Shifting security boundaries
Another critical IT consideration is Security. The emergence of the high demand for remote working has moved the perimeter boundaries of the IT infrastructure from within the offices with specific regular work hours to anywhere and anytime. This has stretched the security boundaries to the home offices or even coffee shops or internet cafes. Gone are the days when you can easily protect your data and resources by securing the IT infrastructure of your offices and data centres.
With such stretching of the security boundaries, IT needs to now consider securing the Home WiFi infrastructure, the end-point corporate device and the other devices present in the network i.e., IoTs and household laptops. One thing is for certain, defense-in-depth and zero trust architectures continue to be the overlying principal approach to Cybersecurity design and strategy; and the only challenge is extending this to the remote worker’s homes.
The key solutions that are crucial to the new design of extended security perimeters are:
1. First, an Endpoint Device Management (EDM) solution which controls Corporate Devices and BYODs patch level, installed software and security policies. This would maintain a minimum level of device configuration before allowing access to data and resources.
2. Second, Secure Access Service Edge (SASE: pronounced “sassy”) which enforces remote user’s access to only the applications authorized based on the users, devices, operating system etc.
3. Third, eMail security solution that would block attached malwares, prevent phishing and spam and apply Analytics and Machine learning to block unknown attacks distributed through eMail to avoid the mistake of opening a malicious link or attachment.
4. Lastly, WiFi security solution that controls access between endpoint devices through Analytics and Machine Learning to determine and block undesired traffic.
There have been several examples of cybersecurity issues during the last year and a half, including a cybersecurity breach that happened in May, 2021. This involved the hacking of a United States pipeline company which resulted in shutdown of their major pipeline brought by a ransomware attack. This resulted in the losses of millions of dollars in sales and revenue. In the end, the attack on the pipeline company’s control systems started from a remote worker’s machine infected by a malware.
Working from outside offices has created a higher demand and/or opened the doors for more data to be shared with larger swathes of the workforce. Going back to HP’s report, it was found that 71% of the more than 9,500 employees surveyed say they access more company data, more frequently, from home now than they did pre-pandemic – with the most common types of data being accessed being: customer and operational data (43% each) and financial and HR records (23% each). At the same time, office workers are increasingly using their work devices for personal tasks. This puts into perspective everything we have discussed so far.
With the rising number of breaches involving data privacy leakage and loss of information, along with the increasing cost of each breach, risk analysis must now be recalibrated to address the emerging weaknesses as a result to the sudden change in work arrangements caused by the Coronavirus Pandemic. CIOs should consider acquiring third party services to perform Risk and Vulnerability Assessments in order to gain an outsider insight on the gaps that may have been overlooked due to the sudden changes executed.
