remote working Archives - Cyber Secure Forum | Forum Events Ltd
Posts Tagged :

remote working

Making the right hybrid choice when it comes to UC

 960 640 Guest Post
By:
0
0

As hybrid working strategies mature, companies are fast discovering that choice is vital. Employers need to offer a flexible approach to balance diverse home and office working preferences. But they must also provide a choice of technology options, especially in key unified communication (UC) tools. Consolidating onto a single UC platform may appear to be the best solution, but limiting every employee to a single solution can constrain productivity, undermine morale and encourage the use of Shadow IT, explains Jason Barker, SVP EMEA & APAC, IR.

Hybrid Flexibility

There is no one-size-fits-all approach to hybrid working. For every middle-aged parent revelling in the chance to do the school run, rather than sitting on a crowded train, there is a Gen Z desperate for the interaction – and warmth – of an office environment, rather than being stuck in a spartan shared flat. For every business leader bemoaning the lack of productivity, there is another embracing the impact on recruitment and ability to attract potential new talent.

Rigid hybrid strategies will never meet the needs of a diverse workforce, but a flexible attitude must extend beyond HR policies and include the UC tools used by employees. Wherever they choose to work, it is vital that employees are able to make meaningful connections, both with colleagues and business partners. They need to be confident in their ability to use a variety of tools, from video conferencing to collaboration.  But are they?

Over the past two years, IT teams have accelerated strategic UC deployments in a bid to wrestle back control over corporate infrastructure. A prime objective is to put an end to the costly and high-risk Shadow IT adopted in the early days of enforced WFH, when individuals made their own choice of video conferencing, file sharing and messaging solutions. Yet many of these ‘emergency’ solutions are an employee’s WFH comfort blanket. People have adapted to their preferred tools and, where possible, adapted the tools to work for them. Attempts to close down the UC environment and restrict users to the corporate platform can backfire spectacularly. The problem is that most businesses have absolutely no idea.

Trusted Communications

Today, 85% of businesses are using two or more meeting platforms and many companies are looking to reduce costs by consolidating onto one platform. Yet how can an IT team make the right decision when the business is completely blind to the reality of UC usage and adoption? While UC performance is routinely monitored, the information is collected on a system-by-system basis. There is no visibility of the entire operation, no understanding of the way 10,000s of employees are using the systems. Businesses don’t know when individuals or teams are ignoring the corporate UC tools and opting instead for their own preferred solutions.

Even this piecemeal UC information is fundamentally limited by covering only the office environments. Companies are not monitoring the tools individuals are using at home or their preferred out-of-office locations. From coffee shops to local hubs, employees are opting to use their favourite Shadow IT solutions and side-lining the corporate standards. The result is not only an unseen and unquantified operational security risk but also a missed opportunity to understand how employees are adapting to hybrid working and any signs of a lack of engagement with the business.

Guiding Strategies

End to end monitoring of the entire UC environment, including home working, can provide the business with invaluable insight to support the evolution of hybrid strategies. Are individuals increasing their use of a certain platform? If so, is that because people prefer that solution or simply due to performance problems with the alternative? Companies cannot blithely assume that growing usage equals preference; the IT team needs to also understand if there are any issues with the solution, the network, even frustration due to the lack of personalisation options.  Is there perhaps a change to mandate a single tool if staff can personalise it to suit the way they want to work?

Hybrid working will only succeed if staff are committed, engaged and able to collaborate effectively, wherever they are located. And that is far from inevitable if IT attempts to impose a solution that simply doesn’t work as well as their Shadow IT alternative. Clearly it is essential that everyone uses the UC solutions that are purchased, implemented and run by the corporate IT team – and that the infrastructure is secure, compliant and well managed. Choice is key. To offer employees the right choice, it is essential to understand how UC platforms are working at home and in the office, for both individuals and the business.

WEBINAR REWIND: The next generation of secure digital communications – Why now and why it matters

 960 640 Stuart O'Brien
By:
0
0

Don’t worry if you missed December’s fantastic Zivver webinar ‘The next generation of secure digital communications – Why now and why it matters‘ – You can now watch the entire session again online!

Regulatory reforms, digital transformation, hybrid working… The business landscape continues to evolve and the need for secure and compliant digital communications solutions is higher than ever. The current state of communications security cannot keep pace.

By watching the webinar you’ll get practical insights from Zivver’s panel of industry leaders, security experts and end-users as they discuss the impact and value of a new generation of digital communications security. There’s discussion around how new solutions can empower secure work with maximum effectiveness and minimal disruption, as well as:

  • The evolution of 3rd generation secure digital communications: Why now and why it matters
  • Creating an empowering ‘secure-first’ lifestyle: How to enable employees to succeed through smart technology, while alleviating pressure and reducing the need for training

The panel also investigates Zivver’s perspective on this and how it is shaping our innovation today and in the future.

