The widespread adoption of cloud technologies and high-speed broadband internet access has made remote work a very viable option for most organizations. The flexibility and productivity benefits of remote work are a huge draw for companies that decide to allow remote work. While remote work appears to be a win-win situation for the organization and its employees, the picture for the IT professionals isn’t as rosy.
From an IT administration perspective, remote work has many challenges, security being the most significant one. The benefits of remote work fizzle out if your IT team isn’t able to ensure seamless access to services, applications, and resources. And while you are busy setting up or upgrading your infrastructure for supporting remote work, cyber criminals are looking for new attack vectors and attack surfaces, and ramping up their attacks.
No matter how developed your systems for supporting remote work are, keeping security central is essential. Here are some best practices to make remote access as secure as possible:
1. Enable encryption
Encryption is a tool designed to ensure the confidentiality and privacy of the data on your devices. Encryption mitigates the risks posed by a lost or stolen device. So even if a criminal were to gain physical access to any of your remote employees’ devices, the data on it would still be protected from unauthorized access. Enabling encryption is simple and you can encrypt your device using BitLocker for Windows and FileVault for macOS.
2. Install antivirus and anti-malware
Antivirus and anti-malware software are required not just for security but also for regulatory compliance. Antivirus and anti-malware solutions provide a layer of protection where it is most needed, i.e. the users, who when in a rush or too busy tend to do stupid things that the IT team advises against. Be sure to choose the right antivirus that meets your business needs and that they are installed on all devices.
3. Ensure all operating systems and applications are up to date
Software updates and patches are regularly released to improve functionality, usability, or performance but more importantly, these patches often fix security vulnerabilities. If you delay updating your software, cybercriminals can use the known and yet unpatched vulnerabilities to hack into your system, install malware, or steal data. If you still feel that you can ignore updates and patches, just remember that the WannaCry ransomware was totally preventable had the systems been patched in time.
4. Enforce a strong password policy
The use of weak passwords is an open invitation to cyber attacks. To safeguard your user accounts from cyber attacks, you need to enforce a strong password policy that helps create good password hygiene. You need to ensure that your password policy checks for length and complexity as well as disable automatic login, and enable automatic lock.
But complex passwords are usually difficult to remember, especially when there are many applications, each with its own username-password combination. And our intention is not to burden the mental resources of the users. Therefore, it is a good idea to use a password manager, which takes care of tedious tasks such as coming up with strong passwords, remembering the passwords and associated usernames, and filling web forms.
5. Use Mobile Device Management (MDM)
One of the key challenges of securing remote access is the difficulty of ensuring that the devices get the same level of security when they are remote as they would when in the office. This is where the Mobile Device Management (MDM) solutions help. MDM solutions allow you to monitor and manage devices wherever they are located.
With MDM solutions you can easily install and configure applications, push updates, and manage mobile devices such as laptops, tablets, and mobile phones easily. It simplifies and enhances the security of portable devices, mitigating much of the risks associated with remote access.
6. Use Virtual Private Network (VPN)
While your employees work on the go, they may use public Wi-Fi at airports, hotels, or other public spaces. Therefore, you need to ensure that no one intercepts or snoops in while your employees are accessing the company resources from public Wi-Fi.
Virtual Private Network (VPN) not only gives secure access to your office network but also ensures its security. VPN allows your employees to easily access company resources using any high-speed internet connection enabling them to work efficiently while keeping their connection secure. VPN is a must for any organization that allows remote work but especially for those that depend on sales and services teams who work in the field.
7. Use two-factor authentication
Two-factor authentication (2FA) provides excellent security, is relatively easy to implement, and comes at no extra cost. It is a type of multi-factor authentication, in which your username/password pair needs to be supplemented with another method such as an OTP (one-time-password) to verify your identity. This additional step required for logging in to your accounts adds an additional layer of security, making it difficult for hackers to gain access to your accounts.
