skip to main content
x
x
We use cookies to ensure you get the best experience on our website. By continuing to use the site, you consent to our use of cookies. Read more about our use of cookies and how you can control them at www.presidio.com/cookies.
Presidio Logo
Phone Handset
search
MENU

COVID-19 and Remote Work Challenges

Is your organization prepared to meet the demands of your Teleworkers?

by Devin Callaway, Security Practice Lead, Presidio, Thursday, 19 Mar 2020
COVID-19 and Remote Work Challenges
COVID-19 and Remote Work Challenges

As the response to COVID-19 pandemic grows, businesses and organizations are sending their people home to work remotely. Have you done the proper planning to ensure your company remote-work program is not introducing unnecessary risk? As more remote workers take the playing field, the standard perimeter, device management, patching, and securing our digital footprint become more challenging.

There will be no ‘one size fits all’ solution, as the needs and risk tolerance of each organization will shape what is critical. Understanding the risks and evaluating them is the essential first step; allowing your organization to move from reacting blindly, to a proactive and targeted approach to improve security posture and mitigate risk. It’s even likely that the actions taken today to address this crisis will enable better IT and Security operations in the future, and perhaps become the gateway to enabling a longer-term remote workforce.

PEOPLE AND PROCESS FIRST

The first step of any remote-work action plan is to inventory worker actions and make sure that the remote access technology meets the needs of the users. If it does not, the employees may take un-secured measures to get their job done remotely, while unknowingly introducing risk to the environment. Understanding worker actions is essential to a successful remote work policy. Conducting a remote tabletop exercise with multiple departments can uncover aspects of remote work that have otherwise gone unaddressed. Below you will find a list of questions that IT professionals should be asking as remote-work plans roll out.

INVENTORY WORKER ACTIONS AND RESOURCES

What do they do?

Who do they talk to?

What data do they need?

What systems do they interact with?

What meetings need to continue?

Which roles and duties can be done, even partially, without physical presence in the workplace?

What is the plan if a worker falls ill?

Does the business have adequate job function coverage from multiple people in critical areas?

Understand interdepartmental relationships. For example, can a department buy new material and resources is accounts payable is unable to print checks?

Do they use, interact with or create sensitive data?

What industry or regulatory standards apply to the data?

Database Access

Custom Applications

CAD

Reporting Tools

HR Tools

Timecards

Etc...

Which meetings are critical for continued operation?

What decisions are made in these meetings and can email or chat communication take its place?

 

What do they do?

Which roles and duties can be done, even partially, without physical presence in the workplace?

What is the plan if a worker falls ill?

Does the business have adequate job function coverage from multiple people in critical areas?

 

Who do they talk to?

Understand interdepartmental relationships. For example, can a department buy new material and resources is accounts payable is unable to print checks?

 

What data do they need?

Do they use, interact with or create sensitive data?

What industry or regulatory standards apply to the data?

 

What systems do they interact with?

  • Database Access
  • Custom Applications
  • CAD
  • Reporting Tools
  • HR Tools
  • Timecards
  • Etc...
 

What meetings need to continue?

Which meetings are critical for continued operation?

What decisions are made in these meetings and can email or chat communication take its place?

 

COMPANIES NEED A CYBER SECURITY POLICY THAT ADDRESSES TELEWORKERS

While tech conferences and domestic/international travel, as well as any in-person internal meetings are being banned around the world, companies are struggling to keep operational goals on track. Policies need to be updated to incorporate the mass influx of teleworkers to the enterprise. Healthcare, banking, legal, insurance, and manufacturing are examples of verticals that are ill-prepared for the fast growth of remote workers. Compensating controls will become more important to organizations as they quickly deploy less than ideal security in response to the rapid growth of remote workers.

This is not a new operational threat to organizations, and it is important to note that some companies already have a Pandemic section to their current BCP (business continuity plan). Also, NIST has a special publication on telework: NIST SP-800-46 (Guide to Enterprise Telework). Companies should not find themselves re-inventing the wheel on this issue.

CONTINUED USER EDUCATION TO DEFEND AGAINST COVID-19 SCAMS

A little education can go a long way to help users make smarter decisions. In early March, Sophos reported that operators of a Trickbot spam campaign had adapted their payloads in Italy to focus on the outbreak. Also, in March, Malwarebytes detected trojans being distributed from a site scraping the Johns Hopkins outbreak map. The Cybersecurity and Infrastructure Security agency as issued guidance regarding telework and increased Vigilance surrounding the COVID-19 pandemic. As secure email gateways have become more prolific, mobile attacks using SMS, iMessage, WhatsApp… etc. will become more prevalent. Understanding the ‘why’ of many of the decisions that are made for security will also make some of the extra controls seem reasonable to users.  Strong end user security hygiene is a must:

Guidance from CISA (Cybersecurity and Infrastructure Security Agency)

  • Avoid clicking on links in Unsolicited emails and be wary of email attachments. 
  • Use trusted sources—such as legitimate, government websites—for up-to-date, fact-based information about COVID-19.
  • Do not reveal personal or financial information in an email, and do not respond to email solicitations for this information.
  • Verify a charity’s authenticity before making donations. Review the Federal Trade Commission’s page on Charity Scams for more information.

