Hybrid working ushers a new approach to data security

Fol­low­ing two years of the pan­dem­ic and organ­i­sa­tions adapt­ing to work from home man­dates, hybrid work­ing is here to stay. The liv­ing and work envi­ron­ment changes we’ve expe­ri­enced over the last two years have induced a per­ma­nent shift in work-life bal­ance. Over that peri­od, enter­pris­es have been forced to adapt to hybrid work pat­terns, and with 85% of desk work­ers cur­rent­ly work­ing from home want­i­ng a mix of both home and office work­ing in the future, busi­ness­es are now seek­ing to meet this demand and embed a per­ma­nent hybrid mod­el.

While hybrid work­ing is undoubt­ed­ly bring­ing great val­ue to organ­i­sa­tions and their employ­ees, cyber­crim­i­nals are exploit­ing this shift in work pat­terns and envi­ron­ments to tar­get end­points more aggres­sive­ly. Since the start of the pan­dem­ic, the vol­ume of cor­po­rate data being accessed from home has risen sub­stan­tial­ly, includ­ing sen­si­tive finan­cial infor­ma­tion. Spot­ting the var­i­ous vul­ner­a­bil­i­ties in a dra­mat­i­cal­ly widened attack sur­face, cyber­crim­i­nals are now tar­get­ing home work­ers through ded­i­cat­ed mal­ware cam­paigns that exploit social engi­neer­ing.

As the lines between work and home have blurred, secu­ri­ty risks have soared and every­day actions such as open­ing an attach­ment can have seri­ous con­se­quences. With­out all of the pre-pan­dem­ic sources of vis­i­bil­i­ty of devices, and how they are being used and by who, IT and secu­ri­ty teams are work­ing with a cloud­ed vision. A study by ana­lyst house Kup­pinger­Cole not­ed a mam­moth 238% increase in glob­al cyber attack vol­ume dur­ing the pan­dem­ic, and ran­somware remains the cybercriminal’s tool of choice to mon­e­tise their access to net­works.

“With a more dis­persed work­force and a rise in the use of soft­ware-as-a-ser­vice (SaaS) appli­ca­tions, crit­i­cal data is being host­ed out­side the enter­prise fire­wall, caus­ing cyber­crim­i­nals to exploit a perime­ter-less organ­i­sa­tion,” says Dave Prez­zano, man­ag­ing direc­tor, UK & Ire­land at HP. “This has exposed the lim­i­ta­tions of the cur­rent end­point secu­ri­ty approach, which is based on assump­tions about trust inher­it­ed from the era of perime­ter secu­ri­ty. Hybrid work­ing has erod­ed the net­work perime­ter of fire­walls, intru­sion detec­tion sys­tems (IDS), web prox­ies and oth­er secu­ri­ty con­trols tra­di­tion­al­ly used to defend net­works and the devices which sit with­in them.

“Hybrid work mod­els can also slow the time it takes to deploy patch­es, caus­ing devices to remain vul­ner­a­ble for longer. And they can lead to poor­er secu­ri­ty vis­i­bil­i­ty because there may be delays in logs being sent to a cen­tral secu­ri­ty infor­ma­tion and event man­age­ment sys­tem. Such a delay can be the dif­fer­ence between respond­ing after an attack­er has com­pro­mised a sin­gle end­point and after they have deployed ran­somware across the entire net­work. Human oper­at­ed ran­somware attacks esca­late from ini­tial access to full net­work com­pro­mise in hours.”

Circumventing behaviour

Employ­ee behav­iour can cre­ate fur­ther chal­lenges in the hybrid work­ing age. Many work­ers are using their work devices for non-work-relat­ed tasks like check­ing per­son­al email, accord­ing to the HP Wolf Secu­ri­ty Blurred Lines and Blindspots report. Yet because per­son­al web­mail ser­vices aren’t pro­tect­ed by cor­po­rate email gate­way scan­ners, they are inad­ver­tent­ly expos­ing work devices to emails con­tain­ing mal­ware that might oth­er­wise be blocked. Email is the top mal­ware deliv­ery vec­tor, with 77% of mal­ware iso­lat­ed by HP Sure Click in Q4 2021 deliv­ered in this way.

