It’s been 4 years since COVID-19 forced many organizations to shift to a remote workforce. But even as some health risks have subsided, many workers still have not returned to the office.
This new normal is just one of several challenges that organizations are facing right now. A quick shift to remote work allowed many companies to continue operating through the coronavirus crisis. But as attitudes about remote work evolved, businesses have had to create a stronger long-term plan to accommodate a hybrid workforce (while also managing the heightened security risks).
If your organization is considering a permanent or long-term switch to hybrid work, here are 14 questions to consider ASAP to ensure this shift remains sustainable, efficient and secure.
1) Who gets to work remotely … and who doesn’t?
This is an HR question at its core, but it affects nearly every other part of your business, including your IT security policies.
Your work-from-home policies need to be crystal clear. Otherwise, it will create confusion and frustration – not just for employees but for the IT teams tasked with making remote work possible.
Which employees or departments will be required to come to work – and why? Will remote workers be required to occasionally come to the office for certain meetings or tasks? When and how often?
These policies must be communicated from the beginning, especially if the changes are permanent. Otherwise, your HR staff and managers will be spending their days fielding questions from employees, instead of focusing on the big picture.
2) How will job responsibilities need to change?
What will each worker actually do?
For many jobs, not every task can be completed outside the business’s central location. So before you can begin the conversation about what equipment or tech your remote workforce needs to be productive at home, you need to figure out what they can actually do.
This may mean changing the job responsibilities for some positions – or implementing new applications, as we discuss further below. Some staff may need to learn how to use new tools or take on projects that were previously handled by others. That’s especially true if some positions needed to be eliminated to maintain efficiency.
Whereas a reactionary response to COVID-19 was allowing all office workers to work from home, the long-term strategy is now adapting positions to make remote work possible for the foreseeable future.
3) What devices will your remote workforce need?
When lockdowns were announced, many businesses didn’t have the time or resources to immediately give laptops and other devices to remote workers. In many cases, employees were allowed to use whatever personal devices they already had at home. It was a security nightmare for IT to figure out, but it was a quick solution nonetheless.
But now, with the likelihood that remote workforces may be permanent at some organizations, businesses need to be sure that workers are adequately equipped with secure, reliable devices.
Ideally, employees should be given devices that have been acquired and configured by IT. This ensures that all remote devices have company-approved operating systems, software, anti-malware solutions, business applications and network connectivity.
If employees will use their own devices, these devices must be protected by the same endpoint security solutions as all other company machines, especially if they will connect to the network. (Similarly, even the company-supplied devices must have stringent endpoint security, as we elaborate on below.)
4) How will they connect to the network?
If you want to maintain control over data storage, backups, patch management, software installations, firewalls, application whitelisting and other administrative controls across the organization, then users absolutely need to connect to the company network.
Back when the COVID lockdowns first happened, smaller businesses may not have had time to connect users’ personal devices to the network. And maybe that worked out for a little while as employees were able to be productive without network access. But if your organization is making your remote workforce permanent, then you need to close this security gap ASAP.
Supplying users with company devices was step one. Step two is configuring those devices to make a secure connection to the company network over the user’s own Internet.
A large remote workforce that is not connected to a single secure network is a disaster waiting to happen.
5) What about remote desktop and virtualization?
With employees working from everywhere, you need more ways for users to connect to various company systems.
If creating a direct network connection on users’ devices is not yet feasible, then users should at least be able to use remote desktop connections and other virtualization tools to gain remote access.
Remote desktops and VMs are useful if users need to access computers that are located at HQ (or elsewhere). For example, by signing into the remote desktop, they can continue to access their computer at work, including programs, email and other data.
Using virtualization can also be useful when connecting disparate operating systems – for example, when you need remote access to a Windows machine from a Mac.
But again, tight network security is a must regardless of how users connect, which brings us to our next question to consider.
6) How will network access be secured?
Your remote workforce is probably connecting to the network in a variety of ways, from different devices and locations. Plus, each user probably accesses an array of network resources: directories, applications and so on.
Not long ago, it was common practice to give remote users access to virtually everything on the network once they authenticated. But these days, this is simply too risky.