Panel participants include:

  • Stephen Khan: Global Head of Tech & Cyber Security Risk (former security exec HSBC)
  • Vinood Mangroelal: Executive Vice President, KPN Health
  • Brenno de Winter: Chief Security and Privacy Operations, Ministry of Health, Welfare and Sport Netherlands
  • Sarah Judge: Digital operational lead & CCIO, West Suffolk NHS Foundation Trust
  • Wouter Klinkhamer: CEO and Co-founder, Zivver
  • Robert Fleming: CMO, Zivver
  • Kelly Hall: VP, Corporate Communications & Campaigns, Zivver

What you’ll take away

Find out how your organization can embed security into everyday workflows to empower effective working, and gain actionable insights on how to enable people to secure their digital communications with minimal disruption.

Watch Again Now

WEBINAR: The next generation of secure digital communications – Why now and why it matters

 960 640 Guest Post
By:
0
0

By Zivver

Regulatory reforms, digital transformation, hybrid working… The business landscape continues to evolve and the need for secure and compliant digital communications solutions is higher than ever. The current state of communications security cannot keep pace.

Join our webinar to get practical insights from our panel of industry leaders, security experts and end-users as they discuss the impact and value of a new generation of digital communications security. We’ll discuss how new solutions can empower secure work with maximum effectiveness and minimal disruption, as well as:

  • The evolution of 3rd generation secure digital communications: Why now and why it matters
  • Creating an empowering ‘secure-first’ lifestyle: How to enable employees to succeed through smart technology, while alleviating pressure and reducing the need for training

We will also investigate Zivver’s perspective on this and how it is shaping our innovation today and in the future.

What you’ll take away

Find out how your organization can embed security into everyday workflows to empower effective working, and gain actionable insights on how to enable people to secure their digital communications with minimal disruption.

When? Thursday 9th December, 10am GMT / 11am CET

Register here: https://bit.ly/3o3U7nM

How can businesses maintain IT security in a hybrid working model?

 960 640 Guest Post
By:
0
0

By Claire Price of QMS International, one of the UK’s leading ISO certification bodies

Businesses now have the green light to go back to work, but your organisation may not be returning to its old working practices. So, if a hybrid model is being adopted, what can you do to ensure that information stays secure?

The introduction of more widespread homeworking has certainly piled on the pressure for businesses’ IT security.

At the beginning of 2021, QMS International carried out a survey of businesses about their cyber security and 75.7% of the respondents reported that they now felt more open to attack. Another 10% reported that they had no confidence in fending one off.

And businesses have a right to be worried. According to analysis of reports made to the UK’s Information Commissioners Office (ICO) by CybSafe, the number of ransomware incidents in the first half of 2021 doubled compared to the number reported in the first half of 2020.

Malicious emails have also been redirected to attack those working from home. Data supplied by Darktrace to The Guardian revealed that the proportion of attacks targeting home workers rose from 12% of malicious email traffic before the first lockdown in March 2020 to more than 60% six weeks later. With homeworking becoming more of a permanent fixture in business models, this trend is likely to continue.

While hybrid working offers your team the best of both worlds when it comes to office and home working, it also leaves your business open to the unique risks associated with both, with the added bonus of those linked to transport and travel.

But this doesn’t mean you have to abandon this new way of working. With the right processes in place, you can ensure your information stays secure, no matter where your staff are based.

Carry out a risk assessment

First things first – you must carry out a risk assessment.

Knowing the precise risks your business faces is key to developing methods of removing or mitigating them, but assessments like this are often overlooked. In fact, QMS’ cyber report found that 30% of respondents admitted that no new information security risk assessments had been carried out, despite changes to working practices.

Discover the risks, analyse their likelihood, and then decide if and how they can be controlled. This will give you the grounding you need to build your wider hybrid IT strategy.

Train and test your team

With cyber-attacks on the rise and remote workers being more vulnerable, it’s crucial that your hybrid team know what to look for and, just as crucially, how to report anything suspicious. The best way to do this is through training, which can now be carried out very effectively via e-learning.

This training should cover common cyber-attacks – such as phishing emails – how to spot them, the fundamentals of social engineering, and how to report suspicious activity. Ideally, this training should be refreshed regularly as new cyber threats emerge. You may also like to include training on the safe use of video calls and how to ensure video cameras are switched off when not in use.

To ensure your team have absorbed what they’ve learnt, carry out penetration testing. This involves crafting fake phishing emails and sending them out to your employees. What they do will give you an idea of whether your training has been effective.

Address access

When your hybrid team aren’t in the workplace, they will need to access servers and files remotely. This will often be via a VPN (Virtual Private Network), so you need to ensure that this is as secure as possible.

