How can you secure a remote workforce?

Implement an MDM with MTD for mobile devices Don't forget about those pesky mobile devices and tablets! The proliferation of the "mobile" endpoints continues to gain momentum as the MOST commonly used endpoint today. Considering most employees are allowed access to their corporate email and various cloud services from their mobile device, the ability to implement strong security controls on mobile devices should becomes a component of your remote worker strategy. And with more companies embracing BYOD, it is relevant to deploy MTD technologies to prevent device, network, applications or phishing anomalies with on-board remediation.

Emplear una VPN es una de las alternativas que han permitido asegurar los activos digitales cuando los colaboradores de las organizaciones trabajan de manera remota. El desafío es elegir un proveedor de VPN que se integre a las plataformas de seguridad perimetral y no sean soluciones "gratuitas" o temporales, ya que esto puede ocasionar la materialización de nuevos riesgos.

VPN is a good start to security for remote workers. Before covid your work machine was treated differently thana home computer. You had techs to work on it if there is an issue. At home workers do not have standard hardware or software leaving your company prone to a breech.

What’s important, configure your VPN in a way, that whole traffic comes through it, including DNS queries. Some vendors allow to configure a split, so the local network traffic is still available, avoid it if not necessary for your work. Also enabling automated connections when you join the network is a good way to go.

Virtual Private Network (VPN) is important for all remote workers/Stakeholders when trying to access and share resources with an organization. VPN helps to create a tunnel between the sender and the receiver end that provides secure communication by encrypting the data, also it helps to hide one's digital identity as well.

Securing a remote workforce is crucial, and one effective method is enabling multi-factor authentication (MFA). MFA adds an extra layer of security by requiring users to provide two or more verification factors. By implementing MFA for all remote access, choosing the right MFA solution, educating the workforce, monitoring and auditing MFA usage, integrating MFA with existing security tools, and considering context-aware MFA, organizations can significantly enhance their security posture. MFA helps mitigate risks associated with compromised passwords and unauthorized access, ensuring the security of remote workers and company resources.

MFA is a great mitigation , however type of MFA is also important. For example it is possible to sniff code send over the SMS , if the attacker is within the area and with certain skill or using certain tools remotely. However, using trusted MFA applications are recommended.

La autenticación multifactor se ha convertido en uno de los elementos esenciales al brindar acceso a los activos digitales críticos de las organizaciones, su utilización ya no se debe considerar solo como una mera recomendación, sino como una configuración mínima requerida.

Securing a remote workforce hinges on the proactive updating of software and devices. By regularly installing updates, organizations can patch vulnerabilities, bolster security features, ensure compatibility, safeguard against malware, enhance performance, maintain compliance, and reduce security risks. This practice is fundamental for protecting remote workers and fortifying the organization's overall security posture in an evolving threat landscape.

La actualización de software y dispositivos es una de las causas por la que los adversarios siguen "ganando la batalla", identificar los activos y verificar que cuenten con las últimas actualizaciones es una tarea que requiere ser gestionada con mayor atención, para obtener una postura adecuada de seguridad en las organizaciones.

Ensuring password hygiene is critical for securing a remote workforce. Organizations should encourage the use of strong, unique passwords, implement multi-factor authentication (MFA), regularly update passwords, use password managers, educate employees, enforce password policies, monitor password usage, enable account lockout policies, and conduct regular security audits. By promoting password hygiene, organizations can significantly enhance their security posture and protect their remote workforce against cyber threats.

Maintaining robust password hygiene stands as an essential responsibility for every individual in ensuring information security. Using strong and unique passwords is like building a strong fortress for your data, making it hard for unauthorized users to get in. Longer and more complex passwords add an extra layer of defense, making it tough for attackers to brute force. Following these steps helps make the digital world safer for everyone.

Es muy posible que las contraseñas en el mediano plazo desaparezcan, hasta que eso suceda, las organizaciones tienen la necesidad de gestionarlas de manera adecuada, incluyendo en esta gestión a aquellas que brindan acceso a servicios principales del negocio y aquellas que cuentan con privilegios elevados.