Today’s hackers (and the malware they deploy) know how to exploit the many vulnerabilities in unsecured networks. Often, it only takes one compromised device to bring down the whole network if safeguards aren’t in place.
Basic access control is a decent starting point. But for most businesses, the security needs to be much more granular.
That’s where the principle of zero trust comes into play.
Zero trust is the idea that no user, device or application should be trusted to access network resources unless they are authorized and continuously validated. More precisely, zero trust network access (ZTNA) allows you to implement defined security policies that provide greater control over all network activity.
ZTNA enables you to control who has access, from which devices and to which network resources. If any suspicious activity is detected along the way – such as an unexpected device change or unusual behavior – access can be revoked instantaneously.
ZTNA thus helps to block unauthorized access and stop threats from spreading laterally across a network. This is the kind of network security that today’s businesses require for their remote workforces.
7) How will teams communicate?
When communication is faster, teams are more productive.
Sure, apps like Slack and Zoom worked fine, even before the pandemic. But what about in the long term?
Are there other communication solutions that can be better integrated with existing processes or technologies, such as Microsoft 365 and Teams? Can communication be strengthened even further, so it’s easier and more efficient?
What about the simple act of calling colleagues when emails and DMs won’t do? Will workers be instructed to use their own mobile phones, or will they be provided with company devices?
All of this needs to be mapped out in order to ensure maximum efficiency and security.
8) How will they collaborate?
Staying in touch is one thing, but actually collaborating as a team is another challenge altogether.
If employees can’t be in the same place, how will they “work together?” How can decentralized processes be streamlined and conjoined?
There’s no shortage of tools for remote collaboration. We often point to the efficiency of Microsoft 365 and Egnyte for file sharing and collaboration. But it really depends on the specific needs and goals of the business.
Now more than ever, businesses will need to rely on robust SaaS tools to keep projects moving at breakneck speed. That could include tools for project management, digital whiteboard sharing, CRM, marketing, business processes and more.
Teams should be given some flexibility to identify the tools they need. But it’s important to make sure that the selected tools are properly assessed by IT for security issues and proper integration with existing processes. This brings us to the next important question.
9) Which applications will your remote workforce need?
Did you know that 1 in 10 companies now use more than 200 different applications?
In the era of hybrid work and SaaS, the number of applications used by organizations has skyrocketed. And naturally, so have the security risks.
Whether the applications are cloud-based or locally installed, businesses need to maintain tight reins over the programs that employees use. If they don’t, it’s only a matter of time before malicious programs are installed, either inadvertently or via a cyberattack.
The first step is determining which applications are needed, and by which teams. Then, businesses can secure those applications by making them accessible only to authorized users, as we discuss in the next point.
10) How will you keep those applications secure?
The vast majority of ransomware infections begin with executable files that are opened by unsuspecting users or by processes within other applications. So how do you stop these cyberattacks when you have employees using so many different applications with near-endless attack vectors?
One effective solution is Application Allowlisting.
Allowlisting applies the concept of zero trust to your applications. It blocks all applications from running, except those that are specifically authorized. Even if a legitimate application tries to execute a script, it will be denied if that script is unrecognized.
This strategy alone will help to prevent most ransomware attacks and other malware infections that rely on rogue programs. Meanwhile, employees will still be able to access the apps they need, and if new software is needed, they can request approval from admins with just a few clicks.
Multi-factor authentication is also a must. It ensures that only your authorized users are able to access your systems by requiring a simple extra step in the authentication process (i.e. authenticator app, passcode, biometrics, etc.). So even if a user’s credentials have been stolen, the bad actor will not be able to sign in to your systems.
11) What tech will support these workers?
We mentioned the need for SaaS applications, which largely leverage the cloud for speed and reliability. But obviously that’s only one part of a much larger computing picture.
If users will be connecting to the company network, using remote desktop, spinning up virtual machines and running applications off company servers, then it’s going to put a whole lot of stress on IT systems.
It’s critical that your underlying infrastructure can support this remote workforce. If your organization wasn’t already set up to handle a decentralized workforce, then chances are you need to reassess your technology deployments ASAP. Investing in new hardware and systems now will better position your company in the long term and will significantly reduce the risk of an IT meltdown.
12) How will data be protected?
