identity theft, ransomware, breach and data leakage exposures.
This unprecedented health crisis and respective workforce shift and extended attack surface don’t have to impact the productivity of workers and, if properly implemented, should not result in potentially massive security incidents. Organizations can plan for emergency disruptions with enough capacity and reasonable control in place to allow employees to work together and obtain the applications, data and services needed to continue to do business, giving security a seat at the (kitchen) table while WFH directives remain in place during COVID-19 and beyond.
For those that are still in the throes of enabling work from home capabilities, the following tips are provided to take you through the process of ensuring business continuity and secure access:
Every organization needs to …
- Understand their remote access needs in terms of users, applications and resources to assess respective physical, virtual or user-based connection capacity and throughput.
- Enterprises will need to determine if key applications and resources, whether on-premises or cloud, will require increased capacity during times of crisis and apply to an emergency capacity plan. If you have not mapped out a user, role, application and resource access policy and data protection obligations, don’t wait for this emergency to spur unauthorized access incidents.
- Assess your licenses and capacity shifting options in advance and work in advance with security and IT vendors to ensure that you can add bandwidth capacity, as well as deploy software to handle burst load and added regional workforce shifts.
- Having these provisions in place will allow greater flexibility and time to work through emergency access conditions, such as In Case of Emergency (ICE licenses) that automatically accommodates burst licenses and means to shift licenses among appliances.
- Move from physical to virtual and cloud secure access. Many secure access vendors now have physical appliance ordering backloads or regional and country fulfillment limitations that can take months before deployment and configuration tuning can commence. If the opportunity presents itself, move to virtual and cloud appliances and clientless mode to realize more rapid on-demand implementation and scale options.
- Don’t wait to communicate and invoke an endpoint security policy. Enforcing endpoint compliance and offering self-remediation capabilities will reduce phishing, ransomware and other threats introduced by increased remote users and potential at-risk device use.
- Don’t assume scalability from your next-generation firewall: Some organizations have activated SSL-VPN functions within their next-generation firewall (NGFW). While NGFW offers basic tunneling services, the SSL decode and tunnel management do impact NGFW performance. As companies expand the number of people remotely connecting to network and cloud resources from home, the sheer transaction volume will require a significant and often costly increase in NGFW capacity—including the purchase and management of more NGFW appliances and licenses. Consider dedicated VPN solutions that overcome emergency capacity, scale and management challenge, but typically offer a broader array of application support and endpoint security options.
- Support global load balancing and application delivery controller technology so that users are directed where resources are best available that ensure consistent user experience and application responsiveness.
- Enable mobile device security options to accommodate broader corporate and personal device use that can provide for more flexible access while ensuring these devices meet corporate security policy and safeguard sensitive data.
- Allow capabilities that simulates being on-premises, which often include Layer 3 access to a specific subnet, HTML5 access to local machines or virtual desktop infrastructure. This allows privileged users and service technicians emergency means to allow for full troubleshooting or make necessary system changes.
Ensuring security in the new normal of working at home during the COVID-19 crisis does take a bit of planning and effective communications, but in the end, employee productivity and business continuity can remain intact to help alleviate the global health crisis issues at hand.
