1 00:00:00,000 --> 00:00:01,920 In this lesson, we're going to cover remote 2 00:00:01,920 --> 00:00:03,810 and hybrid work environments. 3 00:00:03,810 --> 00:00:06,570 These days, it is pretty common for most organizations 4 00:00:06,570 --> 00:00:08,490 to allow their employees to work remotely 5 00:00:08,490 --> 00:00:10,890 or to work in a hybrid work environment. 6 00:00:10,890 --> 00:00:13,380 This transformation in our professional work environments 7 00:00:13,380 --> 00:00:15,030 has really reshaped the way we think about 8 00:00:15,030 --> 00:00:17,820 and how we conduct our work on a daily basis. 9 00:00:17,820 --> 00:00:20,400 Working remotely or using a hybrid work model 10 00:00:20,400 --> 00:00:22,260 does offer us with many different benefits 11 00:00:22,260 --> 00:00:23,730 in terms of flexibility, 12 00:00:23,730 --> 00:00:26,430 but it also poses some unique security challenges 13 00:00:26,430 --> 00:00:28,590 that require us to create a strategic approach 14 00:00:28,590 --> 00:00:30,780 to preserving the confidentiality, integrity, 15 00:00:30,780 --> 00:00:33,480 and availability of our organization's data 16 00:00:33,480 --> 00:00:34,710 when we're operating outside 17 00:00:34,710 --> 00:00:37,260 of our typical normal office environment. 18 00:00:37,260 --> 00:00:40,350 First, let's define remote work and hybrid work environments 19 00:00:40,350 --> 00:00:42,570 before we dive into any of the specific challenges 20 00:00:42,570 --> 00:00:44,730 and potential solutions that you may want to implement 21 00:00:44,730 --> 00:00:46,560 inside of your organization. 22 00:00:46,560 --> 00:00:48,900 Now, a remote work environment is any environment 23 00:00:48,900 --> 00:00:51,150 where the organization's employees work outside 24 00:00:51,150 --> 00:00:53,040 of a traditional office space. 25 00:00:53,040 --> 00:00:55,770 This type of remote work can incur from the employee's home, 26 00:00:55,770 --> 00:00:58,350 a coffee shop, or even while they're on vacation, 27 00:00:58,350 --> 00:01:00,360 on a cruise ship in the middle of the Atlantic Ocean 28 00:01:00,360 --> 00:01:01,620 with today's always available 29 00:01:01,620 --> 00:01:03,900 and online satellite connections. 30 00:01:03,900 --> 00:01:05,790 A hybrid work environment, on the other hand, 31 00:01:05,790 --> 00:01:07,710 is going to blend the traditional office environment 32 00:01:07,710 --> 00:01:09,690 with some remote work opportunities. 33 00:01:09,690 --> 00:01:12,390 For example, I personally work using a hybrid model 34 00:01:12,390 --> 00:01:14,490 at Dion Training when I work from our offices 35 00:01:14,490 --> 00:01:16,500 in Orlando, Florida a few times a week, 36 00:01:16,500 --> 00:01:18,330 and then I do the rest of my work from home, 37 00:01:18,330 --> 00:01:21,780 a local coffee shop or a hotel room if I'm on travel. 38 00:01:21,780 --> 00:01:23,760 Now, when we have our employees conducting business 39 00:01:23,760 --> 00:01:25,200 on behalf of our organization 40 00:01:25,200 --> 00:01:27,180 outside of a traditional office space, 41 00:01:27,180 --> 00:01:28,950 there's inherently going to be additional risks 42 00:01:28,950 --> 00:01:30,720 that we're going to be assuming since a lot 43 00:01:30,720 --> 00:01:32,790 of our organization's physical security controls 44 00:01:32,790 --> 00:01:34,890 simply won't be extended into these remote 45 00:01:34,890 --> 00:01:36,510 or hybrid environments. 46 00:01:36,510 --> 00:01:39,330 Additionally, from a purely technological perspective, 47 00:01:39,330 --> 00:01:41,160 data and information that used to be transferred 48 00:01:41,160 --> 00:01:42,510 over an internal network 49 00:01:42,510 --> 00:01:44,460 within a single secured office building 50 00:01:44,460 --> 00:01:46,770 is now going to be transmitted outside of that building, 51 00:01:46,770 --> 00:01:48,330 and it could be accessible to our employees 52 00:01:48,330 --> 00:01:50,190 from their homes, the local coffee shop, 53 00:01:50,190 --> 00:01:52,620 or even a hotel room located in another country 54 00:01:52,620 --> 00:01:54,240 halfway around the world. 