As a result of the pandemic regulations, home office operations seem to be establishing themselves as a permanent organizational pillar in companies. According to the latest Remote Work Report from Bitglass, for which 287 IT security managers were surveyed in January 2021, 53 percent of companies plan to permanently move certain job positions to the home office.
Apparently, this gives the introduction of cloud technologies a further boost, because a clear majority relies on cloud-based IT ecosystems for home office operations: 71 percent of those surveyed state that their company is switching from on-premises applications and tools to the cloud will. Compliance with legal regulations is a major issue there: With data distributed across corporate networks across SaaS, IaaS, and a variety of remote devices, transparency and the ability to intervene are limited, which is why companies are exposed to greater risks are. For 45 percent of those surveyed, adherence to compliance regulations is also of great relevance.
Effective protection and backup of data are therefore important prerequisites for remote work. In this scenario, the IT security strategy focuses a little differently than in office environments: For example, access control plays a much more important role. In addition, companies must ensure that the security measures chosen do not affect the work processes of the workforce - and thus productivity. The following three priorities can help address the security challenges associated with working from home:
Prevent unnoticed data loss
In remote work scenarios, working with encrypted connections is by no means the exception, but rather the rule. Cyber criminals who have succeeded in stealing data often send it camouflaged over SSL connections. Numerous DLP solutions classify this as trustworthy and do not examine the data in this type of traffic. In view of several dozen or even hundreds of employees working in the home office, this blind spot can develop into a data loss path of great dimensions. A significant part of the sessions, through which data could potentially be lost, is simply not recorded, which can have consequences under data protection law in an emergency.
As a result, organizations need cloud and web security solutions that can inspect every byte outside the network and beyond the reach of legacy technologies. With this approach, you can ensure that the data in the encrypted traffic is safe.
Close the gaps between data protection tools
With the move to the cloud, data is distributed across various SaaS, IaaS, web and on-premises environments. For effective data protection, companies use Cloud Access Security Brokers (CASBs) to secure managed SaaS applications and IaaS platforms. In addition, Cloud Security Posture Management (CSPM) to scan IaaS instances for costly misconfigurations, Secure Web Gateways (SWGs) to secure the web and unmanaged applications (shadow IT), and Zero Trust Network Access (ZTNA) to ensure secure remote access to remaining local resources. Having to manage this multitude of individual solutions can, however, contribute to losing track of the overall situation. Although everything is apparently covered with these specialized solutions, they usually do not mesh seamlessly. Since each of them is designed according to different parameters, there is a possibility that certain events will not get stuck in this grid.
Companies should therefore work towards reducing this complexity and enforcing data protection principles as consistently as possible. A uniform layer of protection, in which a consistent level of security is provided for all interactions across ecosystems, can be achieved by introducing a comprehensive security platform that is integrated into and provided via the cloud. Today's market-leading technologies can monitor data in transit and at rest within IT resources through features such as cloud DLP and ATP. In this way, an overarching, interlocking security level can be created that can be managed via a user interface.
Use scalable security tools
Of those surveyed about remote work, 41 percent said that bandwidth limitations affect the scalability of the security solutions they use. A majority of 55 percent have experienced difficulties using VPN as a result. Behind this is the fact that with many appliance-based security solutions, the data traffic has to be forwarded to a central data center, which can lead to bottlenecks and latency times.
Another disadvantage is that IT departments can only anticipate, identify and solve problems with their security stack to a limited extent. Also, when the majority of the services, solutions, or applications used by employees are outside of the company's control, it becomes more difficult to ensure that employees have a good user experience and maintain normal levels of productivity.
Secure Access Service Edge (SASE) platforms
With Secure Access Service Edge (SASE) platforms, companies in remote work can remove their dependency on physical appliances and eliminate the associated latency times. This cloud-based approach enables them to monitor activity on each device and enforce their principles of network control right through to the endpoints. In this way, they can act in a more agile manner, reduce the complexity in their IT environment and create productive conditions for the workforce.
The pandemic crisis has shown companies how important it is for them to take measures with which they can keep their business operations going under all circumstances, even away from their office environment. In order to achieve the flexibility that such ecosystems demand, there is no way around the cloud in the long term. In order to ensure the necessary data security there, companies must consider the changed priorities in remote work scenarios in their security strategy.
More at Bitglass.com
About Bitglass Bitglass is a global provider of a NextGen CASB solution based in Silicon Valley. The company's cloud security solutions offer agentless zero-day, data and threat protection everywhere, for every application and every device. Bitglass is funded by senior investors and was founded in 2013 by a group of industry veterans who have introduced and implemented numerous innovations in the past.