Businesses need to start thinking about data protection in a post-COVID-19 world.
As companies shifted to remote work, data backups became an afterthought. With little time to react, businesses’ top priorities were ensuring workers could keep the business running from afar. But this meant that many devices were no longer being protected by the company’s data backup systems.
In the long term, this approach is not sustainable. Organizations need to be sure their data is backed up no matter where it lives. That means backing up not just the company servers, but also endpoint devices, virtual environments and clouds.
A unified business continuity and disaster recovery solution is essential for protecting the entire infrastructure and preventing data loss across the organization, whether users are working remotely or on site. SaaS and VM backups need to be part of that continuity, too.
13) How will your systems be secured?
Remote workers’ devices need the same cybersecurity and antimalware protection as on-premise systems – if not even more.
As businesses adapted to the coronavirus pandemic, hackers exploited vulnerable systems to deliver malware. And, they took advantage of the chaos and confusion to fool users with deceptive phishing emails.
This problem isn’t going away anytime soon. To adapt to this new normal, businesses need to deploy stronger cybersecurity systems and protocols across the organization. That includes everything from antimalware software to tighter firewall settings, as well as more frequent employee training to ensure that remote workers are constantly reminded of safe practices for web and email.
Endpoint security is essential for remote workforces. Solutions like Sophos Endpoint Protection can shield your employees’ devices from threats and neutralize suspicious activity before it escalates into a full attack.
70% of cybersecurity breaches originate on endpoint devices. So by tightening security on employees’ PCs, laptops and phones, companies can significantly reduce their attack surface.
14) Should you still be managing your security?
Cybersecurity in the hybrid work era is not for the faint of heart.
For most businesses, it has become too costly, complex and time-consuming. Threats are constantly increasing and evolving. False alarms take forever to investigate. And when real threats arrive, they’re difficult to contain until it’s too late. Meanwhile, internal IT teams end up spending their time on security instead of business enablement.
So the question to consider is: is it still worth it to manage security internally?
For many organizations, it’s not.
This is why many companies are moving to managed detection and response (MDR) from providers like Field Effect and Sophos.
MDR leverages the latest cybersecurity technologies, backed by human intelligence, to make security easier and more effective. Field Effect Covalence, for example, can detect and block threats anywhere on your network far faster than most internal teams can. It also analyzes your infrastructure to uncover security gaps and provide actionable steps to resolve vulnerabilities.
Simply put, it’s a hands-free cybersecurity solution that responds to abnormal activity across your entire IT infrastructure, around the clock. This produces greater security outcomes, while also reducing the costs of security management.
Conclusion
The remote workforce is here to stay. While the COVID-19 pandemic may have been the initial catalyst for remote work, the new era of hybrid work will likely continue to transform the way businesses operate for years to come.
Now more than ever, organizations must adapt their security to eliminate the vulnerabilities posed by this shift. Companies that will continue relying on a decentralized workforce need to rethink their approach to remote access and collaboration to ensure that all systems stay secure and employees stay productive.
Frequently Asked Questions about Remote Workforce Security
1. What is remote workforce security?
Remote workforce security refers to the cybersecurity policies and tools that a company uses to safeguard the systems used by off-site workers. Examples of remote workforce security tools include zero-trust network access, firewalls, multi-factor authentication and application allowlisting, to name a few.
2. How do I secure my remote workforce?
The most effective way to secure a remote workforce is to maintain rigid controls over who can access company systems and how. Use strong network firewalls and zero-trust network access tools to block threats externally and internally. Implement endpoint security to prevent users’ devices from being compromised.
3. What is the security concern on remote working?
A main security concern for remote workforces is the increased risk of cyber threats entering company systems from off-site devices. This is why it’s critical for organizations to increase their network security and implement strong endpoint protection, which can help to neutralize threats on users’ devices before they cause a full breach.
Is your remote workforce creating a security risk? Let’s review it.
If you’re currently reevaluating your remote workforce security, we can help. Contact our business continuity and cybersecurity experts to learn more about solutions for endpoint protection, data backup, MDR, networking and more. Schedule a meeting with one of our data protection specialists at Invenio IT or contact us by calling (646) 395-1170 or by emailing success@invenioIT.com.
