Home About Contribute Sponsorship Contact Sign In


Technology Industry News

Five steps to mitigate the risks of employees returning to work

In this article, Scott Dodds, CEO at www.ultima.com shares five key steps that organisations should follow before welcoming employees back into the office en masse to avoid IT security risks.

Five steps to mitigate the risks of employees returning to work

"When a homeworker returns to the office with a dormant infection on their machine, it's no longer a problem solely for the individual, its a risk to the entire operation."
Scott Dodds, CEO, Ultima

Finally reaching the end of lockdown brings a new call for people to return to the office part-time or full-time. While this might be an exciting development for many, businesses need to be aware of the IT risks the office return poses.


1.    Understanding the threat landscape


We see the highest incident of threat risks from malware like Emotet, Trickbot, Zbot and GuLoader, whereby attackers infiltrate and secure remote access to machines. Hackers are becoming increasingly clever at fooling employees and are prepared to dwell for a lot longer on the machine to wait for the right moment to attack.


While these are not new types of threat, we see that the hackers are using more advanced and persistent tactics to work out how to gain more information on how the machine is being used. They aim to gain domain admin access and ransomware a whole corporate network, as it is, unfortunately, a proven and lucrative avenue.


The main risk for corporations right now is that when a homeworker returns to the office with a dormant infection on their machine, it's no longer a problem solely for the individual. This infection can spread laterally across the whole corporate network like wildfire creating a cyber disaster capable of causing significant reputational and operational damage.


We've seen these sorts of methods commonly delivered to endpoints, which makes endpoint security critical. The traditional way that many companies defend their network perimeter is no longer fit for purpose, but what can be done in both the short and long term to mitigate these risks?


2.    Providing the proper education and training for employees


In the short term, it's essential to focus on staff training as employees are an organisation's main point of weakness when it comes to cybersecurity. Every employee must understand the role that they play in protecting the company perimeter.


Let's look at why home worker's systems are vulnerable. During lockdown, employees have been swapping between corporate and home devices, using USB media, sharing corporate devices with other family members, accessing their own IoT devices, and all across a flat network. This is a problem because flat networks don't have the same level of protection as corporate networks. The likelihood is that this flat network will not have such a stringent patching cycle as a corporate network.


It also won't have the same level of security protection that a corporate environment would have. For example, often the level of protection on a corporate device outside of the corporate network lacks the next generation detection and prevention technologies used to combat malicious URLs in email messages or suspicious downloads. Furthermore, if a home user does become infected, they probably can't remediate the situation without the same service desk, and TechOps support they'd have in the office. When employees chop and change between corporate and home devices, it increases risk, making the corporate network vulnerable.


While security education is the first step; it's also important to be mindful that many devices at home will have been shared with other people who may lack any cyber awareness. Therefore, other precautions must be put in place.


3.    Ensuring devices are 'clean' and free from malware on return to the office


Upon returning to the office, scan all computers and endpoint devices brought back onto the corporate network. Examine each device for new apps and programmes added and either validate or remove them before allowing them to connect to the corporate system. 


Remember, it’s not just laptops and smartphones that need scanning for vulnerabilities; USB devices and peripherals such as printers will also require the same scrutiny.


4.    When and how to leverage EDR


Looking ahead, many organisations understand more about the tools that will enable them to operate securely and remain resilient, irrespective of whichever external event may impact them next.


The next generation of Endpoint Detection and Response (EDR) software focuses on tactics, procedures and behaviour-based detection. It has inbuilt machine learning on machines and in the cloud, which is based on signatureless detection - this is necessary to detect and stop most threats we are now seeing. Unfortunately, our research shows more than 60% of companies don't have EDR or next-gen anti-virus on their end devices. Some don't know they need it; for others, they are tied into long licenses with companies that don't offer EDR yet.


As the network of endpoint devices increases, so too does the data that comes from them. Extracting this data can provide a 'God's Eye' view of an organisation's infrastructure. This requires a specific toolset to help make sense of the data and to leverage it effectively. To summarise, an EDR platform can take in extensive event logs, providing the visibility and data to defend an organisation's estate efficiently.