Mean­while, HP Wolf Security’s Rebel­lions & Rejec­tions report found 31% of office work­ers aged between 18 to 24 had tried to cir­cum­vent secu­ri­ty mea­sures, which is con­cern­ing for all organ­i­sa­tions. Ulti­mate­ly, if secu­ri­ty poli­cies and mea­sures are too cum­ber­some and block peo­ple from doing what they need to do, employ­ees will try to find ways around them that could put the busi­ness at seri­ous risk. If left unchecked, this kind of fric­tion and risk could esca­late.

Employ­ees are crav­ing user-friend­ly secu­ri­ty tools and eased restric­tions, but cyber­se­cu­ri­ty teams need to find a way to reduce the bur­den of secu­ri­ty and improve vis­i­bil­i­ty into threats. Secu­ri­ty should fit as much as pos­si­ble into exist­ing work­ing pat­terns and flows, util­is­ing seam­less tech­nolo­gies that are secure by design and user intu­itive. This involves seek­ing out new lev­els of end­point pro­tec­tion root­ed in zero trust prin­ci­ples that are as unob­tru­sive as pos­si­ble to avoid end-user cir­cum­ven­tion. Embed­ding non-intru­sive secu­ri­ty tech­nol­o­gy into the end­point will go a long way to improv­ing the user expe­ri­ence while also pro­tect­ing the busi­ness.

“We need to make it as easy to work secure­ly as it is to work inse­cure­ly, and we can do this by build­ing secu­ri­ty into sys­tems from the ground up,” says Prez­zano. “More than ever, there’s a need for resilient end­points that are secure by design and pro­tect them­selves with­out rely­ing on know­ing what is good or bad. Over-bur­dened secu­ri­ty teams and users can’t be relied on to catch every­thing, so enter­pris­es should focus on ground zero for most attacks, which is users and their end­points. The end­point is the inter­sec­tion of flawed humans, unse­cured tech­nol­o­gy and untrust­ed inter­ac­tions that keeps cyber attack­ers com­ing back time and again.”

Zero trust

End­point secu­ri­ty strate­gies must be root­ed in zero trust prin­ci­ples. Access to ser­vices should be con­trolled on a case-by-case basis, after ver­i­fy­ing a set of con­trols that might include the user, the device and its secu­ri­ty pos­ture. This helps to con­tain fail­ure, mean­ing a com­pro­mise of a less impor­tant ser­vice doesn’t nec­es­sar­i­ly lead to a major breach. Zero trust prin­ci­ples should be embed­ded into the end­point, includ­ing device firmware, the oper­at­ing sys­tem and appli­ca­tions.

“Lap­tops, PCs and print­ers that have secu­ri­ty built in rather than bolt­ed on can pro­vide a much more seam­less and less restric­tive end-user expe­ri­ence,” Prez­zano adds. “From here, organ­i­sa­tions can lay­er secu­ri­ty ser­vices on top, such as those that can con­tain and iso­late crit­i­cal threats before they have a chance to do any dam­age. Oth­er tools can offer remote man­age­ment for IT teams and the abil­i­ty to self-mon­i­tor and self-heal with­out user inter­ac­tion.

“HP Wolf Secu­ri­ty can help organ­i­sa­tions defend against the pletho­ra of new attacks and risks fac­ing them. By com­bin­ing hard­ware-enforced soft­ware and secu­ri­ty fea­tures with indus­try-lead­ing end­point secu­ri­ty ser­vices, HP Wolf Secu­ri­ty imple­ments lay­ered secu­ri­ty and enables seam­less inte­gra­tions with the wider secu­ri­ty stack. As such, cus­tomers ben­e­fit from robust, built-in pro­tec­tion from the sil­i­con to the cloud, from the BIOS to the brows­er. Embrac­ing a new archi­tec­tur­al approach to secu­ri­ty that mit­i­gates risk and enables resilience, by apply­ing the prin­ci­ples of zero trust, will allow com­pa­nies to reduce the attack sur­face in the future of work.”

Q&A: Less detection, more prevention

Dr Ian Pratt, glob­al head of secu­ri­ty for per­son­al sys­tems at HP, says data secu­ri­ty is too focused on detec­tion and not enough on pre­ven­tion and iso­la­tion. A bet­ter bal­ance is need­ed

Despite large invest­ments in data secu­ri­ty, why are so many cyber attacks still suc­ceed­ing?