Remote workers will also be relying on their home Wi-Fi, but this may not be as secure as the Wi-Fi in your office. Your team should therefore be encouraged to create strong passwords – not the default ones on the base of the router.

Workers need to be cautioned against the use of free Wi-Fi hotspots too. It’s possible that your workers may want to use it to work on the train, for example, or in a coffee shop. However, public Wi-Fi is notoriously unsecure, and your workers should be cautioned against using it.

Think about physical protection

If your workers are going to be travelling between locations, then they are going to have to carry equipment such as laptops, phones and removable media with them. If something is lost or stolen, your business information could be compromised. Indeed, IBM’s Cost of a Data Breach report revealed that around 10% of malicious breaches are due to a physical security compromise.

A solid back-up protocol is key to ensuring that any lost information can be recovered. A robust password and access process are also musts – you may want to think about two-factor authentication to make logging in more secure. Make sure you also have a protocol in place so that if your team do report something as lost or stolen, you can act quickly.

When working remotely, you need to ensure that your staff keep their physical devices safe too. Equipment should be kept out of sight when not in use and papers stored away. If your workers are printing content, you may also need a safe disposal or destruction policy in place.

To prevent prying eyes seeing something they shouldn’t, workers should lock their screens when away from their workspace, whether they’re in the office or at home. And if any of your team do want to work while in public, they should be cautioned about the kind of work they perform – who knows who’s sitting next to you?

Create a culture of security

If you really want to take information security to the next level, you may want to consider a more wide-reaching measure such as ISO 27001.

ISO 27001 is the international Standard for information security management, and it is designed to help organisations integrate information security into every aspect of business.

Its 114 controls tackle every angle of security, including physical, legal, digital and human, bringing them together to enable you to maintain compliance and showcase to employees, customers and stakeholders that you have the processes in place to protect information from theft and corruption.

Going forward, it could give you the framework you need to adapt your practices to suit your new hybrid working model and any changes in the future.

How insider threats and the dark web increase remote work risks for organizations

 960 640 Guest Post
By:
0
11

By Veriato

The “Dark Web” is often portrayed as a gloomy realm of internet land where you can find criminals and offenders lurking around every corner. Though there is some truth to this perception, there are also many misconceptions about the Dark Web and its role in the security or insecurity of businesses. Furthermore, the continuous embracement of remote work has led to an unexpected shift in the way the dark web is being used today. Without awareness and understanding of these concepts, it’s impossible to prepare for the looming threats that this obscure area of the net introduces to enterprises.

Level setting on the current remote work landscape

The global pandemic has changed the way organizations and businesses once operated. The rapid shift to remote work brought on tons of security challenges for all types of businesses. Due to the overwhelming increase in remote work, many organizations were not equipped with the right tools and security measures leaving them entirely helpless and at the mercy of the threat actors.

According to a survey conducted by Owl Labs, when the Covid-19 pandemic was at its peak, more than 70% of employees were working from home. Another survey by OpenVPN found that 90% of remote workers were not secure. As per keeper.io “Cybersecurity in the Remote Work era Global risk report”, organizational security postures saw a drastic decline during the pandemic due to remote work.

The most common cybersecurity risks associated with remote work environments include but are not limited to malware & phishing attacks, Virtual Private Networks (VPN) attacks, Insider Threats, shadow IT device threats, home Wi-Fi security, lack of visibility, accidental data exposure, and more.

The sudden rise in remote work since 2020 has overwhelmed the IT teams responsible for cybersecurity. Now, in addition to regular technical infrastructure support for the organization, they also need to support remote work-related issues. The rise of remote work coupled with overwhelmed IT teams increases the human error factor.  Adversaries leverage such situations to exploit vulnerabilities at large.

Scott Ikeda quotes in the CPO Magazine, “71% of organizations are very concerned about remote workers being the cause of a data breach, and unsurprisingly the biggest concerns are the state of their personal devices and their physical security practices. A whopping 42% of organizations are reporting that they simply do not know how to defend against cyber-attacks that are aimed at remote workers. 31% say they are not requiring remote workers to use authentication methods, and only 35% require multi-factor authentication.”

Level setting on the current Insider Threat landscape

An Insider Threat is a security risk that originates from within the organization. It includes employees, third-party contractors, former employees, and consultants who have access to the company’s resources, network infrastructure, and IT practices. An insider threat is capable of compromising an organization’s confidential data, information systems, networks, critical assets by using different attack vectors.

