After 18 months of working from home, offices around the U.S. are finally reopening their doors – and employees are ready. According to Glassdoor, 72% of more than 1,100 employed U.S. adults surveyed said they are eager to return to the office.
But it won’t be the old office. Most companies will offer hybrid work environments, where employees can work some days in the office, and others at home. While most people recognize this as a major work/life balance benefit for workers, it’s also a major challenge for IT departments and security teams – because they now have to enable and secure the new “work-from-anywhere” digital office.
Cybercriminals exploit change
Cybercriminals used COVID-19 and the work-from-home trend to unleash an unprecedented volume and variety of pandemic-themed phishing emails. These opportunists took advantage by preying on remote workers’ fears and uncertainties. Mimecast’s 2021 State of Email Security Report found a 64% year-over-year increase in threat volume from 2019 to 2020.
It’s certain that threat actors will similarly attempt to exploit the transition to the hybrid work environment by taking advantage of the associated disruptions and operational challenges.
Securing the hybrid office
On the plus side, unlike the unexpected transition to remote work, the hybrid office doesn’t have to happen overnight. IT and security teams will have time to ensure that when the doors open to employees, it is done so securely.
Here are five tips to help companies transition employees to a secure hybrid work environment:
Educate employees on the latest threat trends, such as COVID-19- and hybrid work-related phishing attacks and impersonations. Also, ensure everyone knows how to detect and report on suspicious emails, which will help reduce the mean-time-to-detect (MTTD) and mean-time-to-respond (MTTR).
For security awareness training to work, companies need engaging and relatable content. Consider combining real-life threats with gamification and offering short videos that are humorous or otherwise interesting, rather than the yearly stock training that just checks a box.
As a rule, companies should review and update policies on a continuous basis to reflect the changing threat landscape and evolving business requirements. Obviously, the change to a hybrid office should trigger a comprehensive policy assessment. For example, remote work has blurred the lines between personal and professional devices, so it’s a good idea to define new bring-your-own-device (BYOD) policies and implement procedures to validate the security of devices before they are allowed back onto the corporate network. In addition, re-evaluate the company’s authentication and authorization policies. With the high rate of ransomware affecting all organizations, updating data recovery and continuity policies can potentially mitigate the time it takes to recover.
The work-from-home trend dramatically expanded the attack surface and eliminated the traditional network perimeter. In this new hybrid world, it’s important to have the ability to find and identify all assets that are on and off the network. In addition to devices, security teams should strengthen the visibility and security of collaboration tools, such as Slack, Microsoft Teams and Microsoft OneDrive. Today, employees are communicating through these channels just as much as email, and they need to protection and archiving.
The average enterprise organization has more than 75 security tools in its technology stack. Simply buying more products doesn’t guarantee that the company will not be breached. In fact, IT infrastructures that are too complex can actually introduce risk rather than mitigate it. Use the return to the office as an opportunity to streamline infrastructure and eliminate tool sprawl.
Additionally, the next time the company invests in a security product, identify how it can integrate into other solutions to make the environment more efficient and effective. Streamlining infrastructure not only can help improve efficiency, but also reduce the volume of alerts and cut down on response time when a security event arises.
Whether remote, hybrid, or in-person, organizations need to make sure they have strong security fundamentals. For example, ensure employees use strong and complex passwords. Make sure IT and security teams conduct vulnerability scans. And keep all hardware and software updated with the latest patches. Too many preventable security incidents occur from weak basic security hygiene. Give security fundamentals the time, resources and budget they deserve.
Following these five tips will help the company strengthen its cybersecurity posture in a hybrid environment. And, in doing so, businesses can ensure that they open the doors to employees – and not to cybercriminals.
Jeremy Ventura, senior security strategist, Mimecast