55 00:01:54,240 --> 00:01:55,470 All of this takes the information 56 00:01:55,470 --> 00:01:57,840 out of our most trusted internal networks, 57 00:01:57,840 --> 00:02:00,060 and now it's transiting over a mixture of public 58 00:02:00,060 --> 00:02:02,460 and private networks that could potentially have the data 59 00:02:02,460 --> 00:02:05,040 or information exposed by a malicious attacker 60 00:02:05,040 --> 00:02:07,290 who's seeking to cause a data breach. 61 00:02:07,290 --> 00:02:09,660 Now, at the core of this risk is that our home networks 62 00:02:09,660 --> 00:02:11,490 and any public networks we might use, 63 00:02:11,490 --> 00:02:13,830 like a hotel or coffee shops' wireless network 64 00:02:13,830 --> 00:02:16,230 will have less stringent security controls in place 65 00:02:16,230 --> 00:02:17,760 as compared to our organization's 66 00:02:17,760 --> 00:02:20,040 usual office-based infrastructure. 67 00:02:20,040 --> 00:02:22,620 These networks are going to be susceptible to cyber attacks, 68 00:02:22,620 --> 00:02:25,200 including eavesdropping through unencrypted connections 69 00:02:25,200 --> 00:02:28,440 or even direct infiltration by using a weak Wi-Fi password 70 00:02:28,440 --> 00:02:29,670 for that network. 71 00:02:29,670 --> 00:02:32,070 Employees unaware of the sophisticated tactics 72 00:02:32,070 --> 00:02:34,920 employed by most cyber criminals might inadvertently expose 73 00:02:34,920 --> 00:02:36,600 your organization's sensitive data, 74 00:02:36,600 --> 00:02:37,830 which makes cybersecurity training 75 00:02:37,830 --> 00:02:41,010 something that every remote or hybrid worker must complete 76 00:02:41,010 --> 00:02:42,900 to ensure your organization remains resilient 77 00:02:42,900 --> 00:02:44,880 against these kinds of attacks. 78 00:02:44,880 --> 00:02:46,920 Now, in addition to these technical attacks, 79 00:02:46,920 --> 00:02:49,200 we also need to be more concerned with the physical security 80 00:02:49,200 --> 00:02:51,390 of our devices when we're operating remotely 81 00:02:51,390 --> 00:02:53,100 or under a hybrid model. 82 00:02:53,100 --> 00:02:54,840 In a regular office environment, 83 00:02:54,840 --> 00:02:57,720 our environment is totally under our organization's control, 84 00:02:57,720 --> 00:02:59,580 so that any access can be restricted 85 00:02:59,580 --> 00:03:02,100 to only those who are authorized to get in the building. 86 00:03:02,100 --> 00:03:03,810 However, in a remote setting, 87 00:03:03,810 --> 00:03:05,190 the chances of the device being lost 88 00:03:05,190 --> 00:03:06,870 or stolen will be increased, 89 00:03:06,870 --> 00:03:08,610 and without proper safeguarding protocols, 90 00:03:08,610 --> 00:03:09,840 like robust encryption 91 00:03:09,840 --> 00:03:12,510 and the capability to remotely wipe the device's data, 92 00:03:12,510 --> 00:03:14,580 the information contained within that device 93 00:03:14,580 --> 00:03:17,550 could quickly fall into the hands of a threat actor. 94 00:03:17,550 --> 00:03:19,500 So to address these challenges, 95 00:03:19,500 --> 00:03:21,630 we must establish comprehensive policies 96 00:03:21,630 --> 00:03:24,570 that clearly define the acceptable practices for remote work 97 00:03:24,570 --> 00:03:26,880 to ensure that our employees understand the responsibility 98 00:03:26,880 --> 00:03:29,490 in helping to protect our organization's data. 99 00:03:29,490 --> 00:03:31,440 These guidelines should stress the need 100 00:03:31,440 --> 00:03:34,170 to always use a secure connection, like a VPN, 101 00:03:34,170 --> 00:03:36,240 when connecting back to the company's network 102 00:03:36,240 --> 00:03:38,130 in order to access that data. 103 00:03:38,130 --> 00:03:40,500 This will ensure that the data is encrypted end-to-end 104 00:03:40,500 --> 00:03:41,580 to be able to shield that data 105 00:03:41,580 --> 00:03:43,050 from any potential interception 106 00:03:43,050 --> 00:03:45,840 and modification by a given threat actor. 