The intent of an insider threat is not always malicious. In fact, insider threat incidents are more likely to happen due to the carelessness of employees. According to a Forrester research report, in 2021, 33% of cybersecurity incidents will happen due to insider threats. In addition, according to the 2020 Cost of Insider Threat report by the Ponemon Institute, 62% of the incidents are due to negligent insiders, 23% due to criminal insiders, and 14% due to credential insiders. Similarly, the cost incurred by an organization due to a negligent insider is 4.58 million, more than other insiders on the category list. The world has seen a 47% increase in cybersecurity incidents caused by the insider threat.

Example insider cybersecurity incidents

Some notable cybersecurity incidents which were caused due to insider threats:

  1. Gregory Chung, a former Chinese-born engineer at Boeing was charged with economic espionage. He used his security clearance to smuggle Boeing trade secrets to China. He was sentenced to 15 years of imprisonment.
  2. Twitter faced an insider attack in 2020, where attackers used social engineering and spear-phishing attacks to compromise high-profile Twitter accounts. Scammers used their profile to promote bitcoin scams. Twitter’s forensic investigations revealed one of their admin team member accounts was compromised exposing access to admin account tools. The adversaries were able to use spear-phishing techniques to get hold of the account, which later used tactics that enabled them to take over high profile users’ accounts such as those of Bill Gates, Barack Obama, etc. and run the bitcoin scam.

Level setting on the current state of the dark web

In simple terms, the dark web is a part of the internet that is not indexed by search engines. The dark web also cannot be accessed by a normal browser. It requires the use of a special browser, for example, the Tor browser (The Onion Router).

Using the dark web, users can get access to information that is not publicly available on the surface web – the part of the internet that is used by people daily. This provides users with anonymity and privacy as it’s difficult to trace someone’s digital footprint once they are on the dark web.

Image Source: Neteffect

Though the Dark Web provides extreme privacy and protection against surveillance from various governments, it is also known as the cyber “black market”. Sophisticated criminals and malicious threat actors use this marketplace to traffic illicit drugs, child pornography, counterfeit bills, stolen credit card numbers, weapons, stolen Netflix subscriptions, and even an organization’s sensitive/critical data. People can also hire a hitman for assassination or recruit skilled hackers to hack systems or networks. The bottom line is that it can get pretty dark in there, hence the name.

Image Source: Techjury

According to a survey conducted by Precise Security, in 2019, more than 30% of North Americans used the dark web regularly. 

Where remote workers exist, insider threats and the dark web intersect

Growing insider threat trends in the remote era reveal the high-risk organizations now face. The dark web has played a crucial part in this evolution both in providing attackers with access to recruit insiders, as well as, empowering them to run lucrative garage sales with stolen data. 

External attackers breach companies and sell data on the dark web, commit fraud, and more

It’s not uncommon to learn of an organization’s critical data which includes confidential data, financial data, and trade secrets being sold on the dark web marketplace. During the global pandemic, adversaries have exploited vulnerabilities in remote working environments by using techniques such as phishing, clickjacking, ransomware attacks, malware/virus injections, social engineering attacks, and more to gain access to this data for sale. They also use this data for organizational identify theft and fraud.

Malicious insiders auction off data on the dark web

Poor working culture and employee morale in organizations may lead a disgruntled employee to sell company data or even hire a skilled hacker to break into the company’s private network and cause severe disruptions. 

Malicious actors are hiring your employees through the dark web

Attackers need a way into your organization. What better way to do that than to make a friend on the inside? Cybercriminals have turned to the dark web to recruit employees within organizations they are targeting. Conversely, malicious employees are offering to sell out their employers to attackers on the dark web as well.

Curious, non-malicious insiders expose organizations to dark web vulnerabilities 

Many people also use the dark web for anonymity and privacy and do not know the potential negative implications of doing so carelessly. While connected to the enterprise network remotely they might access the dark web and unwillingly expose the organization’s sensitive data. 

Remote workers may use their home network Wi-Fi to connect the company’s internal network via a VPN. A remote worker may visit malicious websites or download shady tools and software that can lead to severe data breaches. The malicious site or tools may contain links to a command and control center or even a dark web community forum from which a threat actor could pivot into the corporate network via the remote worker’s laptop. Once pivoted into the corporate network the adversary can launch all sorts of attacks such as ransomware, Denial of Service (DDoS), phishing attacks, and more. When employee activity is not monitored over remote work environments it becomes very difficult for organizations to take control over what they can’t see. 

Bringing light to the dark web in the remote world through advanced insider threat detection 

Artificial Intelligence plays a critical role in combatting insider threats, and thus dark web risks

The risks and threats associated with insiders are difficult to detect as they tend to have legitimate access to many important resources of the organization, and this risk increases when employees work remotely. The remote work environments and practices have increased the attack surface and level of opportunity available to cybercriminals. It is now increasingly difficult for organizations to keep pace with the sheer volume of threats, and the corresponding resources required to manually detect and respond to those threats. Threat mitigation techniques using artificial intelligence (AI) and automation have become very necessary to effectively monitor, detect, control, and mitigate insider threats. 

David Mytton, CTO Seedcamp nicely summarizes the situation as follows:

“The volume of data being generated is perhaps the largest challenge in cybersecurity. As more and more systems become instrumented — who has logged in and when what was downloaded and when what was accessed and when — the problem shifts from knowing that ‘something has happened to highlight that ‘something unusual has happened.” 

That “something unusual” might be an irregular user or system behavior, or simply false alarms.

AI and automation help in correlating threat responses and mitigation faster than any human being can. With these advancements, organizations are able to process large volumes of data, analyze logs, and perform behavioral analysis, threat detection, and mitigation with little to no human intervention.

The response time of AI is phenomenal as it can learn, act and hack in a more efficient and effective manner than the current penetration and vulnerability assessment tools. As such, AI will play a very important role in cybersecurity threat detection. AI can help data protection solutions to rectify, support, and prevent end-user threats such as data leakage, manage unauthorized access, and more. In addition, AI will continue to make threat detection and response solutions to be more efficient and effective in the near future.

Basic cyber hygiene will continue to be paramount in combatting dark web risks

Organizations need to spread awareness among their employees regarding remote work cybersecurity threats and dark web challenges. To do this, establish security awareness programs. Passwords used to log in or access the corporate networks need to be strong and complex. VPN should be properly configured and should be employed with the latest encryption technologies and protocols. Access controls should be implemented to properly limit unauthorized access to critical resources, especially for remote workers.

Visibility for overall user activity is crucial, especially in remote work environments. Organizations need to see what their employees are up to when they are accessing corporate networks for interacting with enterprise resources, sharing files, uploading or downloading files, accessing the central repository or database, using remote desktop services, and more. Close monitoring of such activities ensures organizations take appropriate steps to minimize insider threats and deploy the required countermeasures to prevent malicious activity in remote work environments.

Next-generation insider threat detection technology provides visibility and monitoring needed to shed light on dark web risks

Next-generation insider threat detection and employee monitoring solutions, like Veriato Cerebral, can be used to track down one of the key sources to dark web issues – insider threats. By integrating user behavioral analytics (UEBA), user activity monitoring (UAM), and data breach response (DBR) into a single solution, the organization’s security teams are empowered to identify and minimize insider threats. Powered by artificial intelligence and machine learning, these solutions create a unique digital fingerprint of every user on different platforms, be it a virtual or a physical endpoint. 

In the remote era, the keywords to addressing dark web risks are visibility and insight. Using next-gen technology, organizations can get the level of insight into user activity that is necessary to understand if and when your employees are engaging in sketchy activity on the dark web such as selling their corporate login credentials and more. 

Examples of the level of visibility that can help includes insight into:

  • Web activity monitoring  
  • Network activity monitoring
  • Email Activity 
  • IM & Chat Activity 
  • File and Document Tracking 
  • Keystroke logging 
  • User status 
  • Geolocation 
  • Anomaly Detection
  • Risk scoring etc.

In addition to insider threat detection solutions, organizations can also leverage remote employee monitoring and employee investigations solutions to secure the organization from rising insider threats in remote work environments.

Conclusion

Risks and threats related to remote work will continue to rise. Adversaries will continue using complex and sophisticated attack and compromise techniques to harm enterprise networks and systems via remote working environments. Veriato’s AI-based, advanced threat mitigation solutions ensure that your remote working environment is fully protected and your visibility over IT operations is also increased. These solutions proactively detect and prevent dark web threats and insider threats to secure your organization and remote work environments.

Cybersecurity is not a one-stop-shop

 960 640 Guest Post
By:
0
3

By Steve Law, CTO, Giacom and Kelvin Murray, Threat Researcher, Webroot

Boris Johnson announced the Government’s roadmap to lift Coronavirus restrictions for both businesses and the general public earlier in February, and since then, this has provided a glimmer of hope for many across the country. However, since the start of the pandemic, the way business is conducted has changed permanently, with many workforces wanting to continue to work remotely as lockdowns and restrictions ease over time.

So, as companies relax and rules are eased, life is expected to return to a form of ‘new normal.’ But, the issues around cybersecurity are here to stay, and the gas pedal must not be eased – especially with the increased risks associated with continued remote working. 

If anything, security should be more reinforced now than ever before to ensure all aspects of a business are secure. But this isn’t the case. Steve Law, CTO, Giacom and Kelvin Murray, Threat Researcher, Webroot, detail the importance of embedding a trilogy security approach into organisations, and this is where a strong CSP/MSP relationship can be invaluable. 

