Securing remote work in 2021

Now that the rush to work remotely is over, businesses are taking a step back to consider what infrastructure they need to support the new workstyles encouraged by the COVID-19 pandemic, and how to secure it properly.

"When COVID-19 struck, enterprises needed to quickly adapt and typically reacted by implementing the most expedient remote work options available. Generally, this involved a combination of VDI, remote VPN access and simple-to-deploy cloud-managed devices like remote access points," said David Hughes, founder of Silver Peak and Senior VP of the WAN business at Aruba. VDI stands for virtual desktop infrastructure while VPN refers to virtual private network.

"It’s now commonly recognised that the global pandemic has forever changed the way we work and conduct business. In 2021, enterprises will step back and review what they learned in the past year and evolve their remote work strategies, applying a longer-term perspective of the workplace. This will include eliminating trade-offs between security and user-experience and providing more a consistent experience as users work from home, the road or the office."

Source: Telstra. Bates.

"In the rush to secure organisations and ensure overnight remote digitalisation, many businesses and their teams unintentionally took part in behaviours that put themselves and the companies they work for into a cyber-vulnerable position, such as signing up for multiple free tools and collaborative online applications, to securing sensitive work devices to vulnerable home networks," Todd Bates, Regional Lead South Asia at Telstra agreed.

James Carder, Chief Security Officer & VP of LogRhythm Labs, also suggested that cybercriminals will be targeting remote workers. "Many employees will continue to work remotely in 2021 to slow the spread of COVID-19 until a vaccine can be reliably distributed. Consequently, bad actors are no longer following these employees 'through the door' when looking to steal data.

"Instead, they will seek to take advantage of workers who have been remote since the start of the pandemic, as they may be more likely to be letting down their guard when it comes to following security protocols. This relaxation on security protocol — combined with threats that already exist in a rushed remote work environment — will result in data loss rates exceeding what we saw in 2020," he said.

Source: One Identity. Cetin.

One Identity has named 2021 the year of the remote work data breach. "At the start of 2021, there will be an increasing number of companies that will begin to acknowledge data breaches that occurred in 2020. In response, there will be a drastic number of regulatory audits, making it appear that data breaches are on the rise. However, the vast majority of breaches being publicised will not be new. Instead, the breaches that make headlines will be opportunities that were taken during the chaos and lack of management in the shift to remote work," said Serkan Cetin, Technical Director, APJ, One Identity.

"This will cause many companies to begin doing quick security fixes and focusing on privileged account management to address the problem. However, government agencies will already have recognised how slow-moving companies are to identify a breach, resulting in the implementation of stricter auditing practices."

How cybercriminals will get in

Trend Micro also highlighted the remote work challenge for security. According to Nilesh Jain, VP, SEA and India, Trend Micro, home networks will become targets for cybercriminals looking for a way into corporate networks. "Malicious actors will either take advantage of installed software or unpatched vulnerabilities — hopping from one remote worker’s machine to another until it finds a suitable target. This chain attack will spread to other users downstream," he said.

"Employees who remotely access confidential and critical information (e.g., human resources, sales, and tech support) will also be actively targeted by data-stealing attacks in 2021."

Jain further emphasised that COVID-19 contact tracing has its vulnerabilities. "Rapid access to data could be crucial in fighting the outbreak but easing data privacy measures leads to problems of its own. Big databases, along with hasty implementations, are rich targets for malicious actors looking to compromise collected and possibly retained data. Cybercrime groups can abuse this in different ways, including extracting identity information and selling it in the underground," he warned.

Trend Micro additionally believes that collaboration software platforms will be targeted in 2021. "Vulnerabilities related to Microsoft Teams, as well as SharePoint, Office 365, and Exchange, will be sought after in 2021. Processing potentially sensitive information in these collaboration software platforms will be a major concern for organisations with increased remote workforces, particularly in regulated industries such as financial services and healthcare," Jain predicted.

He advised, "Organisations should focus on creating security-based company policies and an incident response plan that covers the perimeter of their operations. This will harden services, workstations, and corporate data while empowering businesses to work remotely. Refrain from putting implicit trust in assets or user accounts regardless of the location.

"An incident response plan will have to outline how an organisation would deal with security in a network with discrete machines. Companies should advise work-from-home employees on home router and Internet of things (IoT) security, as well as the use of a virtual private network (VPN)."

Like Trend Micro, LogRhythm also identified collaboration platforms as a key vulnerability in 2021. The company has predicted that in 2021, the board meeting of a major company conducted using videoconferencing software will be exposed, resulting in a high-profile scandal.

"With so much of the world staying at home and finding new ways to communicate with others, people are using collaboration tools for everything from highly confidential government discussions to distanced learning in K-12 and university-level education. Both scenarios are targets for bad actors looking to exploit vulnerabilities. In both the school and office environment, Zoom has been battling a major influx in hacks since COVID-19 began, with bad actors partaking in ‘Zoom bombing’ to sabotage calls with disruptive videos and commentary. 

"As these criminals' efforts continue to become more sophisticated, we will see a threat actor gain access to a major public company’s board meeting and leak compromising business information that results in a high-profile scandal," Carder of LogRhythm elaborated. K-12 refers to the US education system from kindergarten, around 5 years old, to 12th grade, the end of high school, at 17 years old.

Another scenario that LogRhythm has identified involves deepfakes, or people captured on video who either do not actually exist, or who were impersonated. Carder said: "The unprecedented shift to remote work will lead to video and images of leaders inside an organisation being weaponised to exploit employees for financial gain. Outside of being used to target employees internally, this technique will be used to dramatically impact a specific stock by manipulating the public into thinking the CEO of a public company has done something damaging."

Mitigating the risk

"With remote work as the continued trend, there is a need to support the hybrid workforce with more emphasis on cybersecurity. Telstra suggests five immediate priorities businesses can explore to secure their workforce: streamlining security investments, training employees to be cybersafe at work and on the move, keeping VPNs running and as secure as possible in the short-term, investing in Zero Trust network access to replace ageing VPNs in the long-term and building a reliable security foundation for personal devices," said Bates of Telstra.

"With the above focus, we believe that organisations will not only be able to maximise the productivity of their people, but also create agility and resilience."

Vic Sithasanan, Chief Growth Officer, Everise DX, added that there is an insider threat when people work from home. He said that there is now a market for home-monitoring solutions that provide "the same level of data security inherent to centralised workplaces". He explained, "(Working from home) has sparked a need for smart monitoring able to programmatically prevent unauthorised actions – such as manually capturing on-screen data or allowing unauthorised individuals (often residents of the same home where the work is being done) from glimpsing such information."