Business continuity in the midst of a global pandemic is a hot topic right now.
How do you ensure that a business and its many complex processes will continue to run even when faced with—in some countries—draconian levels of quarantine protocols that essentially prevent employees from going to the office to work?
Ensuring that a business will continue to run efficiently means adopting alternative methods for work. Remote work has been an option for many companies and businesses in the last few years because of the increasing popularity of the concept of work-life balance. A study conducted by Global Workplace Analytics showed that employees who work at home have increased by 216 percent since 2005, but it has exploded over the last year as the de facto method for work and productivity because of the travel and proximity limitations imposed by the COVID-19 pandemic.
In fact, a study conducted by Gartner revealed that 88 percent of businesses worldwide either required or encouraged their employees to start working from home as a way to address the health concerns brought about by the pandemic.
However, work-at-home arrangements have also brought about a new problem: rising cyber-attacks.
Remote work means that employees will now be accessing their organization’s network from their homes or wherever they are working from outside of the office. But most organizations have been caught flat-footed by this change in work dynamic. This meant many networks and IT infrastructure have not been properly configured to handle the amount of traffic that it will receive remotely. Cybercriminals are quite aware of this inadequacy.
One of the most common pathways for criminals to gain access to an organization’s network is through application attacks. Inadequately configured applications and networks that do not have a properly installed web application firewall have become a favorite entry point for malicious actors.
According to the Global Threat Intelligence Report, web application and application-specific attacks comprised 67 percent of all the total attacks committed in 2020. This is a significant statistic that proves applications will continue to become vulnerable, and more so as remote work becomes more prevalent worldwide.
The enemy from within the ranks
One of the strongest reasons for the rise of web application attacks in the advent of the new remote work revolution is the fact that the organization now essentially works from outside the confines of the office. Office networks are protected. These networks can be seen as forts that protect their employees from outside forces.
However, the remote work arrangement meant a total change in dynamics. All of the employees have left the fort and are now accessing the network from wherever they are, using various devices that may not be officially given by the company or configured by its administrators. This means each employee is now a potential, but unwitting, carrier of attacks.
In an article published by The Guardian, a cybersecurity expert compared the work-at-home situation as akin to having more open doors to access corporate networks, attributing each device being used by an employee as a door towards the network.
Some organizations have been proactive enough to have installed protections like web application firewalls to help in filtering attacks that would come from exploits found by malicious actors in the applications and other services used by employees while they work from home. Administrators hope that a WAF would be a good first line of defense against cyber-attacks. But while these kinds of defense are effective, many organizations fail to deploy it or if they do, it’s not configured properly.
One recent example of the vulnerability of systems is the shutdown of the Colonial Pipeline, which gained headlines all over the world. The shutdown of the fuel pipeline was caused by hackers being able to access the company’s network through a virtual private network, which employees working remotely use to access the company’s system. This is the kind of risk office systems are potentially exposed to whenever employees access the network.
Bad habits
Employees themselves are considered contributing factors that allow hackers to access devices. A recent study conducted on UK and US security companies revealed that 56 percent of IT technicians think employees have bad cybersecurity habits and this has been compounded by them working from home. They believe these habits have been exacerbated because there are no IT administrators or members of the IT department to remind them or institute strict cybersecurity measures.
One example of a bad habit is the practice of remote employees transferring company data through their personal email accounts, often accessing it through a browser or a web application. More often than not, these personal email accounts do not have two-factor authentication turned on, which now makes it easy for criminals to access company data from compromised email applications.
Fixing the problem
IT experts recommend organizations’ IT personnel initiate protocols that will address the vulnerabilities associated with remote work. As mentioned before, a great first line of defense is security measures to protect the network infrastructure. Another important measure is to initiate a security policy, wherein the IT department will screen employees’ personal devices that they use when working at home.
This can be as simple as providing employees with instructions on how to secure the devices. Some companies even go the extra step of having IT personnel configure the devices themselves as an extra level of service to employees. Of course, a crucial security measure is to educate employees about cybersecurity threats and stress that they can play a significant role in eliminating these threats by simply practicing good cybersecurity habits.
Conclusion
Remote work will continue to increase in popularity even after the pandemic is addressed globally. This new paradigm brings with it new security concerns for organizations. But by simply providing employees with training and assistance in establishing healthy cybersecurity habits these threats can be lessened, if not completely eliminated.
