Remote working: how to balance productivity and security

The UK has a profound productivity problem. Growth has been flat over the past decade and still lags pre-financial crisis levels. In this environment it’s vital that IT departments support employee demands for more flexibility in where and how they work.

Employers must provide flexible working options by law in the UK. But beyond this is just makes good business sense, helping improve job satisfaction, reduce churn, and drive that elusive productivity. It could even help firms to downsize offices to lower rent and overheads. The big problem is the cybersecurity risks it introduces.

I spoke to some experts for an upcoming Infosecurity Magazine feature to find out more.

Duo Security’s Trusted Access Report notes that over 40% of requests to use corporate applications come from outside the secure networks.

“Users are demanding flexible working conditions to perform their jobs and security needs to enable these practices as well as not inhibit them otherwise users will just find work-arounds. The risk may be increased as users log in to unprotected Wi-Fi spots that may have been set up to deliberately trap them or be infected by malware to perform attacks,” the vendor’s advisory CISO, Richard Archdeacon, told me.

“This way of working enables a situation where a hacker using remote access with stolen credentials may be able to perform a sophisticated attack. We need to ensure that users are aware of this risk and that their endpoint devices are as up to date as possible, which will help reduce the potential of compromise.”

A Zero Trust approach, in which the default setting is to assume users and devices have been compromised, offers a way forward, he claimed. It should include not just security on each mobile endpoint but also multi-factor authentication (MFA) so that remote workers can prove they are who they say.

Raghu Konka, iPass VP of engineering, pointed to the risk of passive data collection and man-in-the-middle attacks via public Wi-Fi, as well as “untrusted sources” such as websites and email attachments.

“Rather than everything being neatly secured on the company’s network in an office building, mobile workers can be accessing data from anywhere, and this opens them up to a number of threats,” he told me.

“Malware downloaded onto the victim’s devices in these attacks can be used to steal personal, financial or business information or lock access to data. Email fraud is another growing concern for enterprises when employees work remotely, as these workers are used to receiving instructions or conducting business via email rather than face-to-face, and therefore may not see the need to verify that the requests are legitimate.”

For SANS instructor Lee Neely, the flexible working risk can be split into two components: security of the connection and security of the environment.

“Users working from locations outside the corporation pose physical risks, as in theft of the device, unauthorised observation of the contents, and possibly non-employees having access to the device,” he said of the latter.

“Screen protectors, full disk encryption, and replacement of sleep mode with hibernate go a long way here, but still cannot protect an open system which is grabbed out of a user’s possession. Sandboxing with authentication to access corporate information in those areas can reduce the likelihood of access on a shared system, but you cannot get to zero risk.”