Keeping remote workers safe from hackers
By Gigamon
How a Zero Trust environment is the future of flexible work.
Most organisations around the world have gone into business continuity planning (BCP) mode. But there have been instances where organisations have been the subject of malware and ransomware attacks through remote access. According to Gigamon CEO Paul Hooper, by moving employees to their homes, you are creating an opportunity for hackers to carry out attacks.
There are simple steps that agencies can take to secure their data and protect themselves against attacks while working remotely. Zero Trust environments enable companies to build a secure infrastructure that protects employees as they work from home. There are four simple steps that organisations can take to build this Zero Trust infrastructure. GovInsider finds out what they are.
The threat
As the COVID-19 rages on, people have been going online to look for healthcare information - an instinct that hackers have ruthlessly exploited. Their end goal in most cases is to steal credentials, such as usernames and passwords of the people on the network. They can use this to access an entire company network and commit fraud on a vast scale.
Fake COVID-19 maps are being set up to insert malware into people’s devices, notes Shehzad Merchant, Gigamon CTO. “Unsuspecting users who are seeking information on the COVID-19 spread are being enticed to download these maps, resulting in their systems being compromised.”
This is a particularly risky time for organisations. “Bad actors are not about to give up on what they perhaps perceive as a huge opportunity to take advantage of a strained, tested and con-strained InfoSec team and infrastructure,” Merchant says.
They are even hacking agencies that are trying to keep us safe. Bad actors recently attempted to steal passwords from staff members of the World Health Organisation, the BBC reported.
So how can we ensure the safety of our systems?
Merchant tells us that there are four simple steps that companies can follow to protect them-selves during this period. The first is to “map out your assets”. What this means is that organisations can use non intrusive techniques such as network metadata for visibility, along with leveraging host and endpoint-based approaches.
Second, companies need to “discover and understand asset communication flows and pat-terns”. This allows them to monitor the traffic on their networks to ensure visibility on what information is being accessed and by who.
Third, agencies must “implement authentication and access control policies based on your discovery”. This will allow organisations to gain an insight into who has rights to access the network and limit and enact access control policies.
Finally, organisations need to “set up a continuous monitoring strategy”. This will allow them to monitor traffic as well log host and endpoint data.
Another way to secure the network would be to implement authentication before access is granted to the network, especially on non-trusted devices. With most employees on company-issued devices, getting access to the network will be straightforward. But for employees that chose to use devices outside of the network, the recommendation is for them to be isolated and monitored much more closely.
Zero Trust, Zero Threats
These simple steps can make a difference. But as the world of work evolves, governments should move towards a bigger goal. This is known as a Zero Trust architecture.
A Zero Trust framework simply means that no entity within or outside of their IT network is to be trusted, ensuring that all the information is monitored, secured and managed. According to the CTO of Gigamon, the ultimate goal of a Zero Trust network is to allow for a work from home model without the security concerns that come with it.
A Zero Trust environment needs an agency CIO to identify every device that requires access to the network, and their communication patterns. Merchant says that this allows officials to identify and prevent unauthorised parties from gaining access.
Second, the organisation must implement authentication, authorization and access controls to all devices, he adds. This means that no-one can use trusted devices to hack the network.
Third, ensure all data is encrypted regardless of whether it’s being accessed on-site or remotely. By making sure that all data is encrypted, companies can worry less about anyone gaining access to the system as they will have to go through another layer of security to get the information, says Merchant.
And finally, agencies must monitor all the data flows in their organisation to ensure that there are no inconsistencies, he adds. By monitoring all the data that is being accessed by the system, it can allow the organisation to make sure that it is not being tampered with.
Zero Trust means Zero Risk - and maximum flexibility. Many agencies have had to shift into a new world of remote working. If they invest and innovate, they can ensure flexible working is a benefit to employees, and not a major cost - and risk - to their employers.