8. Avoid using Remote Desktop Protocol (RDP)
Remote Desktop Protocol (RDP) is a protocol used for creating remote desktop sessions. When remote employees access their office desktop from their mobile device, it is commonly done using RDP. It is primarily a Windows application but can be used with Mac as well. It is quite popular and is used by many companies.
However, RDP is prone to vulnerabilities that can compromise your internal network. RDP sessions have been known to be vulnerable to man-in-the-middle attacks. They are also susceptible to credential harvesting, remote code execution, and can be even used to directly drop malware on the computer. Therefore, it is highly recommended to avoid using the remote desktop protocol.
If it is unavoidable and you have to use it, then you should take the following precautions:
Do not expose RDP to the internet.
Direct all activities through a secure connection.
Instead of direct RDP connection, force RDP sessions through a Remote Desktop Gateway.
Restrict who can use RDP and what they can access.
9. Implement Identity And Access Management
Identity and Access Management (IAM) secures enterprise resources by allowing you to easily manage access rights, privileges, and digital identities. In addition to managing how users gain digital identities and permissions granted to those identities, IAM also validates the hardware and software of the device requesting access.
IAM solves the problem of ensuring the correct level of access to IT resources in complex business environments using risk-based authentication, artificial intelligence, and machine learning. IAM allows you to apply role-based access to control access to critical IT resources and to regulate access to systems, applications, and networks from a single platform.
Considering today’s threat landscape, username and password combination isn’t enough to secure your resources while users access them remotely. If your company wants to maintain elevated security standards or rigorous compliance requirements, Identity and Access management is absolutely necessary.
10. Conduct Security Audits And Risk Assessments
Regular security audits and risk assessments help you to identify, analyze, and evaluate vulnerabilities and associated risks. You can either include remote services and remote work as part of a company-wide IT security audit or conduct a separate audit specifically for remote services.
Your remote services audit should have a special focus on the following:
Logins to both cloud and on-premises resources
VPN logins
User activity on cloud solutions such as SharePoint, OneDrive, Microsoft Teams, etc.
Group membership and permission changes
Use of network ports and VPN connections
Port scans and failed login attempts
RDP sessions, if in use.
Configurations of all critical resources
Use the data gathered to create a baseline or benchmark normal use. This will help flag suspicious activity when there are spikes or anomalies in user activity or network traffic. Document the results of your audits and make changes as and when necessary to accommodate changes in processes, new technologies, etc.
11. Train Your Staff
We know by now that technology alone isn’t sufficient to protect your business from cyber threats. There is no security system that can protect your business 100% on its own. Data shows that human errors, social attacks, and phishing are responsible for a large number of cyberattacks. So, in order to effectively protect your business, you need to focus on the weakest link in your security system, i.e. the users.
Effective IT security comprises a security-conscious culture supplemented by the right technologies and tools that work together to mitigate security risks. To create such a culture you need to provide regular security awareness training to your employees, keep them engaged, and communicate the importance of their role in the organization’s security. Creating a culture is a long and difficult process but it is worth the resources you will spend because a security-conscious culture is a sustainable security system that contributes to a strong overall defense.
Conclusion
As more organizations transition to remote work, the cybersecurity threats that they face undergo a change. While remote work offers many advantages, it adds new security challenges that traditional office environments don’t usually experience.
In the above blog post, we have listed some best practices that help create a more secure remote working environment without compromising on flexibility and mobility. However, you need to ensure that your security systems keep pace with the changes in the threat landscape as well as your internal processes.
Is your remote work infrastructure secure? Do you need help improving your security posture? Reach out to us by clicking the button below to learn how we can help you with your IT security needs.
If you liked the blog, please share it with your friends
About The Author
Hari SubediMarketing Manager at Jones IT
Hari is an online marketing professional with a focus on content marketing. He writes on topics related to IT, Security, Small Business, and Mindfulness. He is also the founder and managing director of Girivar Kft., a business services company located in Budapest, Hungary.