Rise in remote working demands new security approach

For for­mer office-based staff, work­ing all or part of their time from home is ever more clear­ly a per­ma­nent shift. New research shows that more than eight in 10 staff have increased their work from home since the start of the coro­n­avirus pan­dem­ic, and many expect this high lev­el of home work­ing to remain in place.

While many organ­i­sa­tions have ben­e­fit­ed from the increased pro­duc­tiv­i­ty and employ­ee sat­is­fac­tion of remote work­ing, the set­up also presents sig­nif­i­cant new cyber secu­ri­ty threats. As employ­ees mix and match work and per­son­al phones or lap­tops — using non-secure per­son­al devices, includ­ing print­ers, to access cor­po­rate sys­tems — a raft of new secu­ri­ty risks are intro­duced.

Sev­en in 10 office work­ers now use busi­ness devices for per­son­al tasks, increas­ing the risk of mal­ware on sys­tems that access sen­si­tive cor­po­rate data. The research, com­mis­sioned by HP Wolf Secu­ri­ty, shows that a third of employ­ees also share cor­po­rate lap­tops and phones with their fam­i­lies and friends.

Mean­while, some 69% of staff often use their own lap­tops or print­ers to car­ry out work tasks, com­mon­ly access­ing sen­si­tive cus­tomer, oper­a­tional, finan­cial and human resources data, on devices that may be inse­cure or already infect­ed.

Blurred lines

Since the arrival of the pan­dem­ic, the dis­tinc­tion between pro­fes­sion­al and per­son­al lives on an aver­age day has become less clear, accord­ing to more than three quar­ters of the near­ly 8,500 office work­ers sur­veyed. Half describe their work tools as per­son­al devices, which is under­stand­able in flex­i­ble work con­texts but also presents pro­found cor­po­rate risk.

“With employ­ees work­ing remote­ly, the lines between work and per­son­al equip­ment are blurred, and every­day actions, such as open­ing an attach­ment, can have seri­ous con­se­quences,” explains Joan­na Burkey, chief infor­ma­tion secu­ri­ty offi­cer at HP. “With­out all of the pre-pan­dem­ic sources of vis­i­bil­i­ty of devices, includ­ing how they are being used and by whom, IT and secu­ri­ty teams are work­ing with cloud­ed vision.”

All of this presents major prob­lems as sophis­ti­cat­ed mali­cious actors quick­ly adapt to the new envi­ron­ment by exploit­ing gam­ing plat­forms, mim­ic­k­ing pop­u­lar stream­ing ser­vices and email­ing mal­ware-infect­ed files to per­son­al accounts to gain access to home net­works and to slip through cor­po­rate defences.

Busi­ness­es are begin­ning to wit­ness the impacts. “In the past year, more than half of IT deci­sion-mak­ers have seen evi­dence in their com­pa­ny of com­pro­mised per­son­al PCs being used to access com­pa­ny and cus­tomer data. This is a huge risk that could lead to exposed com­pa­ny data, rep­u­ta­tion­al dam­age, non-com­pli­ance and loss of cus­tomer trust,” warns David Prez­zano, UK and Ire­land man­ag­ing direc­tor at HP.

As employ­ees take more risks, a surge in email phish­ing attacks and web brows­er down­load infec­tions means 44% of 1,100 deci­sion-mak­ers inter­viewed have wit­nessed com­pro­mised devices infect­ing their wider busi­ness­es. Research firm Kup­pinger­Cole high­lights a 238% increase in cyber­at­tacks dur­ing the pan­dem­ic, with employ­ees’ con­nect­ed devices con­tribut­ing to a break­down of the tra­di­tion­al cor­po­rate IT infra­struc­ture and net­work. Clear­ly, hack­ers are tak­ing advan­tage of the new set­up.

Outdated security

Typ­i­cal­ly, busi­ness­es are stuck in an old approach to data secu­ri­ty, allow­ing the prob­lem to grow. Their method­ol­o­gy orig­i­nates from an era of tra­di­tion­al net­work perime­ter pro­tec­tion and fire­walls, despite the estab­lish­ment of a dis­persed work­force and cloud com­put­ing. When a breach hap­pens, it often remains com­plete­ly invis­i­ble until after seri­ous harm has occurred.

