There is a lot of uncertainty around where we are headed, both individually and corporately, as we watch, for most of us, one of the most impactful events of our lives unfold day after day. We each have the responsibility to do our part in flattening the curve and, for many organizations, that means implementing alternative work arrangements. My thoughts go out to IT professionals across the globe scrambling to ensure our workforce can access the resources it needs to best continue business operations. In this brief blog, I want to discuss ways to ensure security of remote infrastructure during this transitional time.

A New Global Remote Workforce

With the COVID-19 pandemic coming on the heels of the recent Windows 7 support expiration, many IT departments are struggling to make things work for their users. With all the changes taking to accommodate a new global remote workforce, I am confident many organizations will fall victim to cyberattacks during this period of transition. Attackers are very keen to how an event like the COVID-19 pandemic can impact business continuity and they WILL aim to exploit an opportunity such as this. No doubt, there will be a long list of crisis-related social engineering tactics developed. However, the newly established/expansion of global remote will create unprecedented vulnerabilities.

For many businesses, this is uncharted territory. Organizations should take enhanced precautionary measures, like penetration testing of remote infrastructure, to ensure the population of misconfigured devices does not grow exponentially. If organizations do not take the necessary steps to ensure security of remote infrastructure, attackers will be left with an endless supply of targets in their sights.

4 Discussion Points Around Security of Remote Infrastructure

With this in mind, here are some discussion points for the C Suite and their IT Departments around security of remote work:

  • Do we have change management/tracking in place for EVERYTHING that is being done to our infrastructure? – So many times, changes are implemented on a system to get a solution “to work” but is often not revisited until exploited by an attacker.
  • Are we allowing employees to access our resources from personal computers? – Some organizations might loosen access rules “temporarily” without fully acknowledging the associated risk.
  • Are we using Multi Factor Authentication for external access? – It’s not a silver bullet but ask anyone that’s had a corporate email account compromised, and I can assure you they wish they would have been using some form of multi factor authentication. Yes, there’s been research and reports of this being circumvented, but successful security is established in layers.
  • Who’s checking our work? – As I mentioned, there are a lot of changes being made to network infrastructure. The need for review of these systems by a third-party is imperative.
  • Penetration Testing for Remote Infrastructure

Making sure that your organization utilizes internal and external resources effectively is key during this uncertain and transitional time. Penetration testing your remote infrastructure to ensure no holes have been left available for exploit by an attacker could mean the difference between weathering the storm or going beyond the point of no return.

Any questions related to testing the security of your remote infrastructure, feel free to reach out to HORNE LLP’s Director of Network Security, Brad Pierce, at 901.372.5816 or brad.pierce@hornecyber.com.