Partner Insight: Home working: the need for multi-factor security
During the months of lockdown and widespread uncertainty, it can be easy for unwary staff to fall victim to data breaches. Convincing scams and malicious links are rife, some linked to health or finance issues that prey on people's hopes and fears.
Computer viruses and malware can lurk in IT systems for long periods dormant and undetected, while crypto-jacking tools can do something just as insidious and costly: covertly use the organisation's processors and electricity to make money for others.
The home working risk
At the same time, the dispersed nature of most teams at present means that some home workers may be taking security risks of their own without realising it: sharing devices with family members, using unsecured WiFi connections, ‘shadow' IT, or unsanctioned apps within their departments.
Like the IT functions of a much earlier age, many organisations have had to ‘make do and mend' during the COVID-19 crisis, feeling their way into this world of home working at unprecedented scale.
Others may have found that their corporate laptops or operating systems are out of date, and so are unable to run recent apps for online collaboration and videoconferencing - increasing costs for the organisation as upgrades are forced on them just to keep business ticking over.
Supporting the team
Even those companies that had factored remote, agile working into their corporate strategies are likely to have found themselves ill prepared for up to 100 percent of staff doing their jobs away from the office for months on end. For many CIOs and IT leaders, supporting this level of remote access as the senior responsible owner and protector of the organisation's data has been a significant challenge.
A Verizon report in 2015 found that over 50 percent of data breaches were due to lost login details, passwords, and other credentials. Other surveys have found that many people still use weak, guessable passwords, while some use the same strong password across dozens of different services to avoid having to remember multiple identities.
In the latter case, a successful hack of an online repository could reveal those details to organised criminals; there is a healthy trade in stolen credentials on hackers' forums.
Don't make it easy for them
The ease with which a criminal or opportunistic hacker could assume an employee's identity is just one part of the problem, particularly if home workers are using insecure smart-home devices that give attackers an easy route into the domestic network - and from there into the corporate one.
Other techniques, such as phishing or spear-phishing, aim to trick people into divulging their details, while ransomware locks up devices and data, forcing people to make cryptocurrency payments.
The multi-factor solution
In our private lives, most of us expect strict levels of security from the apps and platforms we use for sensitive tasks, such as online banking, so it's reasonable to expect similar precautions when logging on to corporate networks and applications. After all under GDPR and the Data Protection Act 2018, the penalties for not securing private data can be severe, while the damage to reputations can be long lasting.
All of these threats are why the simple ‘user name plus password' approach to security is no longer deemed sufficient by sensible organisations. Multi-factor authentication (MFA) is essential. Such techniques are particularly effective when deployed at hardware level, and they have the additional advantage of negating the need for passwords at all, which makes the hacker's task much harder.
Amongst the multiple elements that can be triggered or demanded by MFA include a personal identification number known only to the user, a unique code sent by text to the user's registered phone number, or even a biometric identifier, such as a fingerprint. In most cases, it's highly unlikely that a hacker would have access to each of these identifiers.
The greater the number of factors included at the checkpoint or security gate, the greater the assurance that the person is who they say they are and so should have authorised access to the device, application, network, and/or data.
One feature that would be particularly beneficial in a home-working scenario is presence detection and/or a timed lock-out, so if a user leaves their device logged in but is away from their machine, or inactive for an extended period, they can be disconnected from the resource.
By making security a more seamless and less inhibiting experience for the user - and for the IT support team - organisations can enhance the user experience of their employees whilst making them more secure at the same time.
To learn more about how the Intel vPro® Platform supports MFA, click here
More on Security
Double jeopardy: Are universities becoming the new target for cybercriminals and spies?
David S. Wall, Centre for Criminal Justice Studies, University of Leeds outlines recent trends in cyber attacks across the public sector, and higher education specifically
In an age of change, Neustar has focused on protection
Neustar SVP Rodney Joffe is shortlisted for Security Specialist of the Year in the Digital Technology Leaders Awards
Microsoft releases Windows updates to fix Meltdown/Spectre security flaws in Intel CPUs
Updates are KB4558130 for Windows 10 version 2004 and Windows Server version 2004, and KB4497165 for Windows 10 version 1903 and 1909
Tesla was target of serious cyber attack, Elon Musk reveals
Egor Igorevich Kriuchkov had allegedly offered to pay $1m to a Tesla employee for installing malware on the company's network
Most read
