Cloud
HQs in the cloud: the case for security as enabler has never been stronger
Our CEO, Eva Chen, predicted recently that the Covid-19 experience will change organisations for good. This is to be largely welcomed.
Save to Folio
Our CEO, Eva Chen, predicted recently that the Covid-19 experience will change organisations for good. This is to be largely welcomed. It will help us “fix antiquated processes” and increase remote working, which is good for staff productivity and work-life balance. One other prediction of Eva’s stuck in our minds: the idea that company headquarters in the future will be “located in the cloud”.
In fact, organisations up and down the UK are already working this way. It is bringing with it new opportunities, as well as a host of challenges, for IT security teams. As these companies struggle to ride out the current crisis, more than at any time we can remember, the function needs to step-up as a true business enabler.
The future starts here
Aside from a few critical sectors and essential staff, most organisations today have ordered their employees to work from home (WFH). It’s a trend that could become permanent in many companies, according to Gartner. However, the surge in remote endpoints also increases the risks of shadow IT.
At the same time, the black hats have been quick to exploit the new normal to take advantage of distracted home workers, unprotected personal devices and computers, and potentially unsecured remote working infrastructure such as VPNs. In our 2020 predictions report, Trend Micro warned that cyber-criminals would increasingly be looking to target home workers as a potential weak link in the corporate security chain. That process now appears to have begun in earnest.
Email has always been the number one threat vector. It accounted for over 91% of all threats detected by Trend Micro last year. Now cyber-criminals are using Covid-19 as an effective lure to trick users into clicking through. That might lead to them handing over corporate log-ins, or unwittingly downloading ransomware, info-stealers, VPN malware and other bad stuff.
Time for action
We’re all in this for the long haul. That means WFH employees must be given the tools, guidance and support they need to work productively but securely. Security teams are also likely to be working remotely, an unfamiliar experience for many, and stretched to the limit to support business demands. But they must strike the right balance between managing the risk of compromise and of staff that can’t do their jobs effectively.
To that end, they must try to:
- Understand how many endpoints there are out there that need protecting, issuing corporate laptops if possible
- Ensure all devices, desktops and laptops connecting to corporate systems are adequately secured. Trend Micro is offering remote workers six months’ free access of our leading consumer product
- Due to the strain on VPNs, it may be necessary to allow split tunnelling, so that VPN connections are freed-up to deliver essential patches out to endpoints
With more employees visiting websites through unsanitised connections, security leaders must draw up policies to mitigate risk as far as possible without impacting productivity. This could include researching and making available:
- Corporate-grade video conferencing
- Enterprise-licensed storage, sharing and collaboration tools
This will hopefully reduce the risk of staff using less secure solutions themselves. Such tools should also be made available to partners for secure collaboration outside the organisation.
Aside from these basics, CISOs will want to enforce 2FA on all accounts, mandatory cloud back-ups, and updated end user training programmes. The latter can be run remotely in short bite-sized lessons, updated to feature real-world examples of the most common Covid phishing tactics in use today.
These are tough times for everyone. But for IT security teams thrust into the spotlight, they represent an opportunity to shine.