The current health crisis, due to the expansion of Covid-19, is responsible for the rise of remote work. The Governments of the affected territories recommend it, and even impose it, and companies are quick to seek a fast solution so that their staff can continue to carry out their work from home.
In a matter of days, teleworking has gone from being a minority practice to becoming the only formula for employees that due to the characteristics of their job can adopt it and keep on working.
If telecommuting was a minority, the adoption of the BYOD (Bring Your Own Device) trend was practically non-existent.
Having to put remote working and BYOD into operation immediately has blown up all workplace safety regulations. The pillars of information security: confidentiality, integrity and availability have been jeopardized.
Are we evaluating all the factors that must be taken into account? Are we sacrificing security for speed of implementation?
Until today we were concerned about the security of users' computers, we installed the latest antivirus, anti trojans, antimalware… We governed the devices, implemented security policies, clearly delimiting the privileges of the users , groups, roles and configuration of services with tools such as Active Directory, LDAP, passwords, Firewall, etc.
These days, many companies have opted for the quickest and easiest solution: employees connect remotely to offices through a Virtual Private Network (VPN), in such a way that from the time of connection, the user is within the company network, and can work as if he was sitting at his workplace.
By allowing this type of connection we are under the false security of a "private network", and many times it is anything but that. A VPN "guarantees" that the information that circulates through it is not accessible by third parties, we are safe from an attack of the type of "the man in the middle", but exposed to many other risks. So we should ask ourselves questions like: Have we failed from the beginning? Have we configured the VPN properly? What can we access from the VPN? To the LAN, to the DMZ? What ports can we use? What network visibility does it provide us? Does it allow us access to shared storage? Does it isolate us from the environment?
And the devices from which we connect, what security guarantees do them provide? In most cases none. The IT team has no control over the user's personal device. It has not been checked or prepared, most likely due to lack of time. And much less the infrastructure that the user uses to make the connection.
In a bad scenario, more common than expected, if the user's device or network is hacked, cybercriminals will have the door fully open to access corporate systems at the time the employee connects. What's more, threats can be easily spread throughout the company network, including servers and from there they can reach the devices and networks of all connected users.
Another aspect that many companies have emphasized in recent years is security of access to information, whether for industrial protection, rights... Especially after the implementation of the Law of Data Protection and Digital Rights Guarantee. How compromised is that security now?
We are seeing that the solution chosen in many cases has been to connect users via remote desktop with their desktops, probably the only solution found. That is, the user, through the VPN, reaches the company network. Through the DMZ we have protected servers, no direct communication from the internet with them, but, without realizing, we can have the enemy at home.
With the expansion of the Coronavirus, the mobility of citizens has been restricted, since they have been forced to limit their social relationships to the members of the family unit. And paradoxically from the IT departments of many organizations we are promoting a GangBang with computer systems. Our data is promiscuously contacting third-party systems without the most basic protection systems.
The steps being taken to provide telecommuting solutions at many companies break all the safety regulations that have been in place to date. An imprudence that is being committed due to the haste with which the need for employees to work remotely has to be covered.
There are solutions that minimize the impact, it is enough to choose an appropriate technology that provides security measures to match the circumstances. Desktop and application virtualization allows to enable secure connections through WAN, in which information does not circulate from one device to another. Users simply visualize the data and work with it, but data are never physically on their computers, which become mere connection clients.
Users do not have to access the LAN, their information simply can be displayed from the DMZ, completely securing the network.
With a solution that includes a broker and a tunneler, it is possible to implement the security policies that best adapt to the requirements of the professional activity of each user group. In the event of a security breach, the threat can be easily isolated and fixed.
The adoption of virtual desktops and applications allows the IT team to have data under the control, supervision, monitoring and security of the company, without taking unnecessary risks.
Have we considered how we can limit a security issue in case it arises in such a distributed solution? Another thing we can do is like the three wise monkeys: we neither see it, nor hear it, nor talk about it.
Author: Félix Casado, CEO of VirtualCable
If you need to implement a telecommuting solution in your organization with the maximum security guarantees, request information about our UDS Enterprise VDI and vApp broker at info@udsenterprise. com