Bet you didn’t think that remote workers are vulnerability points, here are 3 ways how

[This is a sponsored article with Aruba and Techdata.]

When the first movement control order began in 2019, a survey showed that almost 44% of workers in Malaysia were forced to work remotely as businesses had to adapt to stay relevant during the pandemic.

Today, as we transition to the “new normal”, research from late 2021 shows that at least 33% of Malaysians prefer working remotely because of the added flexibility it provides. Some would even go as far as resigning if their job does not allow them to work remotely.

However, by working outside the confines of a secure business network, remote workers are vulnerable to many kinds of cyberattacks.

Not only would such an attack spell disaster for the user, but it also poses a major security risk for the business as valuable information can be stolen or corrupted by cybercriminals.

Here are three ways how remote workers could become vulnerability points for businesses, and how these threats can be mitigated.

1. Our personal-use devices lack phishing filters

In 2020 alone, 91% of cyberattacks that started with phishing were usually emails masquerading as legitimate entities in order to trick victims into clicking a download link. This link then installs malware onto a user’s device.

Once the malware has been installed, it will relay keystrokes or allow the cybercriminal to access the user’s PC to extract login credentials, which can be used to gain access to sensitive information.

These include personal information such as customer credit card information, company intellectual property, or trade secrets.

But you may be thinking then, don’t email service providers nowadays have their own spam and phishing filters that warn you of opening certain emails?

Unfortunately, they aren’t always effective at properly eliminating phishing emails that were made to specifically address an individual or organisation.

2. Malware spreads easily through local area networks like your home WiFi

Since remote workers usually share their home networks with friends and family, it’s possible for computers that are already infected to spread malware to other devices on the same local area network (LAN).

A popular example of such a situation was the WannaCry ransomware attack in 2017. It infected other computers through a shared local area network and locked users out of their devices, causing around US$4 billion in damages globally.

While most modern Windows-based PCs come with Windows Defender antivirus built in, which can catch most common malware, it is usually still not enough to protect against a wide range of cyberattacks.

3. Public networks at cafes or elsewhere are prone to man-in-the-middle attacks

Remote workers that access a business’s network are also at risk of having their information stolen via man-in-the-middle attacks where cybercriminals intercept the data that’s on the way to its destination.

Once intercepted, the data can be copied or corrupted. Cybercriminals usually deploy these kinds of attacks in the form of free public WiFi, tricking people into connecting to it.

Upon connecting to it, however, you’re exposed to an unsecured and unencrypted connection that makes any sort of data exchange risky.

How exactly do you secure your business from the threats mentioned above?

There exist two different concepts to protect networks from cybersecurity attacks.

The first one is the Zero Trust (ZT) security framework. It requires all users, whether in or outside the organisation’s network, to be authenticated, authorised, and continuously validated for security configuration and posture before being granted or keeping access to applications and data.

Traditionally, a lot of cybersecurity approaches focus on keeping attackers out of a network. But what happens when a user has already clicked on that phishing link or unknowingly installed malware, therefore giving the outsider access in disguise of an insider? 

By always assuming that the network is already compromised, ZT only provides the user access within the network once they can prove that they are not an attacker through strict, continuous verification.

Using access policies, it also has the ability to limit an intruder’s access once they’re inside the network, preventing it from further compromise.

Secondly, there’s the Secure Access Services at the Edge (SASE), which is a cloud-based solution that protects new Software Defined Wide Area Network (SD-WAN) frameworks.

SASE comes with 5 core components that run primarily on the cloud including the SD-WAN service, Secure Web Gateway (SWG), Firewall as a Service (FWaaS), Cloud Access Security Broker (CASB), and Zero Trust Network Access.

Each component handles different aspects of a network’s security such as filtering unwanted traffic, monitoring ongoing transactions, and distributing traffic across WAN to improve network performance.

Aruba has a solution called Edge-to-Cloud Security that implements both the ZT and SASE architecture.

In addition to the benefits of both architectures, there are tools like the Aruba Central NetConductor to help automatically configure LAN, Wireless LAN, and WAN infrastructure on top of applying security policies. By doing so, it helps streamline the process when it comes to deploying a new network or registering a new device.

Furthermore, there’s Client Insights which uses machine learning and AI algorithms to automatically flag and quarantine any device that is deemed suspicious. A cybersecurity personnel will have to resolve this manually.

Your business will also get the Unified Threat Management for Modern Networks solution that provides additional layers of protection against cyberattacks.

-//-

As more businesses embrace remote working, it becomes increasingly crucial for them to take cybersecurity seriously, since a distributed workforce means unregulated network and device usage.

This opens up employees, employers, the business, and its stakeholders up to various risks, and oftentimes, action is only taken when a cyberattack has been carried out.

Employee productivity is one thing to worry about, but what does it matter if the tools and technology your workforce is using could be the very threats to their work in the first place?