Remote work and other developments demand a shift to managing people rather than devices
The consumerization of IT has eroded the traditional line between "work" and "play." Propelled by the bring-your-own-device (BYOD) era, our personal devices are commonly used for work.
This is especially true as more small businesses embrace the flexibility of working remotely, and as new devices and networks are used for work purposes. Personal smartphones are loaded with business email accounts, and personal computers and laptops used for remote work have business software, email, and documentation that may contain confidential information.
To top it all off, we aren't just using work devices in the office. We're using them on airplanes, at client offices, in coffee shops, and at home. All this means that the idea that protecting a perimeter is outdated. Instead, as "the workplace" becomes impossible to define as a physical location, technology professionals and IT teams must shift from managing devices to managing people, in order to stay one step ahead of such a rapidly evolving reality.
Protect the Crown Jewels
One easy way to begin implementing this new risk management strategy is to follow the Pareto principle (also known as the 80/20 rule), where companies treat 80% of the people one way while treating the riskier 20% of users with a higher level of security. Access should only be allowed via corporate devices, where multifactor authentication is mandatory, behavioral analytics is applied, and full auditing must be carried out regularly.
For example, the head of HR will be able to access data on all employees within an organization — and accessing this information from an untrusted, insecure device presents a huge risk. In this scenario, an organization's IT team will want to ensure that the device is controlled and that it hasn't been compromised.
Essentially if a person within an organization has the keys to the kingdom, it's crucial to make sure that his or her device isn't dirty, the network isn't compromised, and activity is completely monitored. There then needs to be a division between most of the staff and the VIPs and between most data and the "crown jewels" (in other words, the most important and most sensitive parts of a business that would be most appealing to an attacker).
Zero Trust: Suspect Everyone
At the same time, by doing away with a perimeter-based security model, where those inside the perimeter are trusted, organizations now need to implement a new model that better matches the vulnerabilities inherent to today's mobile workforce. We must suspect everyone — we can't afford not to.
A Zero Trust policy assumes untrusted actors exist both inside and outside the network and, as a result, every user access request must be authorized. When implemented correctly, Zero Trust networks can improve security while also increasing productivity. What's key to true Zero Trust environments are adaptive controls that are contextually aware. Without context, we always need to put the strongest possible security in place; with context, we can adapt the level of security based on risk.
For example, there should only be a prompt for additional credentials when a user comes from an unknown machine, an unknown location, or when performing a sensitive function. Businesses need to understand their user's behavior, and if things are normal, allow for minimal authentication — if things have changed or the risk is greater, add additional checks.
Still, Zero Trust is new. Until it's mainstream, password management products that offer complete privileged management systems to password vaults will help to reduce the complexity of users remembering multiple passwords while encouraging stronger password use.
What Comes Next: Good Cyber Hygiene
We know the modern workplace is no longer in one fixed location. At the same time, the nature of cyber attacks is shifting because of how efficiently cybercriminals get paid. From a hacker's perspective, fewer steps equal faster profitability — and all too often, organizations with remote work policies are ripe for attack.
There are more devices to compromise, which means more machines that will likely be unpatched and not secure. Identities may be implemented in a weak fashion and allowed too much access. Similarly, the rise of collaboration tools such as Slack presents new opportunities to infiltrate networks and take advantage of liabilities. These types of accounts often do not get terminated — so when that user eventually leaves a company, their account remains active and open to infiltration or exploitation by cybercriminals. The more software there is, and the more people experiment with new ways of working, the greater the attack surface will be.
For these reasons, implementing good cyber hygiene within your community is critical as the workplace continues to evolve and become increasingly distributed. To meet the basic tenets, community curators should at least:
- Understand the IT environment: Produce a comprehensive understanding of IT environments to uncover hidden data risks and help explain key elements to business leaders.
- Educate business and IT leaders: Tell them about the risks to their data and implications of a breach — including showing data risk in financial terms.
- Implement threat monitoring and detection: Deploy the right IT security management tools to detect and respond to potential threats.
- Use data to show the value of IT efforts: Use data to understand an IT environment, get useful insights, solve problems faster, and demonstrate value.
- Establish a solid security process: Ensure your organization is completing routine security updates such as managing and patching machines, ensuring a backup is in place, etc.
To stay ahead of this rapidly changing workplace paradigm, technology and security professionals alike should combine good cyber hygiene best practices in concert with additional strategies like Zero Trust and the 80/20 rule. Ultimately, employees need to be the new "endpoints," with the risk they pose to the organization assessed rather than simply determining them as safe depending on whether they are inside or outside a perimeter.
You must be logged in to post a comment.