The Top 5 Challenges Of Securing Remote Work
This time last year, we might not have imagined we’d still need to accommodate so many remote workers in our security plans for 2023. Any assumptions that we’d have returned more or less to ‘normal’ have been shattered.
Not only have organisations recognised the benefits to be gained from remote working, but it has become a privilege that employees expect.
Increased remote working has expanded the attack surface, bringing with it endpoint sprawl. Employees are accessing networks, systems and data from diverse devices in multiple locations, and cyber-attackers will keep targeting them as access points, hoping to catch them with their guard down.
In parallel, we’re likely to see a near complete decentralisation of IT capability in 2023. The more people work away from the office, the less they’ll want to lean on IT to get tasks completed. Less contact with IT will erode the visibility and control teams once had over enterprise systems and their users.
According to research carried out in the summer by Apricorn, more than 60% of UK IT decision makers expect their remote workers will expose the organisation to a data breach. Almost 30% believe this has already happened - with remote workers having knowingly put corporate data at risk in the last year. The respondents cited phishing and user error as the main causes of breaches in their organisation.
The same survey questioned IT leaders on their biggest challenges when implementing a cybersecurity plan for mobile and remote working. The following five came out on top.
1. The complexity of managing the technology that employees need and use – cited by 42% of respondents.
2. A lack of awareness among employees of the risks to data when working out of the office (38%).
3. Lack of confidence in security measures – with one third (32%) admitting that they cannot be certain their data has been adequately secured.
4. Employees who are aware of the risks of remote working will still lose data and expose the organisation to a breach (31%).
5. Complying with legislation – with 29% saying that mobile or remote working makes it harder to comply with GDPR.
There are three straightforward steps organisations can take to help address these obstacles in their cybersecurity plans for the coming year, all focusing on the endpoint - that potential entry ‘door’ attackers exploit to gain access to data and systems.
Mitigating The Human Risk
Whether intentional or not, employees’ actions – or inactions – are frequently to blame. Ongoing education has a critical part to play in plugging the awareness gap, by engaging remote working employees in remaining vigilant and following security policy at all times.
As well as cybersecurity best practice, they should understand the specific threats and risks to the organisation, and the consequences of mishandling data and devices when out of the office. This will help to make sure people genuinely want to ‘do the right thing’. A set of ever-evolving policies that clearly lay out what ‘the right thing’ is, detailing security procedures and how to follow them, is essential.
Wherever possible, policy should be enforced and automated in technology, to remove the decision from the end user; for example locking USB ports to only accept approved storage devices.
Encrypt All Data & Back It Up Offline
Mandating the encryption of data as standard, on the move and at rest, will address the issue of technical complexity, as well as assuage any doubts about how secure information is. The approach is also specifically recommended in Article 32 of GDPR as a way of safeguarding personal data.
Encrypting data ensures it remains fully protected: even if a remote worker leaves a device containing in a café or an Uber, the data will be unreadable to anyone without the decryption key.
Additionally, employees should be required to make offline local backups of the data they create and handle. This will protect information, and provide the best chance of restoring it in the event of a ransomware attack or technical failure, for instance.
Storing data on an encrypted removable hard drive or USB is a practical way of doing this. These devices can be disconnected from the network to create an ‘air gap’ between information and threat. They also give remote workers a way to move information around safely offline.
When employees are working away from the office, they need unhindered access to systems, applications and confidential data. Embracing this means accepting that they’ll expose the organisation to risk. The answer to overcoming the security challenges of a remote working environment is not to scrutinise or limit what employees do; this will only stifle productivity and frustrate people. Instead, organisations should take a strategic and proactive approach that devolves some responsibility for ensuring the integrity of information onto individuals, while applying encryption to build a last line of defence.
Jon Fielding is Managing Director EMEA of Apricorn
You Might Also Read:
