How to address the security risks of a remote workforce

As part of the COVID-19 pandemic response, a much larger number of government workers are working from home. We may see this trend continue beyond the pandemic given the increases in productivity and efficiency that are being realized by agency leaders. But there is a downside to the work-from-home movement as well – a greater likelihood of a data breach or other cyberattack stemming from the expanded, yet largely unprotected, perimeter that comes with a remote workforce.

With more people working from home, the network perimeter has expanded significantly to wherever users sit or use their devices, exposing government agencies to both outsider attacks and insider vulnerabilities like never before. Over the past month or so, data coming from our Dtex Intercept Insider Threat Platform reveals that an average of 9.2% of home-based workers across all industries are circumventing VPNs.  That number will likely grow over the coming weeks as VPN bandwidth becomes saturated, slowing connectivity speeds and reducing productivity.

Additionally, we have seen an 81% increase in “unapproved” online file sharing on major sites like Google Docs and Dropbox, and a 14% decrease in Microsoft Office usage, despite most organizations reporting an increase in overall user internet activity, further indicating that employees are bypassing their organization’s security protocols. This experience is reflected across the private and public sectors alike.

Traditional cybersecurity relies on perimeter solutions that attempt to prevent intrusions and leakage of confidential information. The sudden move toward working from home has expanded that perimeter exponentially. It’s now potentially thousands of disaggregated endpoints -- far too many to successfully secure the traditional way.

Additionally, the “not in the workplace” prohibition against some apps, devices and behaviors has been vacated as people work from home.  The visibility of activity and persistence of government workplace protocols have changed with the adjustment, and the “usual” threat reporting avenues are no longer available. As a result, cybersecurity protocols must quickly evolve to securely adapt to this new reality.

Here are three ways government chief information security officers and their teams can strengthen and broaden security of the perimeter to ensure protection of data and other digital assets.

1. Gain visibility of corporate assets -- everywhere, all the time. Effective cybersecurity protocols now require total visibility of government assets -- the ability to see and monitor activity in real-time, quickly recognize patterns and behaviors and move to isolate and eliminate threats before they become breaches. Security teams can accomplish this through non-intrusive monitoring and machine learning technology that analyses telemetry from data, machines, applications and people. With this kind of total visibility, CISOs can then take actionable steps to block attempted threats and correct bad behaviors such as accidental data loss or malicious data theft, circumvention of security controls by users or theft and unauthorized use of user credentials by outsiders.

2. Immediately detect bad behavior before it leads to a security breach. While malicious insiders usually represent a small percentage of the user base, it’s critically important to identify them immediately and capture a full audit-trail to stop them before they steal data or sabotage systems. The same applies to malicious outsiders who somehow manage to get access to government systems -- their behavior should be detected immediately so that sensitive systems and legitimate user accounts can be quarantined.

3. Identify teachable moments to inform targeted security training and modify behavior. Teachable moments can come from the common mistakes that users make as part of their day-to-day activities. If left unchecked, these accidental security breaches expose government agencies to ongoing vulnerabilities. By recognizing these non-malicious breaches as teachable moments, agencies can engage employees and promote a more security-conscious workforce, drawing workers’ attention to relevant security risks that are directly attributed to their behaviors.

Long-term alignment with government security objectives must focus on targeted employee training to drive awareness through real-time analysis and recognition of behavior and patterns, both on-network and off-network, across all data, machines, applications and people.

Before COVID-19 struck, government agencies already were challenged with protecting against an ever-expanding threat landscape and maintaining a solid security posture. Now, with a large share of workers accessing networks and files from home and circumventing VPNs, the security risks have grown even greater. However, there is light at the end of the tunnel, as CISOs can take advantage of emerging artificial intelligence platforms and machine learning to develop new protocols and take appropriate action.