The Risk Grows

Despite lockdown restrictions easing, cybersecurity risks remain and are likely to grow as COVID-19 changes the working landscape. As indoor spaces begin to open in the next few months, employees will want to venture out to new spaces to work, such as coffee shops and internet cafes – but working on open networks and personal devices creates unlocked gateways for cyberattacks to take place. Since this hybrid and remote way of working looks like it’s here to stay, businesses must ensure they have the right infrastructure in place to combat any cyber threats. 

For instance, research by the National Cyber Security Centre shows that there has been a rise in COVID-19 related cyber attacks over the past year, with more than one in four UK hacks being related to the pandemic. This trend is not likely to ease up any time soon either. And, going forward, hackers could take advantage of excited travellers waiting to book their next holiday once the travel ban is lifted, deploying fake travel websites, for example. 

Aside from the bad actors in this wider scenario, part of the problem here is that many IT teams are not making use of a holistic and layered approach to security and data recovery; which can lead to damaging consequences as data is stolen from organisations. Such issues continue to resonate strongly across businesses of all sizes, who will, therefore, turn to their MSPs for a solution. 

The Importance of a Layered Approach 

Cybersecurity is not a one-stop-shop. A full trilogy of solutions is required to ensure maximum effect. This includes a layered combination of DNS networking, secure endpoint connections, and an educated and empowered human workforce. 

The need for DNS security cannot be ignored, especially with the rise of remote workforces, in order to monitor and manage internet access policies, as well as reduce malware. DNS is frequently targeted by

bad actors, and so DNS-layer protection is now increasingly regarded as an essential security control – providing an added layer of protection between a user and the internet by blocking malicious websites and filtering out unwanted material. 

Similarly, endpoint protection solutions prevent file-based malware, detect and block malicious internal and external activity, and respond to security alerts in real-time. Webroot® Business Endpoint Protection, for example, harnesses the power of cloud computing and real-time machine learning to monitor and adapt individual endpoint defences to the unique threats that users face.

However, these innovative tools and solutions cannot be implemented without educating users and embedding a cyber security-aware culture throughout the workforce. Humans are often the weakest link in cybersecurity, with 90% of data breaches occurring due to human error. So, by offering the right training and resources, businesses can help their employees increase their cyber resilience and position themselves strongly on the front line of defence. This combination is crucial to ensure the right digital solutions are in place – as well as increasing workforces’ understanding of the critical role they play in keeping the organisation safe. In turn, these security needs provide various monetisation opportunities for the channel as more businesses require the right blend of technology and education to enable employees to be secure.

The Channel’s Role 

Businesses, particularly SMBs, will look to MSPs to protect their businesses and help them achieve cyber resilience. This creates a unique and valuable opportunity for MSPs to guide customers through their cybersecurity journeys, providing them with the right tools and data protection solutions to get the most out of their employees’ home working environments in the most secure ways. Just as importantly, MSPs need to take responsibility for educating their own teams and clients. This includes delivering additional training modules around online safety through ongoing security awareness training, as well as endpoint protection and anything else that is required to enhance cyber resilience.

Moreover, cyber resilience solutions and packages can be custom-built and personalised to fit the needs of the customer, including endpoint protection, ongoing end-user training, threat intelligence, and backup and recovery. With the right tools in place to grow and automate various services – complemented by technical, organisational and personal support – channel partners will then have the keys to success to develop new revenue streams too.

Conclusion 

Hackers are more innovative than ever before, and in order to combat increasing threats, businesses need to stay one step ahead. Companies must continue to account for the new realities of remote work and distracted workforces, and they must reinforce to employees that cyber resilience isn’t just the job of IT teams – it’s a responsibility that everyone shares. By taking a multi-layered approach to cybersecurity, businesses can develop a holistic view of their defence strategy, accounting for the multitude of vectors by which modern malware and threats are delivered. Within this evolving cybersecurity landscape, it’s essential for SMBs to find an MSP partner that offers a varied portfolio of security offerings and training, as well as the knowledge and support, to keep their business data, workforces and network secure.

WEBINAR: Managing the Compliance & Security Nightmares Caused By A Remote Workforce

 960 640 Guest Post
By:
0
4

Webinar – March 11th, 12pm GMT 

How do companies protect themselves with the right tools to mitigate compliance and security concerns?

There are precautions and best practices that are being employed by many companies, and should be part of the security and compliance infrastructure as companies adapt to the new norm of both people and sensitive data residing in remote locations.

In this Webinar we’ll discuss:

  • Maintaining compliance while employees work remotely
  • Maintaining Compliance when employees go offline
  • Monitoring the activity of employees working from home
  • The increased threat posed by remote employees?

Sign up for our latest Webinar on March 11th at 12pm GMT!

Sign Up Now!

