A quarter of IT mangers fear that remote workers present the biggest challenge to security in their organisations, according to newly published research.
A recent opinion poll of 243 information security professionals, working in firms of 1,000 employees or less, found that providing non-technical teleworkers with remote access to corporate systems was widely regarded as one of today’s greatest IT security dangers.
The study, conducted in Q2 2004 by WatchGuard Technologies, found that 22 per cent of respondents said that they lack the time to ensure teleworkers are adequately protected. When asked to rate the security know-how of those telecommuters, the most common response was “poor”.
Installing and configuring systems for remote access was found to consume a significant amount of time for network administrators. According to poll results, 40 per cent of respondents spend more than five hours a week managing remote sites, with 23 per cent averaging more than ten hours a week.
The study revealed that, while companies may have strict security policies governing remote users, nearly a quarter admit they have no way of monitoring whether those guidelines are followed.
“Telecommuting is becoming increasingly common in the market today,” said John Stuckey, vice president of marketing at WatchGuard. “Unlike road warriors who may dial in occasionally from various remote locations while on the move, teleworkers tend to stay connected for long periods at a time from a single place. This can give hackers more time or opportunity to infiltrate the telecommuter’s system, and from there, access the corporate network. Securing the corporate network with a firewall but leaving teleworkers unprotected is a bit like putting a steel door on a straw hut.”
He added that many of firms were using security devices providing Network Address Translation (NAT), which attempts to disguise the whereabouts of the attached PC. “This is the security equivalent of escaping an intruder by hiding in a cupboard. Unfortunately hackers are very good at hide and seek.”
“Even if your teleworkers then use VPN software to access your network, since the device itself may be compromised, all you’re doing is providing a safe on-ramp into your network. You need security at the perimeter and that requires a firewall/VPN device with stateful packet filtering capability at the endpoint.”