5.    Ensuring patches are up to date


A significant proportion of external breaches are due to unpatched vulnerabilities. An inadequate patching regime can have catastrophic consequences on systems, personally identifiable information, and intellectual property. Just look at the repercussions many companies felt with the recent Microsoft Exchange vulnerabilities. In the attacks observed by Microsoft, the attacker used these vulnerabilities to access on-premises Exchange servers, which enabled access to email accounts and allowed installation of additional malware to facilitate long-term access to victim environments.


Often de-prioritised in favour of more pressing activities, patch management as a discipline plays a crucial role in an organisation's ability to fend off threats while improving stability and functionality. But this can now be automated with a Managed Patch and Compliance Service, allowing an organisation to focus on other business areas. The patch service will provide critical updates to security hotfixes and keep all servers, applications and endpoints patched per a pre-defined schedule and ruleset. Automated reporting also offers real-time visibility, fulfilling even the most rigorous compliance obligations of highly regulated industries.


What are the merits of outsourcing your IT to take advantage of the latest cybersecurity protection?


Many businesses enlist the help of a Managed Service Provider (MSP) but often find that the company provides little value beyond incident alerting. It doesn't adapt quickly enough to the evolving threat landscape.


It's worth finding an MSP with a Managed Detection and Response (MDR) toolset that operates on an outcome-focused approach. This will deliver the actionable insight organisations need to proactively detect current and emerging threats and respond rapidly to incidents. An MDR service supplies the tools needed to detect and respond to threats and the people to deploy, configure and monitor them.


An MSP with an MDR toolset will assess the network environment and leverage the different technologies that fit its specific needs. It will combine multiple tools sets, including Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) tools, providing a bespoke suite of products according to the environment, whether public or hybrid cloud or on-premise. This approach is essential when dealing with a diverse organisational structure where an out-of-the-box solution will not be fit for purpose.


To minimise cybersecurity risk, identifying and responding rapidly to attacks is essential, as is having timely patches in place. Without a detailed awareness of activity inside the organisation's network, it can be impossible to know if systems and data are in danger of being compromised.


Outsourcing to an MSP with MDR and patching solutions is much more cost-effective when bringing together a suite of products that serve various elements. Best practice would be to choose an MSP who understands the market and uses best-in-breed solutions.


Easing the return to work


Many businesses will now be looking back at how they have fared over the past 18 months after responding so quickly to new ways of working. For many, a hybrid approach to work will continue to dominate their working culture, accelerating the demand for the latest endpoint security technology. It's essential to take a zero-trust approach to mitigate the risks of employees returning to the office and put in place the proper training and security provisions to ensure that the corporate network does not become vulnerable to cyberattacks.


Technology Business News - LOS ANGELES 23rd March 2021 - Cloud security innovation leader, Orca Security, has today announced a successful 210 million Series C funding round.

Orca Security announce $210m Series C round led by CapitalG and Redpoint Ventures

Technology Business News - As the finance industry increasingly adopts digital onboarding technologies, they are utilizing and storing more of our biometric data and personal identification information.

Regulation needed to ensure Finance Industry use compliant Digital Identity technologies

Technology Business News - If you don t work in the Finance industry, you naturally aren t too concerned with financial services industry regulations. Yet some regulations don t just affect the people who work in the finance industry they affect everyone.

Global Finance Industry faces further regulation after pandemic exposes weaknesses

Technology Business News - Global healthcare leader Abbott have announced the release of their first Virtual Reality training program, powered by Oculus Go , aiming to fundamentally change how cardiologists are trained in using Optical Coherence Tomography OCT imaging technology.

Abbott launches flagship Imaging Technology VR Training Program for Cardiologists

Technology Business News - Next year will be the 40th anniversary of the launch of MTV. Launched in August 1981, MTV aptly chose Video Killed The Radio Star by The Buggles as their first featured music video. Video never did kill the radio star, online radio stations and music streaming services have never been more popular.

YouTube creator brings electronic music to life with visionary video productions

Technology Business News - Organizations invest heavily in security and compliance. They secure and monitor emails, networks and devices to help protect their data, employees and reputation.

Theta Lake's rapid rise to prominence from the need to protect the collaborative workplace

Ten Times Ten

Analytics, Modelling & Business Intelligence Specialists