Securing the future: Cyber security readiness report
Chapter 3: Securing hybrid work
As organizations continue to support their hybrid workforce, IT and Security are faced with a large and expanding array of threat vectors related to remote work. The Mitre ATT&CK knowledgebase, which tracks tactics and techniques used by attackers, currently lists 72 techniques related to mobile devices alone.
While some organizations have required employees to return to the corporate office, many have adopted a new standard that allows for flexibility in the work environments and some semblance of hybrid work. Unfortunately, cyber attackers are well aware that employees continue to work remotely, and these attackers are increasingly targeting the technologies used to support hybrid work, such as cloud-based apps and virtual private networks (VPNs).
More than half of survey respondents (51%) reported that protecting their hybrid workforce is a key challenge for their security team. It makes sense that many organizations find this work challenging: First of all, security teams are already spending significant time and effort keeping their complicated network environment protected from cyber threats. Supporting hybrid work adds new layers of complexity to manage.
Second, protecting a hybrid workforce introduces some unique security concerns. For example, 47% of respondents reported concerns over cloud vulnerability. Many organizations use cloud-based apps and store data in public cloud environments in part to support anywhere work. Cloud providers might invest heavily in security, but security is a shared responsibility: While cloud providers protect their infrastructure, organizations using cloud services must still protect their data and apps in the cloud by adding on security services.
Cyber attackers can gain access to those cloud-based apps and data through phishing schemes. Web attacks may have supplanted phishing as the most frequent type of attack among our survey’s respondents, but for organizations with hybrid workforces, phishing remains a major problem. If a phishing attack is successful, a cyber criminal can steal an employee’s credentials and then log in to cloud environments or the corporate network.
When employees are working outside of corporate offices, they are also susceptible to attackers trying to intercept their Internet traffic. To address that attack vector, many organizations continue to use VPNs to encrypt traffic between remote users and the corporate networks and cloud environments they are accessing. Though VPNs can be effective and have long been a staple security tool, 44% of survey respondents believed that teams rely too heavily on these encrypted tunnels to protect apps, data, and workers. These teams could benefit from augmenting or replacing their VPNs with more modern solutions.
Organizations supporting hybrid workforces also need to be on guard against actions by employees that inadvertently put company networks and resources at risk. Among survey respondents, 43% reported concern over their organizations’ IT supply chain. If IT and security teams are unable to monitor — and prevent — the use of unauthorized apps or services, employees might be unintentionally opening their companies up to breaches.
Securing a hybrid workforce could be a key driver for rethinking an organization’s security strategy. Adopting a Zero Trust approach would enable CISOs to safeguard any user, accessing any application, on any device, in any location. It could help bolster security without diminishing user experiences or adding excessive complexity to security management.
This article is part of a series on the latest trends and topics impacting today’s technology decision-makers.
Key takeaways
After reading this article you will be able to understand:
Survey results from over 4,000 cyber security professionals
New findings on security incidents, preparedness, and outcomes
Considerations for CISOs to secure the future and achieve better outcomes for their organization