Enter­prise secu­ri­ty sys­tems still focus far too much on detec­tion and not enough on pre­ven­tion and con­tain­ment, leav­ing com­pa­nies exposed. Many enter­pris­es rely on detec­tion con­trols like antivirus soft­ware and end­point detec­tion and response (EDR), but these fail to detect more sophis­ti­cat­ed threats, thus allow­ing attack­ers to gain a foothold inside vic­tims’ net­works.

Instead, organ­i­sa­tions should shift their approach by putting a vir­tu­al fence around risky activ­i­ties so in the event of their com­pro­mise, mal­ware can’t spread or per­sist. Sim­i­lar­ly, the high­est-val­ue activ­i­ties can be iso­lat­ed from oth­ers to pro­vide addi­tion­al lay­ers of secu­ri­ty. To secure the huge amount of data that is being accessed from home, includ­ing sen­si­tive finan­cial infor­ma­tion, archi­tec­tural­ly robust pre­ven­tion and recov­ery are vital.

Why does mea­sur­ing end­point secu­ri­ty by how quick­ly a secu­ri­ty team can detect and respond to a threat no longer make sense?

For a long time now secu­ri­ty oper­a­tion cen­tres (SOCs) have used met­rics like ‘mean time to detect’ and ‘mean time to respond’ to mea­sure their per­for­mance. The the­o­ry is the quick­er the detec­tion and response, the low­er the impact of the com­pro­mise or intru­sion. Hav­ing made the ini­tial com­pro­mise, how­ev­er, attacks can move extreme­ly quick­ly today, using automa­tion to spread across sys­tems in an instant. Seg­ment­ing sys­tems and net­works to con­tain the intru­sion before it’s spot­ted is the most effec­tive way to lim­it impact.

This has become even more impor­tant as the hybrid work­ing age has reduced vis­i­bil­i­ty fur­ther, as well as con­trol over end­point devices.

How can organ­i­sa­tions strike a bet­ter bal­ance in their end­point secu­ri­ty strat­e­gy?

Data democ­ra­ti­sa­tion can bring enor­mous val­ue to com­pa­nies in the hybrid work­ing age, but you can only enable it safe­ly by ensur­ing the sys­tems that stake­hold­ers use to access data are secure. That means equip­ping employ­ees with sys­tems that are secure by design and don’t get in the way of work­flows, enabling users to work con­fi­dent­ly with­out fear of being tricked into click­ing on some­thing that com­pro­mis­es their sys­tem. Invest­ing in tech­nolo­gies like micro-vir­tu­al­i­sa­tion can iso­late threats deliv­ered by the most com­mon threat vec­tors – email, brows­er and down­loads – to reduce the attack sur­face with­out impact­ing user expe­ri­ence.

When a task is closed, the micro-VM and any threat it con­tains is dis­posed of safe­ly, so even if a user does click on some­thing bad, the attack­er has nowhere to go and noth­ing to steal. Remote work­ers can use their PCs nor­mal­ly, but the CPU vir­tu­al­i­sa­tion hard­ware iso­lates and con­tains attacks even the most sophis­ti­cat­ed and nov­el threats, elim­i­nat­ing that threat vec­tor and caus­ing attack­ers to have to look else­where.

How is HP sup­port­ing organ­i­sa­tions to bol­ster end­point pro­tec­tion?

Unlike tra­di­tion­al end­point secu­ri­ty solu­tions, HP Wolf Secu­ri­ty doesn’t rely just on detec­tion to pro­vide secu­ri­ty. Instead, it pro­tects sys­tems by iso­lat­ing risky user tasks, such as click­ing on links, open­ing email attach­ments, and down­load­ing files from the web. The infor­ma­tion record­ed by HP Wolf Secu­ri­ty also pro­vides insights into how users inter­act with threats, such as uncov­er­ing which email lures are con­vinc­ing enough to trick users into open­ing mali­cious attach­ments. These insights empow­er secu­ri­ty teams to craft pol­i­cy changes to defeat oth­er sim­i­lar attacks.

With HP Wolf Secu­ri­ty, the mal­ware is run inside a micro-VM where all activ­i­ty is record­ed in a ‘black box’ flight recorder, thus cap­tur­ing what the attack­er is doing and what they hope to achieve, giv­ing rich threat teleme­try.

For more infor­ma­tion, vis­it hp.com/wolf

Pro­mot­ed by HP