Since the onset of the pandemic, hybrid working has become an almost universal phenomenon. For those unfamiliar with the exact definition, 'hybrid working' is a form of flexible working that allows employees to divide their time between being at the workplace and working remotely (usually from home).
The sudden and unforeseen shift to hybrid working has had profound implications on the cyber-threat landscape. When an organization moves data and/or applications into the cloud, security teams have to reshape their security policies. After all, in the last 12 months, there were more data breaches than in the last 15 years combined. This shows that threat actors are working hard to exploit the shift to working from home and hybrid working in general.
Fortunately, there are various robust strategies to help organizations shift to hybrid working safely:
- A zero-trust model of security has regularly been highlighted as vital to keeping a hybrid workforce
- A hybrid workforce must be underpinned by a strong privileged access management policy
- Securing Active Directory (AD) points has become increasingly critical to organizations that are shifting to hybrid working
Hybrid working makes use of services from a cloud service provider such as AWS or Azure. Accordingly, those involved in security need to address security considerations, particularly when moving data and/or applications into the cloud.
So here are the top five security considerations for a safe hybrid workforce:
- Security controls
Security controls might not have been properly implemented across the hybrid cloud setup. To make things worse, IT teams can't always update security controls remotely. Taking these things into account is essential to ensure attackers don't get another foothold into your systems to steal data. - Data leakage
IT teams typically use an open internet when setting up private and public clouds. Accordingly, there is a danger that data could be leaked. Data leaks can be caused by devices on the network (e.g., mobile devices), human error, etc. When data is leaked, it is essential to know who is responsible for data breach notification (customer, vendor, etc.). - Risk assessment
To perform effective risk assessment, organizations require a lot of information regarding security policies in operation at the cloud service provider. Once this has been completed, risk assessment is still going to be an obstacle when evaluating hybrid cloud setups. Risk assessments can be performed for private and public clouds as opposed to performing an overall evaluation. Accordingly, it is going to be challenging to have a consistent compliance stance. - Confidentiality and privacy
Organizations have a legal duty to follow appropriate data confidentiality and privacy practices when implementing a hybrid work model. However, moving data to the cloud presents new risks for attackers, which will mean organizations must rethink how employee and customer data remains confidential and how they uphold privacy. - Encryption
A lack of VPN to access an organization's cloud is a considerable cyber threat. Network transmissions are susceptible to snooping and Man-in-the-Middle (MitM) attacks. A VPN will ensure that data received from the cloud is encrypted in transit, providing additional security to employees.
If you liked this article about hybrid working, be sure to check out these other articles by Infosecurity Magazine:
