The spread of Coronavirus and the associated illness, COVID-19, has had a drastic effect on people’s lives all over the world. In particular, COVID-19 is changing the way enterprises are operating, forcing many employees to work from home in a bid to practice social distancing and limit the spread of the disease.
The full effects of the pandemic to businesses and the general public are yet to be fully realized. However, it’s important that businesses try as best they can to carry on operating as normal under these new working conditions.
The business landscape has changed, and whether this remains a temporary change or a permanent one, it’s important that we consider the ramifications to cybersecurity. Businesses must be able to maintain security, integrity, and continuity throughout the pandemic, and this will require constant vigilance and the adoption of some new practices, policies, and technologies.
Unfortunately, we live in a world where attackers, and even opportunistic insiders, may seek to take advantage of any relaxed security measures during the crisis and confusion.
The Challenges of Remote Working
Even though allowing employees to work from home is likely to be beneficial in the long term, the problem is that many organizations are simply not prepared for it, and it’s unlikely that employees have been sufficiently trained to handle sensitive data when working from a remote location.
CIOs and CISOs will find it much harder to enforce company security policies, such as policies relating to what devices can be used, where they can be used, and how they can access the company network.
They will find it harder to enforce the encryption of sensitive data, both at rest and in transit. They will have little control over which applications an employee can install on their device and will struggle to ensure that all devices are password protected.
Should a device containing unencrypted sensitive data get lost or stolen, there isn’t much the CISO can do about it. If the CISO was sufficiently prepared, they could have installed Mobile Device Management (MDM) software on the users’ device, which would allow them to wipe the data from the missing device, amongst other things.
In times of recession, the last thing a business wants is for a data breach to make the headlines, and of course, it’s the last thing CIOs and CISOs want to do, as it will put them under even more pressure. And while the ensuing recession may result in a loss of business, this won’t necessarily ease the load on CIOs and CISOs.
Hopefully, I’m wrong, but the chances are, businesses will try to cut staff and training budgets, as opposed to taking on much needed IT security professionals or training existing staff to fill the role.
Is there anything positive we can extract from this? Well, it’s not exactly a silver lining, but at least there will be less physical security threats, and fewer employees asking questions, which may otherwise distract CIOs and CISOs from more important tasks. Additionally, many of the internal devices, including printers and scanners, will be used less, or even made redundant, thus reducing the amount of time the IT department spends on maintaining outdated systems.
How to Overcome the Remote Worker Challenge
Overcoming these challenges is a difficult question to answer. Organizations have been attempting to find the right balance of policy and technology for years as working from home becomes more popular. Here are some lessons we can learn from those companies already adopting these tactics.
Using Multi-factor Authentication
Stolen credentials remain one of the biggest causes of security breaches for remote workers. Using multi-factor authentication when logging into company portals will help to mitigate some of these risks. In addition, you should always encourage your employees to use strong passwords and not to write them down anywhere that they may be at risk.
Ensure You Have Secure Networks Set Up
Working from home is a significant change in the day to day communications for most workers. In light of this, many employees may be tempted to send sensitive information across unsecured networks, especially if the proper channels and practices have not been established.
Remove Excessive Permissions
You need to ensure that your employees only have access to the data they need to do their job. The vast majority of your employees will not need privileged access, and yet a large number of organizations operate with numerous excessive permissions.
For this, you may need to adopt a solution that is able to report on current permissions and permission changes. You may even want to consider a Privileged Access Management solution that can enable you to revoke excessive permissions automatically.
Provide Secure Devices or Security Software
In times like these, companies need to take serious steps towards keeping their data secure with a remote workforce. If you haven’t provided secure devices for your workers to use when they work remotely, then you will need to at least provide and ensure the installation of firewalls, antivirus software, VPNs, data security platforms, and up to date software.
What Can CIOs and CISOs Do to Improve the Situation?
There are, broadly speaking, four areas that CIOs and CISOs need to focus on to reduce the likelihood of a data breach during the coronavirus pandemic.
The first relates to the protocols they use to ensure that employees working from home can do so in a way that doesn’t put sensitive data at risk.
The second relates to the use of automation to compensate for the shortage of cyber-security skills, and to improve the overall efficiency and scalability of business operations.
The third relates to their ability to protect their systems from ransomware attacks. Even though the recent surge in ransomware attacks are mostly targeting the healthcare industry, hackers will no doubt continue to take advantage of the health crisis to infect anyone they can.
Finally, CIOs and CISOs need to ensure that they have the best auditing solutions in place to give them the visibility they need to identify anomalous user behavior. They need real-time information about what data is being accessed, from what location, when, and by who.
There will be some tough challenges ahead, but it’s not all doom and gloom. In the aftermath of the coronavirus pandemic, the resulting shift in the digital landscape will inevitably yield some long-term benefits. The current crisis will lend justification to larger cybersecurity budgets, and result in a more data-centric approach to cyber-security. And if more employees are working from home, and using their own devices, companies will no doubt save money. Businesses may even move into smaller buildings, which could significantly reduce their overheads. Not only that, but it could result in a boost in productivity, as employees tend to feel happier working from home, using devices which they are familiar with.
At Lepide, we’re helping organizations overcome the challenges of remote working, by providing visibility over user behavior and sensitive data. If you’d like to see how we can help you keep your data secure when working with remote teams, schedule a demo of the Lepide Data Security Platform .