Cyber-safety is much more difficult when working from home, writes John Clancy of DXC Technology

In response to the Covid-19 pandemic, many organisations have moved to remote working, which presents new and attractive intrusion opportunities for hackers, who will target systems and data outside the boundaries of the corporate network. 

In the past month, DXC Technology has tracked at least 15 coronavirus-themed campaigns attempting to distribute 39 different types of malware to unsuspecting workers.  

DXC recommends five key cybersecurity defences that should be reinforced to ensure they are meeting an organisation’s remote working practices.

Security Awareness: Education is the key. Informing your employees how to be cybersecurity aware is even more essential at this time.  E-learning always was one of the most efficient ways to improve the IT culture, but now it is the primary way to secure your organisation.  

Why? While data breaches are generally associated with the actions of malicious criminals, research has shown that 88% were the result of human error. The training should be extended to include clear guidance on securing virtual meetings, particularly if non-corporate applications are to be used. 

In Association with

Often, the lack of knowledge about the content, and the lack of understanding of the meaning and purpose of security polices, is the main reason incidents occur. The DXC campaign therefore aims to improve awareness for information security and to sustainably anchor it in the corporate culture.

End Point Protection: The objective is to protect devices, employees and third-party BYOD devices. Organisations can prevent intruders from derailing operations by defending every device remotely against a new generation of security threats. This should incorporate updated company policies, latest technologies, infrastructure and new business needs in a latest generation endpoint threat protection.

Advanced Threat Protection: This aims to protect employees and third parties from advanced persistent threats via email (phishing) and web channels, implement email filtering at the mail gateway and block suspicious IP addresses.  Adopt a layered security model that anticipates and immediately responds to any type of cyber danger where, ideally, a 24/7 monitoring service provides the ability to detect threats and initiate the appropriate response.

Network Protection: Organisations need to enable secure access while protecting users, applications, and control data — from anywhere.  Managed next-gen firewalls and VPN services are key to a largely remote work force. This should go beyond the now standard Distributed Denial of Service (DDoS) protection and ensure your environment is protected against unauthorised users and systems based on Zero Trust Network Access (ZTNA).  

This requires a more robust identity and access capability that forms a critical layer in the security stack to reduce the risk — highlighted in the reference to human error as the primary cause of data breaches.

Authentication and Access: The Zero Trust model requires a unified identity-centric framework to be in place to perform the required verification. The identity-centric framework is not only used to authenticate human users, but also to authenticate communication among entities (applications, devices, network services), which is prevalent in an automated environment. 

Methods of authentication could be through passwords, API keys or public/private keys. For users this will most likely require the use of Multi-Factor Authentication (MFA), particularly if using BYOD equipment.  

“It gives you visibility,” says Martin Reilly, DXC Technology’s global strategy lead for identity and access management. “You can see who has what access and where there’s any noncompliance. Secondly, it gives you the tools to actually manage towards remediation and do so in an often-automated way. And finally, it gives you the tools to automate and provide self-service for the regular joiners, movers, leavers processes.”

• John Clancy (pictured) is sales leader at DXC Technology, which employs 800 people in Dublin, Galway and Belfast