REMOTE WORK PLANS PROVIDE AN OPPORTUNITY TO IMPLEMENT MFA SOONER THAN LATER

As you scale remote access and remote workers, scale your strong authentication and multi-factor authentication solution to match. Not doing so might leave you open to the range of credential spraying and stuffing attacks as users almost inevitably re-use passwords or use previously breached credentials. 

BEHAVIORAL ANALYTICS TOOLS FOR DETECTING SUSPICIOUS ACTIVITY

UEBA tools can be useful in detecting suspicious activity, and they can be specifically targeted toward admins and power users who handle critical data. As enterprises expand their remote work capabilities, the analysis of remote user behavior will become more important to the overall security capabilities of the organization. Many SIEM’s include UEBA capabilities as well as next-gen endpoint protection. There are also stand alone UEBA solutions on the market.

UNTRUSTED LOCATIONS

Facilities at an alternate location may be less secure or private. In a shared living space without a dedicated home office, the physical privacy of a device or phone call is far from assured. Homes today include a plethora of Internet of Things connected devices that are not present in most offices. With recent research from Palo Alto Networks showing that “More than half of all internet of things (IoT) devices are vulnerable to medium- or high-severity attacks,” having business endpoints sharing networks with these devices opens a range of new issues that increase security risk.

REMOTE ACCESS

Secure access service edge (SASE) can also be an element of a remote access strategy by offloading multiple tunnels to a cloud location and having fewer tunnels back to corporate gateways. By distributing load and managing all the remote access, some efficiencies of scale can be gained, and often this can be accomplished without the need to deploy new hardware. 

IT AND SECURITY SKILLS ASSESSMENT NEEDS TO BE REVIEWED OR CONDUCTED

The pandemic will put a tremendous amount of pressure on technology staff. Network admins that manage remote access VPNs, as well as system admins who are running VDI pools and remote application solutions, will have additional pressure to perform. As the reality of the pandemic lands close to home, these vital technical leaders and stakeholders may fall ill. It is important that we identify single points of knowledge and know-how and address them through cross-training and establishing relationships with partners.

THINGS TO AVOID

There are a few items that Presidio sees as significant mis-steps. First, we have to think of the user experience – not just of security – and not make it more difficult for the user than absolutely required. The two must be balanced as complexity is the enemy of security, and because we do not want users to be attempting to circumvent protection.

Second, from a process perspective, you cannot stop routine tasks and operations. Doing so will leave you open to more attacks. If you have a managed services provider or trusted outsourcer already in your ecosystem, it may be the time to step up their use or to procure additional services.

Third, several conveniences are likely to lead to trouble. You should not enable insecure remote access (such as Internet-facing RDP) to elevate availability, and any direct Layer 3 / Layer 4 access from untrusted endpoints should be extremely carefully managed and monitored.

Finally, as you scale remote access and remote workers, scale your strong authentication and multi-factor authentication solution to match – not doing so might leave you open to the range of credential spraying and stuffing attacks as users almost inevitably re-use passwords or use previously breached credentials.

PARTNERS ARE CRITICAL

As organizations plan for disruption events, selecting the right solutions integration partner is critical to a successful deployment and adoption of technology. At Presidio, we put customer experience first. We are here to support businesses to create a remote work plan that is both effective and secure.

We have a number of options that we can deploy quickly into your enterprise. Please reach out today to Presidio today. Learn More.




Presidio Logo
Presidio is a leading North American IT solutions provider focused on Digital Infrastructure, Business Analytics, Cloud, Security & Emerging solutions. We deliver this technology expertise through a full life cycle model of professional, managed, and support services including strategy, consulting, implementation and design. By taking the time to deeply understand how our clients define success, we help them harness technology advances, simplify IT complexity and optimize their environments today while enabling future applications, user experiences, and revenue models.
Facebook
Twitter
LinkedIn
BrightTALK
CONTACT US   |   LOCATIONS
SITEMAP
Phone Handset
Terms    |    Privacy    |    Cookies    |    Careers
© 2020 Presidio, Inc. All rights reserved.
lat6386