En un entorno donde las amenazas cibernéticas son cada vez más sofisticadas y frecuentes, la formación constante se convierte en un escudo invaluable para cualquier organización. Desarrollar e implementar un Plan de Concientización y Capacitación de Ciberseguridad que considere los riesgos relacionados con el trabajo remoto es una buena práctica de seguridad que permite a los empleados mantenerse actualizados sobre las amenazas existentes y mitigar riesgos de ciberseguridad asociados. Es importante que las capacitaciones sean interactivas y que se realicen ejercicios que permitan mantener en alerta a los empleados ante ataques como phishing y pharming, entre otros.

Todos los colaboradores de una compañía somos los guardianes de la seguridad de la información y datos que se manejan internamente, por ello, es importante que las empresas capaciten a sus colaboradores sobre el uso responsable de los datos, aplicaciones y cualquier dispositivo que pueda poner en riesgo la seguridad de la compañía y, por consiguiente su reputación. Debemos poner a disposición capacitaciones específicas sobre los ciberataques.

The most critical asset for any organization is its people, and they can also be the most vulnerable. It is crucial to raise awareness and understand the threats and their potential impact. Following best security practices can not only protect individuals but also help the team and organization reduce the likelihood of potential attacks.

Securing a remote workforce requires educating both yourself and your team on best security practices. This includes raising awareness about phishing attacks, emphasizing the importance of strong passwords and multi-factor authentication, educating on device security measures, promoting data protection practices, encouraging the use of secure communication tools, stressing the importance of regular software updates, familiarizing team members with security policies, providing regular training sessions and resources, and creating a culture where reporting security incidents is encouraged. By prioritizing education, you can help protect your organization from cyber threats and ensure that your remote workforce remains secure.

El talento humano es el artífice y un actor importante en la consecución de los objetivos de seguridad de la información en las organizaciones; la formación, entrenamiento y fortalecimiento de sus competencias son aspectos que se deben considerar al momento de planificar los planes y programas de capacitación, los cuales deben estar diseñados de tal manera que los contenidos se distribuyan e impartan de acuerdo al rol que cumplen en la organización.

...And for protection against zero-day attacks where detection cannot help, deploy Web Isolation to 1) create an airgap so web-borne threats don't even get to the endpoint 2) airgap your apps from compromised unmanaged devices

Zero Trust enables employees to work securely from any location, using any device. Minimized Risk: By continuously monitoring user identity, device health, network context, and data access, Zero Trust minimizes risk. It prevents attacks, detects threats faster, and allows proactive action The CISA model provides a roadmap for agencies to embrace Zero Trust. It’s built on five key pillars: Identity: Verify user identities rigorously. Devices: Assess device health. Networks: Shift from location-centric to data-centric security. Applications and Workloads: Zero Trust extends to applications. Data: Protect sensitive data. Implement phishing-resistant multi-factor authentication (MFA) for critical access.

Feel this should be under "What else to consider". Implement an MDM with MTD for mobile devices Don't forget about those pesky mobile devices and tablets! The proliferation of the "mobile" endpoints continues to gain momentum as the MOST commonly used endpoint today. Considering most employees are allowed access to their corporate email and various cloud services from their mobile device, the ability to implement strong security controls on mobile devices should becomes a component of your remote worker strategy. And with more companies embracing BYOD, it is relevant to deploy MTD technologies to prevent device, network, applications or phishing anomalies with on-board remediation.

In addition to the suggestions mentioned earlier, I would add: 1. Endpoint Security: Deploy endpoint which include anti-malware, and endpoint detection and response (EDR). 2. Remote Access Policy: Develop and enforce remote access policies that define acceptable use guidelines, access control, clean desk and security requirements. 3. Remote Monitoring: Implement monitoring of things like your Office 365 SharePoint environment for suspicious behavior and anomalous activities. 4. Assessments: Conduct regular penetration testing to include some of your remote user's home networks. By implementing these organizations can boost the security of their remote users and better protect company assets.