107 00:03:45,840 --> 00:03:48,210 Now, another way to protect your organization's data 108 00:03:48,210 --> 00:03:50,250 when using remote or hybrid environments 109 00:03:50,250 --> 00:03:53,160 is to require the use of multi-factor authentication systems 110 00:03:53,160 --> 00:03:54,840 to create an additional layer of security 111 00:03:54,840 --> 00:03:57,840 in case your users' login credentials do get compromised. 112 00:03:57,840 --> 00:04:00,120 By using multi-factor authentication systems, 113 00:04:00,120 --> 00:04:02,670 you can make sure that it is harder for unauthorized users 114 00:04:02,670 --> 00:04:05,100 to access your organization's sensitive information 115 00:04:05,100 --> 00:04:07,050 because it's going to require that they use multiple forms 116 00:04:07,050 --> 00:04:10,590 of verification before entry is granted to that system. 117 00:04:10,590 --> 00:04:12,570 Now, employees must also become educated 118 00:04:12,570 --> 00:04:15,360 and regularly updated on the current cybersecurity trends, 119 00:04:15,360 --> 00:04:17,250 including recognizing phishing attempts, 120 00:04:17,250 --> 00:04:18,930 safely handling and storing data, 121 00:04:18,930 --> 00:04:20,820 and immediately reporting security incidents 122 00:04:20,820 --> 00:04:22,110 when they're working remotely 123 00:04:22,110 --> 00:04:23,520 or in a hybrid environment 124 00:04:23,520 --> 00:04:25,350 because they're more susceptible to an attack 125 00:04:25,350 --> 00:04:26,190 because they're outside 126 00:04:26,190 --> 00:04:28,920 of our normal organizational protections much of the time 127 00:04:28,920 --> 00:04:30,840 because they're always working remotely. 128 00:04:30,840 --> 00:04:33,540 By conducting training, you can help build a company culture 129 00:04:33,540 --> 00:04:35,850 where security is not just something people talk about, 130 00:04:35,850 --> 00:04:37,890 but it's actually something they have a shared commitment 131 00:04:37,890 --> 00:04:40,320 that all of your employees are striving to achieve. 132 00:04:40,320 --> 00:04:42,030 If your organization relies on remote 133 00:04:42,030 --> 00:04:44,640 or hybrid work environments as part of their architecture, 134 00:04:44,640 --> 00:04:46,770 it is a really good idea to require the use 135 00:04:46,770 --> 00:04:49,290 of company issued devices for all remote work 136 00:04:49,290 --> 00:04:51,390 to ensure the highest levels of security. 137 00:04:51,390 --> 00:04:53,700 These devices, including laptops, tablets, 138 00:04:53,700 --> 00:04:55,710 and smartphones, should be fully equipped 139 00:04:55,710 --> 00:04:57,990 with up-to-date security software, firewalls, 140 00:04:57,990 --> 00:04:59,250 and other monitoring tools 141 00:04:59,250 --> 00:05:02,160 that provide real-time protection and threat detection. 142 00:05:02,160 --> 00:05:04,590 For example, if you're going to allow personal devices 143 00:05:04,590 --> 00:05:06,060 to be used under a bring your own device 144 00:05:06,060 --> 00:05:10,830 or BYOD policy, instead of using a CYOD or COPE policy, 145 00:05:10,830 --> 00:05:12,690 then your organization must outline 146 00:05:12,690 --> 00:05:14,190 the required security measures, 147 00:05:14,190 --> 00:05:16,470 like installing official security software updates 148 00:05:16,470 --> 00:05:18,120 and regular patching and updates 149 00:05:18,120 --> 00:05:19,470 to be able to ensure the security 150 00:05:19,470 --> 00:05:21,060 of these personally owned devices 151 00:05:21,060 --> 00:05:24,090 that are being used for remote work in your organization. 152 00:05:24,090 --> 00:05:26,130 But since the employees own the device, 153 00:05:26,130 --> 00:05:28,470 this can actually complicate the securing of the device 154 00:05:28,470 --> 00:05:30,240 because the organization doesn't own it 155 00:05:30,240 --> 00:05:32,430 and doesn't have rights to install software on it 156 00:05:32,430 --> 00:05:34,410 without the employee's permission. 