73% of IT execs concerned over remote working security risks

 960 640 Stuart O'Brien
By:
0
0

73% of security and IT executives are concerned about new vulnerabilities and risks introduced by the distributed workforce, highlighting an ‘alarming’ disconnect between confidence in security posture and increased cyberattacks during the global pandemic.

The data from Skybox Research Lab comes after enterprises rapidly shifted to make work from home possible and maintain business productivity. Forced to accelerate digital transformation initiative, this created the perfect storm, the research says.

Skybox Research Lab discovered that 2020 will be a record-breaking year for new vulnerabilities with a 34% increase year-over-year – a leading indicator for the growth of future attacks.

As a result, security teams now have more to protect than ever before. Surveying 295 global executives, the Skybox 2020 “Cybersecurity in the new normal” report found that organizations are overconfident in their security posture, and new strategies are needed to secure a long-term distributed workforce.

Key findings:

  • Deprioritized security tasks increase risk: Over 30% of security executives said software updates and BYOD policies were deprioritized. Further, 42% noted reporting was deprioritized since the onset of the pandemic.
  • Enterprises can’t keep up with the pace: 32% had difficulties validating if network and security configurations undermined security posture. 55% admitted that it was at least moderately difficult for them to validate network and security configurations did not increase risk.
  • Security teams are overconfident in security posture: Only 11% confirmed they could confidently maintain a holistic view of their organizations’ attack surfaces. Shockingly, 93% of security executives were still confident that changes were correctly validated.
  • The distributed workforce is here to stay: 70% of respondents projected that at least one-third of their employees will remain remote 18 months from now.

“Traditional detect-and-respond approaches are no longer enough. A radical new approach is needed – one that is rooted in the development of preventative and prescriptive vulnerability and threat management practices,” said Gidi Cohen, co-founder and CEO, Skybox Security. “To advance change, it is integral that everything, including data and talent, is working towards enriching the security program as a whole.”

To download the full report, visit: https://www.skyboxsecurity.com/security-transformation/

Cyber security habits getting lax during lockdown

 960 640 Stuart O'Brien
By:
0
0

Britons have developed lax cyber security habits, using their work equipment to shop online, check their social media or forgetting to log themselves out of applications once they’ve stopped using them.

That’s according to research from Mimecast, which says businesses should capitalise on the phased return to the office to implement stringent training and improve cybersecurity awareness among their workforce.

The results of the survey, it says, are damning:

  • 63% of Britons use their personal devices to access the corporate network
  • As the lines between their personal and professional lives blur, almost 60% forward personal emails to their professional ones
  • Almost half open attachments from unknown sources (49.4%) or click on links in emails from unknown sources (47.1%)

Mimecast says these bad practices result in more cybersecurity incidents across businesses, with three in four IT leaders witnessing cybersecurity issues once a month or more – more worryingly, 20% of them admit occurrences happen more than once a day. 

Email remains the first source of cybersecurity issues: 42% of IT leaders acknowledge most cybersecurity incidents start with an employee clicking on a malicious link in an email. As hackers become more sophisticated, 30% admit that these emails mimic an internal source, increasing the challenge to identify whether a source is legitimate or not for employees who may not have seen their colleagues since March. 

Cyberhygiene varies widely between divisions

To add to this constant headache for IT leaders, the level of cybersecurity awareness within the organisation varies widely between divisions – with the main culprits for poor cybersecurity hygiene often being the ones who manage the highest volume of emails. 

IT leaders rank risk and compliance as the most trustworthy division when it comes to cybersecurity, closely followed by the finance department. The latter has long been a hacker’s favourite target as one small mistake can provide access to the company’s financial information and result in a dip in revenue. 

While the guarantors of the company’s financial health are among the most vigilant when it comes to cybersecurity, those responsible for its reputation could use a refresher: IT leaders see marketing and communications as the worst offenders when it comes to bad cybersecurity practices, followed by design and HR & training. 

Many organisations had to implement large-scale remote working policies in a hurry to respond to the lockdown. Yet, IT leaders are confident this has helped their workforce to become more mindful of cybersecurity: eight out of ten believe their company will be better prepared to cope with disruption, and that employees within their organisation will have better cyber hygiene moving forward. 

Francis Gaffney, Director of Threat Analysis at Mimecast, said: “The COVID-19 pandemic has had a massive impact on businesses across the country, making it difficult for many to function as they usually would. With offices forced to close overnight, many workforces were working remotely for the first time. This obviously had major implications for cybersecurity, as IT had limited visibility into employee habits. This research is particularly worrying because it shows that UK employees are failing to follow basic cybersecurity best practises, which can have huge repercussions for businesses both financially and from a reputation perspective.  Now is the time to prioritise cyber hygiene awareness training to ensure employees returning to the office will be proficient in keeping the business secure.”

