Zero-Trust: Stay Safe While Working Remotely
A zero-trust security model can help organizations and their employees stay secure, no matter where they’re located
Up until February of this year, working remotely was typically looked upon as a growing benefit for employees. The opportunity to work from home—or in a location outside of their standard office—was something employees actively took advantage of during the holidays to spend time closer to family. However, since the COVID-19 outbreak, more employees have been encouraged or even forced to work remotely, and while they’re keeping safe by isolating themselves and reducing the risk of getting infected, more individuals and companies are now facing new challenges.
Working with remote teams comes with a laundry list of challenges; most notably, it presents numerous security threats. Remote users have always introduced a higher risk to company networks as out-of-office connectivity extends beyond organizational perimeters. Now, given the surge of employees working from home as a result of the COVID-19 coronavirus pandemic, the risk is even greater. This leads to a need for more control over organizational assets from IT departments. Furthermore, the wide scope of these networks (and, therefore, attack surface) expands the necessary monitoring resources and tools to mitigate risk.
Many companies rely on VPNs to grant their users access to corporate applications from many different, unrecognizable locations. While the use of VPNs can help remote teams working across the globe, they aren’t always reliable, they lack scalability and they have capacity limits. In fact, VPNs were originally sized to meet the needs of a small number of remote users. With this surge in remote work, VPNs cannot always handle the need of every user becoming a remote user. VPNs are also lacking when it comes to constant identity authentication; in many cases, they are being deployed with unlimited access to organizational networks. This, in turn, increases attack surfaces and enables lateral movement from a compromised device to other devices and assets in the organization’s network. Coupled with the fact that VPNs historically have had security vulnerabilities, and the perfect recipe for a data breach has been created.
Regardless of whether businesses are using a VPN, being able to stay connected at any time from anywhere is a requirement for many enterprise users. In fact, new data has found that many users are accessing corporate applications even on holidays such as Christmas and New Year’s Day, particularly in the United States. The same research has shown that hackers aren’t taking any time off, either. Even over the course of the 2019 holiday break, the data highlighted a steady uptick in phishing victims from Christmas Eve to the days after Christmas in 2019.
This is why implementing a zero-trust framework is an attractive option for businesses allowing employees to work remotely today. Zero trust, a network security model based on the premise that all users are untrusted, has grown in popularity over the years as the modern workforce increasingly is on the go and multiple device application access has become a necessity.
Moving from a VPN to zero trust starts with secure application access, which ultimately can help reduce attack surfaces, especially when employees are working from home.
With companies and individual workers continuously overloaded with new information related to the COVID-19 virus, as well as seeking out details on their own, it’s easy to fall victim to a false link offering up the latest news. As the remote work surge increases, employees will begin to blend work and home, using their personal laptops or phones when multitasking in a different working environment. This is the kind of activity cybercriminals utilizing phishing techniques are looking to exploit. As a result, employees working from home are more prone to phishing attacks.
After implementing the zero-trust architecture and enabling remote working, companies still need to make sure their users and devices are well-protected from the lurking threats out there such as phishing attacks. With that, there are a number of strategies businesses can implement to ensure their remote teams are secure and their organization as a whole will be less exposed to phishing security risks. These include the following:
- Apply a multi-layer approach for defending against phishing attacks; look into emails as a common source for infection propagation but at the same time have security controls in place that looks into accessed traffic.
- Make sure all connected devices are fully patched—specifically mobile phones, as more and more attacks are targeting these types of devices.
- Humans will continue to be the weakest link in the chain; keep pressing awareness training to remind users and staff to avoid opening files that are delivered from unknown sources, not click on suspicious links and avoid giving away personal information with deals that are too good to be true.
As working remotely becomes the new normal, it is crucial for organizations and employees to be aware of the potential security threats lurking. Embarking on a zero-trust journey by establishing secure application access can allow companies to save time and frustration, placing a larger focus on mitigating the slew of risks waiting for employees to encounter while working from home. With a lot of uncertainty right now, organizations can and should take comfort in knowing they are doing what they can to enhance their security measures for their teams across the globe.
