Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


As Remote Work Becomes the Norm, Security Fight Moves to Cloud, Endpoints

A majority of firms expect to keep more employees working remotely post-pandemic, forcing businesses to undertake more comprehensive digital and cloud transformations.

As states and cities look to lifting stay-at-home orders, the increased level of employees working remotely will not disappear. That means many businesses will be moving more of their infrastructure to the cloud and having to deal with the security challenges that come from a hybrid infrastructure, experts said this week.

Almost three-quarters of companies (74%) expect at least 5% or more of their former on-site employees to work from home on a permanent basis, while nearly a quarter of firms are planning to keep at least 20% of their workers out of the office post-pandemic, according to a survey of chief financial officers by market research firm Gartner. 

With remote work comes greater cloud usage. That could be a problem for many companies that have issues with visibility into the security of their cloud components, and that often rely on perimeter and on-premise security software and appliances to keep their systems and data safe, says Michael Sentonas, chief technology officer at security services firm CrowdStrike.

"It's my feeling that after the pandemic has subsided, we are going to see a major shift in the workplace as more businesses turn to remote-friendly cultures," he says. "This shift will cause cloud and SaaS adoption to be more important than ever. The cloud will ultimately secure workloads regardless of where employees are located, which will be critical to secure endpoints now and moving into the future."

Prior to 2020, telecommuting grew slowly despite the benefits of remote work, such as greater worker retention, lower employee stress, and more flexibility in work hours. The coronavirus pandemic changed companies' reliance on on-site workers, with many technology firms now relying almost exclusively on employees working from home.

IBM, like so many other businesses, has moved almost entirely to remote working, with 95% of its current workforce working outside of the company's offices. The move is a reversal from when the company revised its work-from-home policy in 2017, forcing thousands of employees in a variety of positions — from marketing to information technology — to come back to the fold and work from an office in one of six cities.

Yet the company — a major player in the cloud — was far more prepared for the challenge than many companies' IT and information security groups, says John Wheeler, business information security officer (BISO) and vice president of strategy and innovation at IBM. Turning the weeks-long disruption of enforced remote working into a business strategy will require a transformation for many firms, he says.

"Coming out of this, CIOs and CISOs need to embrace the fact that we need to continually be ready for a full remote workforce," he says. "We need to assume we are going to have a resurgence of what we are dealing with today, so we are prepared for it. We don't know what the future will be like over the next 12 months."

In a forthcoming report, CrowdStrike found that 89% of business decision makers are now working from home, a 56% increase from before the COVID-19 pandemic. Six in 10 remote workers are using personal devices to do work, and almost all of those workers believe — naively — that their devices are secure, CrowdStrike's Sentonas says. 

Attackers have focused on targeting remote workers, virtual private networking (VPN) technologies, and collaboration software, such as Zoom, in their attempts to take advantage of companies' now much-more-distributed attack surface area, he says.

"Today's stealthy adversaries are keenly aware of this and have been opportunistic as such, using the increased amount of devices to gain access to corporate networks and data," Sentonas says. "With no sign of attacks slowing down, it's more important now than ever for companies to be vigilant about their security posture and train employees on possible risks to protect and defend against rising threats."

IBM has seen a massive increase in coronavirus-related phishing, spam, and malware attacks, says IBM's Wheeler. Many companies do not have the ability to lock down employees' laptops no matter where they are, he says.

"Effectively overnight, your attack surface increased dramatically because any workforce is now outside any perimeter security that you possibly had within an office space," he says. "So you are totally relying on the security that you have built into the endpoint, the security awareness that you have instilled in the users, and any forced connectivity that you have using a VPN back to your own infrastructure."

Complicating matters will be employees' decisions to use unapproved cloud services for work, so-called shadow IT, and the unique risks that remote privileged users pose to network security. In addition, managing the security operations center remotely also poses significant challenges, Wheeler says. About a third of companies struggle with gaining visibility into the security of their cloud infrastructure, according to the "2019 Cloud Security Report."

"Endpoint security is absolutely critical," he advises. "Second, companies really need to focus on end-user security awareness. Finally, cloud is here to stay. Collaboration tools are here to stay. Your employees are going to be hooked on them, and they are going to allow you to be more productive and things will be done, but attackers will focus on those weak points as well."

Related Content:

Learn from industry experts in a setting that is conducive to interaction and conversation about how to prepare for that "really  bad day" in cybersecurity. Click for more information and to register.  
Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Oldest First  |  Newest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 11/19/2020
New Proposed DNS Security Features Released
Kelly Jackson Higgins, Executive Editor at Dark Reading,  11/19/2020
The Yellow Brick Road to Risk Management
Andrew Lowe, Senior Information Security Consultant, TalaTek,  11/19/2020
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: He hits the gong anytime he sees someone click on an email link.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-11-25
osCommerce has XSS vulnerability via the authenticated user entering the XSS payload into the title section of newsletters.
PUBLISHED: 2020-11-25
GLPI stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI before version 9.5.3, any authenticated user has read-only permissions to the planning of ever...
PUBLISHED: 2020-11-25
Nanopb is a small code-size Protocol Buffers implementation. In Nanopb before versions 0.4.4 and, decoding specifically formed message can leak memory if dynamic allocation is enabled and an oneof field contains a static submessage that contains a dynamic field, and the message being decoded...
PUBLISHED: 2020-11-25
A flaw was found in the way the spice-vdagentd daemon handled file transfers from the host system to the virtual machine. Any unprivileged local guest user with access to the UNIX domain socket path `/run/spice-vdagentd/spice-vdagent-sock` could use this flaw to perform a memory denial of service fo...
PUBLISHED: 2020-11-25
An XSS issue was found in the Shares feature of LiquidFiles before 3.3.19. The issue arises from the insecure rendering of HTML files uploaded to the platform as attachments, when the -htmlview URL is directly accessed. The impact ranges from executing commands as root on the server to retrieving se...