Image by Stefan Coders from Pixabay 

Giving resellers the key to unlocking end user continuity, productivity and flexibility

 960 640 Guest Post
By:
0
0

By Dave Manning, Operations Director, Giacom

Until recently, the transition to working from home was unfolding at a gradual pace for many businesses. Although there is much research to back up the benefits of flexible and remote working, many business leaders remained sceptical, believing that office working remained the setup that would be most productive and beneficial from a cultural perspective. 

But the current crisis delivered an ultimatum for many businesses – cease operations or deploy technology to enable employees to work from home for the foreseeable future. There are, of course, several industries where working from home is not an option, but for the majority, there are ways to simply facilitate it – demonstrated by the fact that more than 39% of adults in employment are now working from home, compared to around 12% last year. 

Many employees are thriving working from home. And the hours they have gained back while working from home are not going to be something they will want to give up easily –  two-thirds (63%) of workers said they are open to full time remote working and never going back to the physical office once the crisis is over. It’s becoming clear that the future will not be a permanent office-based workforce, but will shift to a hybrid model combining both remote and office working, allowing for a larger degree of flexibility. This approach of working fuelled by the pandemic is clearly favoured, as 77% of UK employees believe a mix of office-based and remote working is the best way forward post Covid-19. 

For those companies set up to work from home, it’s clear that if business continuity and productivity are maintained – or even improved – during a crisis, they will long term as well. But companies that aren’t properly set up to support remote working are missing out on significant business value gains. To facilitate hybrid working long term, employees must be equipped not only to survive, but to thrive. So how can resellers support end user organisations in transitioning to this new way of operating in the future?

A cloudy future

The lockdown enforcement saw the need for businesses to adapt to this new way of working almost overnight, resulting in a huge surge of enquiries to resellers to get employees working remotely as quickly as possible. Even with cloud-based solutions gaining popularity over the years, a lot of business infrastructure remain on-premises. Businesses need to be moving to a cloud-based infrastructure where the technology they deploy allows for the flexibility to work remotely and on-premises if required. For IT companies supporting SMBs who want to future-proof their businesses and replace outdated on site servers, the cloud offers a fixed cost server solution to IT companies supporting SMBs, while delivering secure storage and easy provisioning as well as scalability – ensuring a futureproof solution for end users. 

Productivity tools

Collaboration tools have come of age and the race is on to both develop and implement smoother integrated IT communications, video, voice strategies so that business can perform at an even higher level whilst working from home. Similar to the transition from letter writing to email, businesses are realising they can actually get more achieved in the same time with cloud-based tools and people not having to travel miles around the country on public transport, in cars or internationally by plane.

And as virtual collaboration tools develop even further to deliver advanced capabilities, employee productivity will only increase. Resellers will be the crucial advisors to companies in order to facilitate their needs, backed up with support from CSPs to help navigate through the most relevant and valuable cloud solutions for their end users. 

Secure setup

Resellers have undoubtedly already experienced the surge of businesses looking to get staff up and running with remote collaboration tools, such as Microsoft Teams etc.. But in the rush to get everyone online and maintain business continuity, security considerations likely slipped much further down the list. Given the continued increase in frequency and sophistication of cyber attacks, especially those capitalising on the current crisis through phishing scams, ‘Zoom-bombing’ incidents and the like, it’s never been more important to prioritise cyber security. 

This is especially true for those organisations that are new to the concept of remote working. While they may have had a solution in place for keeping the corporate network secure within the physical office, a virtual business requires different tools and techniques. This is where resellers can play a crucial role as key consultants to end-users on how they can keep their data secure and deploy reliable, cloud-based backup solutions to safeguard their sensitive information even further. 

A hybrid and flexible infrastructure

While we are all looking forward to this crisis being over, given the nature of the pandemic it’s unlikely that there will be a hard stop to lockdown. Even with the government now lifting some of the restrictions, we can expect a combination of working from home and office working with social distancing and other measures still in place for some time to come. And research has found that 74% of business leaders intend to shift some employees to remote working permanently. No one knows exactly what that journey will look like, so businesses require the toolkit and technology to enable a hybrid working infrastructure now and into the future. 

Moreover, lockdown measures may be starting to ease gradually, but if the UK is faced with a second wave of the virus, or we experience another crisis in the future, additional lockdown measures may have to be put back in place, as was the case in Singapore that struggled to contain a second wave. Flexibility is therefore crucial to safeguard business continuity and enable organisations to maintain optimum productivity levels even in the midst of another unprecedented event. 

The key will be for resellers to support end users in deploying tools that support this new way of working. From unified communications and collaboration software, to cloud-based backup and security tools that keep the corporate network safe no matter where the user is based, resellers hold the key to unlocking end user organisations’ continuity, productivity and flexibility. 

  • 1
  • 2