The challenges of teleworking at the enterprise security level: how to avoid a security breach

Cybersecurity services are critical in meeting the challenges of teleworking at the enterprise security level and avoiding serious incidents

Telework existed before the world was confronted with Covid, but it exploded in the wake of the pandemic. Working from home brings many benefits, especially in terms of family reconciliation. However, it can also affect productivity and hinder teamwork. In addition, the rise of cyber-attacks over the last five years has highlighted the challenges of teleworking regarding business security.

The cases of Western companies and the spanish Tax Agency show the challenge

In recent months, North Korean cybercriminals have infiltrated Western technology and even cybersecurity companies, using fake identities to get remote jobs from which to launch attacks such as installing malware. This dangerous threat has once again spotlighted the challenges of telecommuting at the enterprise security level.

Beyond these striking incidents, the fact is that the entire productive fabric and public institutions must be aware that teleworking increases the surface of attacks against companies and administrations.

Without going any further, last year, the spanish Tax Agency detected deficiencies in the security of the certificates used by inspectors to access AEAT systems when working remotely, so much so that it was forced to paralyze teleworking until the problems were solved and thus prevent malicious actors from gaining access to information as critical as the tax returns of citizens and companies.

Below, we will address the challenges of teleworking regarding enterprise security and unpack what cybersecurity measures and services can help companies protect themselves against attacks.

Why does telecommuting increase a company’s cyber exposure?

Employees, being remote, increase the attack surface as they are not protected behind the corporate network. Also, companies have to adapt services to be consumed by these remote workers.

To these issues, we must add that, when working from home, many professionals acquire bad habits in cybersecurity—for example, handling business information from emails or personal devices outside the corporate security perimeter and with a lower level of protection.

How can teleworking be facilitated securely?

Given the risks we have just described, do companies have to give up teleworking to safeguard their digital assets? No, there are measures that allow companies to maintain an adequate level of security, even if their professionals work from home.

The first essential step in defending a company is to have a secure architecture design. Taking this strategic issue to the world of teleworking, we find that there is no longer a defined perimeter, which poses a challenge for the professionals in charge of a company’s cybersecurity.

How can this issue be addressed? Cybersecurity professionals recommend designing an architecture based on the zero-trust philosophy. In other words, manage requests for access to company resources with zero trust. Information should be categorized to do this, and the principle of least privilege should be applied when managing user roles and permissions.

All this without undermining the operability of the company. In such a way, the security architecture is as non-invasive as possible in professionals’ daily work.

What best practices should workers follow to prevent security breaches from occurring due to teleworking?

To successfully address the challenges of teleworking at the enterprise security level, it is essential to establish a cybersecurity culture in companies and involve all employees in it. Why? This strategic decision:

• It minimizes bad practices due to a lack of knowledge, such as those we noted above.
• It increases employees’ awareness of the threats to which they may be exposed.

In addition, we must remember that a good security policy that is well communicated and understood by a company’s employees will make the security controls much more effective.

Why is it essential to have a Cloud security strategy today?

The digital transformation of enterprises has been causing organizations to require greater flexibility and performance at every step. As a result, companies are migrating their infrastructure to the Cloud, either betting on a hybrid model or a fully Cloud model.

This paradigm shift brings with it the need to adapt the enterprise security strategy to the characteristics of the Cloud model. Thus, any company that migrates to the Cloud among its objectives must be aware of the security risks inherent in the Cloud. It is, therefore, essential to have a cloud security strategy in place.

What cybersecurity services help address the challenges of teleworking at the enterprise security level?

To meet the challenges of telework at the enterprise security level, organizations have at their disposal a wide range of cybersecurity measures and services that contribute to:

• Preventing security breaches related to telecommuting.
• Find vulnerabilities and remediate them before they are exploited.
• Detect attacks early and manage incidents that may occur.

What measures and services can we highlight?

• Awareness of the company’s workforce, including management.
• Identity or IAM control.
• Zero-trust architecture.
• Multiple authentication factors.
• Specific penetration testing exercises.
• Red Team exercises based on attack scenarios focused on teleworking.
• Security audits: web, cloud…
• Vulnerability management services.
• Proactive incident response services.
• Threat Hunting services to anticipate malicious actors and optimize detection and response capabilities.
• SOC services.
• Threat Intelligence services.

In this regard, it is important to note that conducting penetration testing exercises to identify vulnerabilities is essential to meet the challenges of teleworking at the enterprise security level. Why? As we have been pointing out, telecommuting has increased the level of exposure of companies and, therefore, it is necessary to be sure that the security controls put in place are sufficiently robust:

• The applications must be exposed to enable telecommuting.
• The users themselves.

In short, the challenges of teleworking at the enterprise security level are complex and pose a challenge for companies. However, they can be successfully addressed by designing and implementing a security strategy that considers telecommuting risks.