Services
In light of Coronavirus / Covid-19 and in particular, the key CDC recommendation that we implement social distancing (work from home), we wanted to try to write a helpful post about working remotely securely.
Jemurai has always been remote friendly, with employees sprinkled across the US and we can talk about what makes our remote teams work. This post however, is aiming to focus on the security angles of working from home.
We also put together a checklist for securing your remote work environment that you can download and use across your teams.
The good news is that it is practical to work from home when the appropriate infrastructure is in place.
For some companies that already have a VPN and maybe use primarily cloud based SaaSSaaS stands for Software as a Service, which is a cloud computing model that delivers software applications over the internet as a subscription-based service. With SaaS, users can access software applications and data from anywhere with an internet connection, without the need for on-premise installation or maintenance. SaaS providers manage the infrastructure, security, and maintenance of the software application, freeing users from the burden of software updates, patches, and backups. tools to get work done, there may be more of a social impact than a technical impact to working remotely. In other words, people can be productive and secure working remotely in this scenario.
There are also a lot of companies that are quite close to being able to unleash a remote workforce with just a few safety measures put in place to ensure that information isn’t exposed or compromised in the process.
The bad news is that there are a lot of companies that aren’t well prepared for lots of remote work. Either they have internal systems that are not easily exposed outside of their office or they have paper trails or other physical security measures that they need to have in place.
Consider also that many classic security tools are running in the corporate network. What happens if most users aren’t really in the network?
The following sections provide detail around different things we need to do to ensure our work environment is safe.
Often, employees working at home are using their home wireless network. To ensure that organizational information is not compromised through this process we need to take several steps to secure the WIFI.
When we work from home, even if our WIFI is secure, usually other devices on the home network can see our computer and often our specific location is available to sites and services that we visit.
A VPN is a strong countermeasure for both local computers on the network being able to see our traffic and for obscuring our exact physical location.
It is ideal if the company can offer a VPN service with tested configurations that work with supported devices. If they cannot, there are commercial VPN services (eg. ProtonVPN) and even do it yourself options like Algo, which is what we at Jemurai use.
In security, we talk about confidentiality, availability and integrity. It turns out that availability is an important part of successful remote work. That may mean paying a little more for better internet service.
Actions:
Optional Enhancements:
We expect to see increased phishing and social engineering activity related to both coronavirus specifically and more people working remotely in general. That means that phishing campaigns and other attempts to manipulate employees are more likely even than they were before. We advocate for specific awareness campaigns against these types of manipulative campaigns.
In some corporate environments there are countermeasures in place to ensure that employees cannot accidentally browse to a malicious website. Essentially, the corporate network has a directory (DNS) that your computer uses to look up where it is going to visit and the directory contains information about “bad” or “malicious” sites and doesn’t let you go there.
Sometimes the corporate protections work if you are on a company VPN.
There are also public and free DNS services that can also protect you from malicious URL’s, including Quad9.
Action:
It sounds obvious, but when you are working from home your conversations are not private to a company audience and your desk is not private from casual observers. Whether it is your spouse, a cleaning lady, your kids friends or a relative at a party, you probably don’t control or want to watch your physical environment at home the same way it is managed in an office spaace.
Most companies implement a clean desk policy anyway to ensure that passwords, client data or other sensitive information is never sitting exposed to passersby.
Actions:
In the event that there are internal services that are not easily exposed, a company will have to do some soul searching and decide how to address this gap.
On the one hand, it is technically possible to expose internal systems using solutions like Citrix, or even VPN. On the other hand, if the remote part of this setup isn’t established yet it may be costly and complicated to set up a solution like that.
It may be that the best approach is to focus on identifying cloud based alternatives or workflows that do not require the on site systems. On some level, being able to overcome this centralization should be part of a business continuity plan already - where critical systems are identified and ways to use them under changing circumstances are understood and tested.
There are some basic issues that can arise. One is related to group policies, that IT should be pushing out to users. This is a challenge if the user isn’t connecting to a central domain controller. Another concrete example is that security mechanisms like windows event forwarding (WEF) must be set up to report to a place they can reach, and an internal forwarding address won’t be visible from outside.
Actions:
It is very important that laptops and other work devices used for remote work have encryption enabled. This is true even when employees work in an office, but the risk of a laptop “disappearing” may be higher at home or in other remote locations.
It is also important that systems are patched regularly.
Although tools like AntiVirus and AntiMalware programs are important in the office, they are arguably even more important out of the office because an event, incident or compromise might be much harder to detect at an infrastructure level. Therefore, in an ideal world, we would mandate and enforce that these endpoint controls are in place before connecting to valuable company services.
Commercial VPN tools provide these types of controls but most more open VPN tools do not. The risk we take here should be commensurate with the size of the organization and the sensitivity of the data involved.
To say that another way, use commercial VPN tools that let you enforce endpoint configuration (OS Updated, Programs Patched) if your data is extremely sensitive.
Actions:
The best rule to use with storage, i.e. where your files live, is to use the same locations when working remotely that you use when on site. This can be a problem if the typical approach is to use a Windows File Share, for example. Sometimes a VPN can provide access to these shared resources, but that requires an enterprise grade managed VPN.
On the other hand, if there are approved storage solutions like Dropbox, Box, Drive or OneDrive, these can be used the same way remotely as they are in person.
That being said, it is important that users do not use personal file storage solutions to work around company shortcomings. This can result in unintended data exposure.
Action:
There are some things that people naturally do when they want to be productive from home that are not probably a good idea.
These include:
To support remote work, there is an onus upon the organization to update and enhance their security monitoring capabilities.
We would generally want to see:
The environment outside the office when employees work remotely is often quite different from the office network.
Many of the same security measures are important in both cases, but out of the office, there is usually less support around technology and “drive by help” may not be accessible. It may be helpful to work through the details and publish specific guidance (even a WFH Policy) for employees to help them navigate this.
We wanted to help companies shifting to remote setups maintain secure work environments so we collected the safety measures into a handy checklist for employees to use when thinking about their setup at home. You can download it here.
Also, feel free to reach out at support@securityprogram.io.
