Working From Home – The Cyber Security Perspective – Part 1
Woohoo!!! COVID has granted many of us the opportunity to not go into the office and now we can do our work in our latest stylish pyjamas and only ever consider looking reasonable when there is a web conference. What are the cyber security implications of “working from home”?
Many businesses are now dealing with the “Work from Home” phenomenon and this presents a new challenge to cyber security.
- How do we know that the person logging in is the person we employ?
- How can we make sure that the device used to log in meets company compliance
- How can we make sure that the company information is secure and not copied to a home hard drive?
- Do we have the infrastructure and security controls in place to cater for everyone working from home?
With the emergence of “Cloud” many of these items are now managed by AWS, IBM Cloud and Azure to support the operational availability of the corporate systems, although that doesn’t mean that the security compliance and controls are correctly configured. To ensure that you have the right base lines of security management (cloud or on-premise) and you want to allow staff to work from home there are a few considerations that need to be in place:
- Multi-factor Authentication – Ensure that the person who is logging in is the person who works for you.
- Device Access Control – Make sure that the device they are using is the authorized device to access corporate resources.
- Data Loss Prevention and Role based Access – Identify when items are copied from where and ensure that the information that is going to be copied is authorized.
- VPN vs open services – Is the data that is being transferred appropriate and is the mechanism for communications secure?
- Security Monitoring – How do you know when any of the above is an issue?
If you do not have these security controls in your business look into it asap, you may be losing valuable data from your business. If you do have these systems, are they set up correctly?
When looking at Security controls, it is important to define what the control is meant to be doing and also what it can’t do. Many businesses adapt security controls to do multiple functions, the problem is that the policies you deploy in these multi-function systems should not be blended, they should be separate as the policies have a separate action that should be achieved.
EG: Firewalls with IPS – your policies for Firewalls should be focused on blocking the related ports and protocols that the business does not allow (application aware or not), yet the IPS function inspects the allowed traffic to see if there are any concerns with the data sent to the applications and/or systems.
If you make a firewall rule that is too loose and relies on your IPS too much, then threats will emerge. If you make your firewall policy too strict and IPS too loose, your applications can be infected.
Another factor to consider is that it is quite likely that the total number of devices on your network has increased significantly due to WFH. Might be time to do a software license compliance check?
In summary, this new way of working imposed on us by the COVID-19 pandemic brings with it a range of new challenges for cyber security management. The way we do things has changed. Understanding how those changes affect the cyber security landscape defines our organizational requirements for the future.
