With the breakout of the first Global Pandemic COVID-19 pandemic & Lockdown, there will is a greater emphasis on lowering the intensity of business travel, encouraging the entire ecosystem for Work from Home (WFH). Businesses are already turning to the idea of WFH to protect employees from the Covid-19 virus and secure their wellbeing, to ensure minimal interruption in services and keep the business rolling of the economy turning.
With remote work has become a forced necessity for all the organizations looking to create business continuity plans. Remote work also presents a unique challenge for information security because remote work environments don’t usually have the same safeguards as in the office.
When an employee is at the office, they are working behind layers of preventive security controls, however, when computers leave the perimeter and people work remote, new risks arise.
Pradiman Pandita, Vice President -IT & Quality, CISO at Hughes Systique Corporation shares his views that while WFH becomes a shared responsibility of all the functions, including IT, HR, Admin, Finance & Engineering it is best to follow the best security guidelines to avoid potential risks. User are advised to follow below security practices while working from home.
Enterprise is already outside the wall!
In the age of digital transformation, with the Cloud adoption and mobile revolution, business is already running outside the data center, however, Enterprises must consider the consequences of WFH in terms of Systems Access, Access to Internal IT infrastructure, Bandwidth costs and Data Repatriation. What this means, basically, is that when employees accesses Company data and/or databases remotely, then the risk to that Data grows, external working adds public internet, local networks and consumer-grade security systems to the risk mix.
Challenges and Weak Links
The challenges involved in securing a work-from-home footprint can be myriad, according to security professionals.
- End-user security awareness was the top challenge cited by respondents in securing their remote footprints.
- The next-biggest concern was housing sensitive data off-premise and transmitting it via the open internet.
- A lack of IT resources can bite many organizations as they move to enable remote strategies. And when Employees are sent outside the normal perimeter, managing device sprawl, and patching and securing.
Remote Work Policies
When employees go home, new rules apply. They are relaxed, loud and casual, even distracted. Workplace security is the last thing on their mind. Therefore, when they connect from home to enterprise systems, everyone along the chain of connectivity is more vulnerable.
We at HSC are following various security controls to safeguards or countermeasures to avoid, detect, counteract, or minimize security risks to physical property, information, computer systems, or other assets during WFH. HSC has implemented strong policies for accessing office network remotely. We are using VMware VDI / SSL / IPsec VPN, which include following security controls. These controls should help employees act safely with corporate devices and information no matter where they are working.
- Business Continuity & Disaster Recovery Plans (BCP)
Ensure that management responsibilities are shared between Teams and Ensure we put contingency plan in place now in case of key personnel get sick. Tech support, password and security management, essential codes and failsafe roles are all Assigned and Duplicated.
- Virtual Desktop (VDI) Security
Below security features are being used in VDI environment.
- Data Protection – Data cannot be saved locally
- VDI desktop Security – Software installation is not allowed to end users
- Secure Tunnel connection – Horizon Client makes a secure HTTPS connection to the Connection Server or security server host when users connect to a Horizon desktop.
- Remote End Point Security by SSL & IPsec VPN
Our Next Generation Firewall is configured with latest version of cipher suite SSL VPN services , New IP-Schema added to the SSL VPN Pool to fulfill IP address requirement of all Remote Users, Per-user basis policy filtering by integrating AD database with the SSL remote User by which we are only allowing users with AD credentials & HSC laptop. IPsec VPN is configured on cisco ASA which is used as a backup for remote users and as a Primary resource for S2S communication.
- Endpoint Security
Apart from Endpoint Security services like Antivirus and encryption, we have deployed the following solutions to ensure maximum coverage of information assets protection:
- DLP Solution Tuned in Content Aware Protection mode that it prevents Data leakage through all possible exit point, from clipboard, Application like MS Outlook, Skype
- Web Proxy endpoint agent provides real time content scanning and web site classification to protect network computers from malicious web content while controlling Employee access to internet.
- Endpoint Event Reporting & Logs – Our SSL Analyzer synchronized with firewall which is SSL VPN enabled with AD Integration by which we are getting E2E visibility with Event correlation & Threat Detection
- EDR (End Point Detection & Response) agent helps us to ensure that nothing bad comes in and nothing good leaves the end point.
- Extend patch management to all remote devices and end points.
- Securely store sensitive files
When there’s a legitimate business need to transfer confidential information from office to home, especially for the functions like Finance, HR, Admin, mandate is to use ONEDRIVE protected with CASB solution.
- Secure your home network
All the users are advised to start with their home router. Turn on encryption (WPA2 or WPA3). Encryption scrambles information sent over your network so outsiders can’t read it.
- Security Training & Practices
Our home is now an extension of our office. So, follow the protocols that your employer has implemented. In addition, we conduct regular training sessions (mandatory) to ensure WFH is truly an extension of our office.