One of the lasting changes brought about by the COVID-19 pandemic is that it forced organizations to rethink the concept of a workspace. As remote work became inevitable, IT teams had to enable the secure transition to remote work almost overnight. Opening up offices, on the contrary, will likely be executed in planned phases. A United States Department of State advisory recommends that workforces return to an office in three phases, with the employees most at risk coming in at a later stage. The European Union has also issued guidelines for organizations that want to reopen their offices and facilities.
However, it is likely that a significant portion of office employees might choose to work from home instead of commuting to work each day. According to Gartner, 74 percent of the CIOs say that at least five percent of their workforce will continue working from home once the pandemic situation subsides. Similarly, in a study conducted by Business Insider, 54 percent of employees said that they would prefer working from home even after the pandemic ends. It remains to be seen what percentage of employees in each organization will work from home permanently. But it is inevitable that IT teams will have to formulate guidelines for a different sort of an office post-COVID. The policies developed now are likely to be the standard operating procedure (SOP) in the days to come.
Secure SOP for remote work
Create a secure home network: If employees routinely log in through Wi-Fi with weak security, the risk of their credentials becoming compromised is high. A malicious actor can then use the credentials to compromise the main corporate network to carry out an attack. For the users choosing to work from home long-term, it is important that they follow the password policies recommended by their organization’s IT security administrator.
Tip: It is useful to think of any Wi-Fi used for logging into work as a corporate network, and subject to the same security guidelines. Help your users make their primary network as secure as possible.
Ensure that only secure devices are used for logging in: If a work device fails to start, it is highly likely the employee will try to logon with a personal device. These devices often do not have the required level of security as enterprise issued devices. Known vulnerabilities may remain unpatched, and the antivirus software may be outdated. If a malicious software such as a keylogger is already present, even a single use is enough for an attacker to capture a user’s credentials. It is crucial to educate your users about the hazards of logging in with insecure devices.
Tip: Anticipate scenarios such as your users’ work devices getting damaged. Have a backup plan for them to login using another secure device instead of any personal device.
Educating your users about the risks of open Wi-Fi networks: Since the information sent over open networks is not encrypted, these networks should be avoided as a rule. It is crucial that work devices are never connected to an open network since it is not uncommon for malicious actors to set up open Wi-Fi networks with the intention of stealing credentials.
Tip: If your users feel like working outdoors for a change, like the outside area of a cafe, instruct them to consider carrying their own hotspot, and ensure that it is not discoverable by others.
Where users of an organization are likely to be working from a range of locations, monitoring virtual private network (VPN) connections, identifying anomalous behavior, or discovering an unauthorized privilege escalation can prove to be a challenge. This is why having a security information and event management (SIEM) solution like ManageEngine Log360 can make your job easier. The solution has built-in machine learning algorithms to detect anomalies in user behavior, a range of pre-built reports, and alert profiles to detect and mitigate security events no matter where your users chose to work from.
For more information on how Log360 can help you, please click here. You can also evaluate through a free 30-day trial download. Or, you can schedule a free demo where our product experts will answer your product questions and demonstrate the benefits of using Log360 in your organization.
