How to secure your remote workforce

Cloud services enable employees to work from all over the world and from any setting, but the downside of this is that attackers see this as an opportunity to target cloud services themselves.

In order to protect yourself further, it’s worth setting up a VPN. This reduces the risk of an attacker brute-forcing access to your systems. Another option is to activate conditional login settings. In this current climate, it’s likely that your workforce will be static, allowing you to restrict access to users within a specific geolocation.

Another risk to bear in mind with cloud services is the shared responsibility model. The flexibility afforded by these services leads to high complexity, which in turn causes security risks from misconfigurations as it’s not always clear who is responsible for what. This shared responsibility can lead to a serious breach if you don’t implement good cloud security practices and consider what each configuration could expose.

Your main focus should be sticking to basic best practices. As simple as it sounds, it’s actually a really effective cyber security control. This includes things like ensuring that systems are patched and using up-to-date antivirus, plus a process to manage the patching and updating.

It also means using additional layers of security (defence in depth), such as firewalls, as employees may have to share their internet connection with others (e.g. flatmates). While your employee’s devices might be more or less ‘secure’, their flatmates may not enforce the same level of security. As a result, if their device were to be compromised, the malware could potentially jump to the employee’s device through the network.

Again, the key is to follow best practices and assess devices before allowing them onto the network. It is also useful to define a minimum standard for your BYOD devices (e.g. verifying they are patched and run an antivirus software). Ideally, if the user is unable to meet this standard, you should impose a number of restrictions. For example, limiting what documents or webpages they can access.

Regardless, IT teams should be diligent about monitoring these devices, knowing what is being accessed and when. This will allow you to identify any abnormal activity and shut down access to systems for review, before it’s too late.

The impact of an O365 (or other cloud service) compromise, can vary in severity depending on the bad actor’s objectives and intentions. Once a hacker has obtained the credentials to a cloud account, they almost always gain unfettered access to the company’s whole network. This provides cybercriminals with other avenues of attack. For example, they might impersonate an employee for monetary gain (like emailing a CFO for payment on an invoice), or they might just grab all your data to sell on the darkweb. Their tactics for doing this can often be very sneaky, such as setting up email forwarding rules, which covertly forwards an employee’s emails to their own address.

Typically, a hybrid platform’s native security controls do not allow for an organisation to have both cloud and on-premises data in a central place. This results in duplicate processes and requires you to harden, configure, test, monitor and manage two environments for potential attacks.

One of the biggest challenges of working in a hybrid deployment is synchronising accounts and how to do that in a secure way. The NCSC guidelines say that you should synchronise your on-premises Active Directory services and credentials with a cloud service which serves as the primary authentication source. This will lower your risks compared to running your own Active Directory system.

The good thing about standard licenses is that it offers all the basic tools you need. However, with the Office 365 Enterprise model, you also get access to a suite of threat protection tools and phishing tests. This also allows you to run brute force attacks against your accounts to test for weak points, and alerts users about any suspicious activity. Of course, the effectiveness of any security review is limited to what you choose to do, or not to do, with the findings.

As we’ve all been finding out, physical location of employees matters less and less. So if your remote workforce is connected to internal systems through a VPN, it’s still important to conduct an internal penetration test, even if employees are not physically in the office. If you have put restrictions on cloud services, it is also a good opportunity to test their effectiveness. Similarly, make sure your VPNs themselves are not vulnerable to attack.

GDPR is GDPR. Employees are required to continue adhering to the policies and procedures your organisation has (hopefully) put in place, no matter where they’re working from. In fact, it might be worth having your employees undergo a refresher security training session, as it is easy to become complacent about data protection duties and responsibilities when working from home. The ICO has recognised that companies may be delayed in responding to data subject requests, but other than that, it’s GDPR business as usual.

Printing documents, especially documents containing sensitive information, should be kept to a minimum. It is also important to consider how the data destruction policy might affect what you do with documents whilst remote working. All documents should be shredded and securely destroyed in-line with your policy. If employees are unable to do this at home, it would be better for them to keep the documents locked in a cupboard and brought to the office upon return, for destruction.

Learn more about our GDPR services

It may be necessary to implement temporary changes to your processes in order to accommodate the change to remote working. The first thing you’ll need to do is a thorough assessment of the possible risks that a business might face. Then, measures should be put in place to mitigate those risks. If not, there needs to be sign-off from management to ensure that they are prepared to accept the risks

Get in touch today to find more ISO 27001 support