The COVID-19 pandemic ushered in a rapid change to the way in which many people work. Here are 6 ways to ensure enterprise IT security.
White-collar workers have mostly shifted to working remotely from their own homes. Some enterprises facilitated remote work arrangements before the pandemic, but this mode of working is now the norm.
The rapid shift to remote work brings many new security challenges to enterprise IT departments. The perimeter of the corporate network extends to the devices people use at home to connect to the network and do their work.
6 Steps to Ensure Enterprise IT Security
Here are six tips to make sure that your organization’s IT security defenses remain strong regardless of where your employees work from.
#1. Protect All Endpoints
Having the majority of your workforce working remotely leads to a large increase in the number of endpoint devices on your network. Whether your business opts to give employees company-certified laptops or you allow workers to connect to the network from their own devices, it’s imperative to protect these endpoints.
One option for endpoint protection is to use dedicated enterprise endpoint protection software and have it installed on every endpoint device. Another option is to mandate that employees have up-to-date anti-virus software installed on their devices before they can connect to the corporate network.
This can be overwhelming to IT departments, which is why we have created a service called Managed Detection and Remediation (MDR). MDR from Cybriant will help reduce the time between breach and detection, we can also help stop the threat before it can fully execute. Learn more here: cybriant.com/mdr.
#2. Properly Secure RDP Ports
It’s common for businesses to use remote desktop connections to give employees remote access to the same desktop workstation they would normally use on-premise. Remote workers can access remote desktops using the proprietary Remote Desktop Protocol (RDP). Cybercriminals frequently look for open RDP ports in an attempt to gain brute force access to remote desktops inside corporate networks.
To properly secure RDP ports, make sure that employees use strong passwords of at least 12 characters to connect to remote desktops. Another important step is to enable automatic updates so that any vulnerabilities in the remote access software are fixed as soon as patches become available.
Organizations may consider VPN as an option. Here is a helpful guide on how to be safe using a VPN.
#3. Use Multi-Factor Authentication
Multi-factor authentication adds a layer of protection to your IT security environment on top of a strong password policy. With multi-factor authentication, employees can only gain access to systems if they give two or more pieces of identification while signing in. The most practical use of multi-factor authentication is to require a standard username and password combination in addition to a dynamic one-time passcode that only remains valid for one login session.
We consider this a basic of enterprise security. Download our Remote Workers Guide to receive all the remote working tips from Cybriant’s CTO.
#4. Inform Employees of Security Risks
IT departments commonly regard employees as weak links in the context of evaluating enterprise IT risks. Remote work exposes employees to more IT security threats than usual, and it’s harder for enterprises to mitigate these threats.
A good way to protect employees against security threats while remote working is to promote awareness of the threats they face. Consider distributing an internal memo that identifies the main threats criminals use to gain access to networks, such as phishing and social engineering. You could also ask employees to repeat any IT security awareness training modules that your company offers.
While awareness is important, we prefer to go back to #1 – ensure the protection of endpoints. If you had a team of security experts watching your endpoints 24/7 – you can protect your corporate data no matter what. Learn more about MDR here: cybriant.com/mdr.
#5. Secure Your Video Conferences
Businesses need to maintain face-to-face communication and hold team meetings while people work from home. Video conferencing tools are popular choices for remote work, but this type of software can come with IT security risks.
It’s crucial to make an effort to secure all video conferences held by different teams and departments in your organization. Require passwords to gain access to video calls, and make sure your chosen tool has an alert feature that lets you know when someone new joins the conversation. You should also apply updates to your video conferencing software as soon as they are released.
#6. Protect Your Digital Assets
Your enterprise probably has many assets stored digitally on its network, including marketing materials, website content, illustrations, business plans, and presentations. A significant attack vector for hackers to gain access to valuable digital data is by stealing the credentials of an employee who has privileged access to more assets than they need for their daily work.
A vital measure to protect your digital assets is to enforce the least privilege controls on all user accounts. The principle of least privilege minimizes user access permissions to only the assets they need to perform their daily work.
These decisions are easier made when you have a security framework in place, like NIST-CSF. Learn more about the importance of people, processes, and technology here.
Closing Thoughts
The flexibility to work remotely some of the time was becoming an important part of what white-collar workers expected from enterprises. The COVID-19 pandemic rapidly altered the dynamics of remote work such that it is now the status quo. By following IT security best practices and tips for remote workers, you can ensure your corporate network and valuable assets remain protected in a new threat landscape.
Related: What Hackers Know about Fileless Malware (And You Should Too)