I recently read a brief article on a Malwarebytes report about the correlation between increased cyberattacks and the rise in working from home. It was a relatively small survey with only 200 IT professionals responding, but it indicated 20% of organizations had experienced a cyberattack related to a remote worker. Another 28% of respondents indicated they were using their personal devices to perform work related tasks more than their work-issued machine.
Across the world, many companies are pushing back the timeframe for their employees to return to work. Some, like Fujitsu, are introducing permanent work from home policies. I feel this creates a new set of challenges for CISOs and security professionals across a range of businesses. If I am honest about my regular work day, I will often NOT connect to the office network via VPN. I interweave business-related tasks with personal ones.
Because the system security is enforced all the time for the protected session: data encryption and VPN functionality must always be on, while USB device insertion should always be off.
A different US-centric survey published by the Ponemon Institute in January 2020 highlighted that an average of 80% of successful breaches are new or unknown "zero-day attacks" and that the average time to apply, test, and fully deploy patches to endpoints is 97 days. Investigations continue to highlight that companies are often unaware of hacks for months, with one example being the revelation that that hackers were in Citrix’s network for five months between 2018 and 2019, making off with personal and financial data on company employees, contractors, interns, job candidates and their dependents.
From our conversations with enterprises, we have heard that the traditional model was to plan for about 20% of workers being remote at any given time, with 80% being in an office environment. That scenario has completely flipped. Security professionals want functionality like data encryption and VPN to be permanently enabled. Many companies have taken the approach of completely disabling the insertion of USB devices. We feel this increasingly needs to be supported with more fine-grained control than simply enabling/disabling. Rather, this functionality should be allowed or prevented on a per VM basis. I also believe that endpoint detection and response technology must become mandatory in the “new normal”.
Endpoint detection and response technology must become mandatory in the “new normal."
What is the path forward?
From this high-level concept, how this will be implemented will depend on the enterprise and use cases. Fundamentally, the level of protection that is layered in with be dependent on the sensitivity of the data been transferred and processed.
The National Security Agency/Central Security Service (NSA/CSS) Commercial Solutions for Classified (CSfC) Program has been established to enable commercial products to be used in layered solutions protecting classified NSS data. This solution may well incorporate nested VPNs, secured booting and some sophisticated methods of user authentication.
A significantly wider set of chief information security officers (CISOs) that support businesses in financial, pharmaceutical and critical infrastructure may offer a different level of security protocols.
Because the system security is enforced all the time for the protected session must ensure:
- Data encryption is always on.
- VPN functional is always on.
- USB device insertion is always off.
Naturally, this functionality must be supported by industry standard machines running Windows and or Linux and priced similarly to existing hardware in the market.