157 00:05:34,410 --> 00:05:36,240 Another critical thing to consider with remote 158 00:05:36,240 --> 00:05:37,530 and hybrid work environments 159 00:05:37,530 --> 00:05:39,780 is how are your backups going to be conducted? 160 00:05:39,780 --> 00:05:42,330 Automated backups, whether on a secure physical server 161 00:05:42,330 --> 00:05:44,280 or a cloud-based one can be used 162 00:05:44,280 --> 00:05:45,780 to protect your data against loss 163 00:05:45,780 --> 00:05:48,360 and provide a recovery option in case of ransomware 164 00:05:48,360 --> 00:05:50,820 or other type of cyber attack is going to occur. 165 00:05:50,820 --> 00:05:52,050 Now when working in a remote 166 00:05:52,050 --> 00:05:53,910 or hybrid environment, it's also important 167 00:05:53,910 --> 00:05:56,010 that you put in place the proper collaboration tools 168 00:05:56,010 --> 00:05:58,560 and platforms, so that your employees can remain productive 169 00:05:58,560 --> 00:06:00,600 while working outside of the office. 170 00:06:00,600 --> 00:06:01,830 When choosing a collaboration tool 171 00:06:01,830 --> 00:06:03,600 or platform, you should always choose one 172 00:06:03,600 --> 00:06:06,630 that prioritizes the security of your organization's data. 173 00:06:06,630 --> 00:06:08,640 Some things that are considered to be part of your tool 174 00:06:08,640 --> 00:06:10,380 or platform selection criteria 175 00:06:10,380 --> 00:06:12,420 should include the use of end-to-end encryption, 176 00:06:12,420 --> 00:06:14,010 robust administrative controls 177 00:06:14,010 --> 00:06:16,770 and compliance with international security standards. 178 00:06:16,770 --> 00:06:18,570 Finally, it's important that you always maintain 179 00:06:18,570 --> 00:06:20,010 a clear line of communication 180 00:06:20,010 --> 00:06:22,710 between your cybersecurity team and your remote employees 181 00:06:22,710 --> 00:06:24,930 to ensure that any issues can be addressed promptly, 182 00:06:24,930 --> 00:06:27,750 to ensure the potential risks are always kept at bay. 183 00:06:27,750 --> 00:06:28,920 Regular security audits 184 00:06:28,920 --> 00:06:30,900 and feedback sessions with your remote staff 185 00:06:30,900 --> 00:06:32,190 will also help your security team 186 00:06:32,190 --> 00:06:34,470 to update their security protocols when necessary 187 00:06:34,470 --> 00:06:35,430 and allow them to fix 188 00:06:35,430 --> 00:06:37,860 any potentially overlooked vulnerabilities. 189 00:06:37,860 --> 00:06:40,740 So remember, as remote work and hybrid work environments 190 00:06:40,740 --> 00:06:43,260 become increasingly more common in our organizations, 191 00:06:43,260 --> 00:06:45,720 we have to continually become more proactive 192 00:06:45,720 --> 00:06:47,310 to secure our assets outside 193 00:06:47,310 --> 00:06:49,350 of our traditional office environments. 194 00:06:49,350 --> 00:06:51,630 To secure these remote and hybrid work environments, 195 00:06:51,630 --> 00:06:53,940 we have to utilize robust security protocols, 196 00:06:53,940 --> 00:06:56,190 provide employee cybersecurity awareness training, 197 00:06:56,190 --> 00:06:57,660 stress the employee's responsibility 198 00:06:57,660 --> 00:06:59,160 to secure their own devices, 199 00:06:59,160 --> 00:07:01,650 as well as utilizing a continuous adaptation 200 00:07:01,650 --> 00:07:03,390 to emerging cybersecurity threats, 201 00:07:03,390 --> 00:07:05,250 so that they can best safeguard our corporate data 202 00:07:05,250 --> 00:07:07,260 against the ever-changing threat landscape 203 00:07:07,260 --> 00:07:09,300 that we face on a daily basis. 204 00:07:09,300 --> 00:07:11,130 By embracing these best practices, 205 00:07:11,130 --> 00:07:13,800 your organization can confidently navigate the complexities 206 00:07:13,800 --> 00:07:16,260 of these working arrangements while maintain the integrity 207 00:07:16,260 --> 00:07:18,813 and confidentiality of their business operations.