“The tra­di­tion­al ways of secur­ing access to the cor­po­rate net­work, appli­ca­tions and data are no longer fit for pur­pose, and the con­cept of a perime­ter has become obso­lete,” explains Dr Ian Pratt, glob­al head of secu­ri­ty, HP Per­son­al Sys­tems. “Crit­i­cal data is being host­ed out­side the enter­prise fire­wall. The time has come for organ­i­sa­tions to start tak­ing a proac­tive approach to secu­ri­ty, archi­tect­ing their infra­struc­ture to be resilient to attacks.”

In this envi­ron­ment, heads of IT can­not view the shift to home work­ing as a one-off event and they can­not lock down all devices. The pan­dem­ic has changed the way peo­ple oper­ate and organ­i­sa­tions need to reassess how they man­age the new risks. They must, how­ev­er, do so with­out harm­ing work­force mobil­i­ty or jeop­ar­dis­ing pro­duc­tiv­i­ty.

A new approach

The grow­ing demands on IT infra­struc­ture have increased the focus on end­points, includ­ing mobile phones, tablets, lap­tops and even con­nect­ed print­ers, so that threats can be tack­led soon­er. As organ­i­sa­tions become ‘perime­ter-less’, nine in 10 IT lead­ers say get­ting end­point secu­ri­ty right is now as impor­tant as hav­ing strong net­work secu­ri­ty.

“Users are the point of entry for most attacks and that’s why end­points account for 70% of suc­cess­ful breach­es, with mal­ware almost always being deliv­ered via email attach­ments, web links and down­load­able files,” says Pratt. “Phish­ing is of par­tic­u­lar con­cern, with attack­ers using new tech­niques includ­ing AI-automa­tion and per­son­al­i­sa­tion.”

Evolv­ing secu­ri­ty dan­gers demand more robust defences. Com­pa­nies are increas­ing­ly using HP Wolf Secu­ri­ty, a new breed of end­point secu­ri­ty. The port­fo­lio includes the world’s most secure PCs and print­ers*, hard­ware-enforced end­point secu­ri­ty soft­ware and advanced ser­vices, offer­ing com­pre­hen­sive cyber resilience that intel­li­gent­ly pro­tects against the many emerg­ing end­point threats.

Using HP Wolf Secu­ri­ty, organ­i­sa­tions are tak­ing a ‘zero trust’ approach, mean­ing every device is con­sid­ered a poten­tial threat and can be auto­mat­i­cal­ly pro­tect­ed. They are also tak­ing advan­tage of self-heal­ing firmware, in-mem­o­ry breach detec­tion, threat con­tain­ment via vir­tu­al­i­sa­tion and cloud-based intel­li­gence.

Giv­en that the new world of remote work is here to stay, com­pa­nies can no longer afford to remain focused on tra­di­tion­al net­work perime­ters that miss the dis­persed points where data is accessed. Smart end­point secu­ri­ty enables busi­ness­es to tack­le evolv­ing threats on myr­i­ad dis­persed devices, while reduc­ing oper­a­tional impact and empow­er­ing flex­i­ble pro­duc­tiv­i­ty. Get­ting this right is essen­tial to the future of their oper­a­tions.

To find out more about HP Wolf Secu­ri­ty in the fast-chang­ing remote work­ing world, vis­it
www.hp.com/wolf

Dis­claimer: PCs: Based on HP’s unique and com­pre­hen­sive secu­ri­ty capa­bil­i­ties at no addi­tion­al cost among ven­dors on HP Elite PCs and HP Work­sta­tions with Win­dows and 8th Gen and high­er Intel® proces­sors or AMD Ryzen™ 4000 proces­sors and high­er; HP ProDesk 600 G6 with Intel® 10th Gen and high­er proces­sors; and HP Pro­Book 600 with AMD Ryzen™ 4000 or Intel® 11th Gen proces­sors and high­er.
 
Print­ers: Claim includes HP’s most advanced embed­ded secu­ri­ty fea­tures which are avail­able on HP Enter­prise and HP Man­aged devices with HP FutureS­mart firmware 4.5 or above. The claim is based on HP review of 2019 pub­lished fea­tures of com­pet­i­tive in-class print­ers. Only HP offers a com­bi­na­tion of secu­ri­ty fea­tures to auto­mat­i­cal­ly detect, stop, and recov­er from attacks with a self-heal­ing reboot, in align­ment with NIST SP 800–193 guide­lines for device cyber resilien­cy.

HP Secu­ri­ty is now HP Wolf Secu­ri­ty. Secu­ri­ty fea­tures vary by plat­form.

Pro­mot­ed by HP