Back to the office – and time to repair ‘band aid’ security strategies

Now is an opportune moment to assess whether your current systems are still up to the job, writes Steve Mansfield-Devine.

The global pandemic upended many aspects of our lives – not least how we work. For most people, their homes became their workplaces, and organisations had to scramble to put in place the technology to support this shift, including making it secure.

Now, however, people are drifting back to work. Does this entail yet another change? And what does that mean for security?

“The way we work has irrevocably changed. Many employers recognise that the workforce can be just as productive out of the office as they are inside,” says Bernard Montel, EMEA technical director and cyber security strategist at Tenable. “Employees want the flexibility to work from anywhere and, according to a recent study conducted by Forrester Consulting, 86% of UK organisations plan to permanently adopt a remote working policy. The challenge is how to do that securely.”

Infrastructure changes
Firms have spent the past couple of years rapidly overhauling their infrastructures. In many cases, this has led to the duplication of systems and services – with attendant costs. And it has opened up weak spots that have been exploited by attackers. Switching back to an office-based model is likely to entail a similar degree of disruption. But it’s not just a technical challenge.

New behaviours
Although IT infrastructures were forever altered by the pandemic, it also affected behaviours. For example, home workers discovered the benefits of online services – everything from shopping to Zoom. It’s unlikely they were unaware of these things before; however, they’ve now become an embedded part of homeworkers’ lives. According to a report by McKinsey, three-quarters of people who used digital services for the first time during the pandemic want to carry on using them when life returns to normal. And that means bringing these new habits into the workplace.

Workers returning to the office are likely to import their own devices and favourite online services back inside your network perimeter, where security teams will be hard-pressed to detect and secure them. It’s the bring your own device (BYOD) phenomenon on a new scale.

That’s if you have a perimeter. While remote working has eroded the strength and relevance of the network boundary, the wide adoption of cloud services has arguably had an even greater effect. This has broadened the threat landscape, introducing new risks that security professionals may not have faced before.

“For security teams, it’s imperative that any vulnerabilities identified in tech are understood – including whether there are active exploits available, what are the potential attack paths and what systems/data could be exposed, with priority remediation of the real versus theoretical risks,” says Montel. “This includes all devices connected to any corporate applications including those owned by employees.”

Hybrid model
It’s unlikely that the post-pandemic workplace will be identical to the one before the crisis. We’re not going back to the old normal. For a significant proportion of enterprises, the future is going to involve some kind of hybrid work model. But this requires yet more changes to an organisation’s infrastructure.

“We’re in the world of hybrid working environments so most of the technology implemented to support a remote workforce is likely to remain for the foreseeable future,” says Montel. “However, given most of these changes were implemented in a tight timeframe, when having to choose between operability and cyber security, many responded with a ‘good enough for now’ solution.

“It’s imperative that security teams address the ‘band-aid’ solutions applied in 2020 with scalable, long-term, strategies as securing the ‘new normal’ has moved from a sprint to a marathon.”

Identity as the new perimeter
This is a good time for organisations to consider new and different approaches to security that they may have put off tackling. It’s an opportunity to audit current systems and determine whether they match your needs.

Zero trust architectures, for example, are largely agnostic about where people are working or what devices they’re using. Such solutions are often built around identity and access management (IAM) solutions in which identity – rather than some arbitrary device or network – becomes the new perimeter. With security solutions linked to people rather than things, you can safely adopt the best working model to suit your business.

“CISOs can look at this permanent change to working practices as an opportunity to create clearly defined data management strategies that are aligned to organisational needs,” says Montel. ”This includes the preparation of road maps and aligning cloud security to these goals. This saves wasted time and assures security is aligned with the business.”

Published: 4 April