A new survey shows that the vast majority of senior executives say would’ve approached their return-to-work push “differently.”
A new survey shows that the vast majority of senior executives say would’ve approached their return-to-work push “differently.”
Security is definitely a legitimate argument for some companies. The average home network is nowhere near as secure as an enterprise network and BYOD is not nearly as secure as the systems setup and managed by your organization.
Edit: Everyone saying “use a VPN that’s how you secure your home” needs to do more research. I have a comment below explaining how just using a VPN doesn’t make you safe.
I doubt it. The home network does not need to be secure. That is why you have VPNs and other such technology.
Some networks are not accessible via vpn.
In those cases it’s justifiable to have to work in-person. I don’t think we’d want closed networks (presumably for stuff like nuclear power) exposed to the open internet.
True, but that won’t be most of the work force. There will always be exceptions for security/defense and some other areas. I suspect those areas already had a process for monitoring the comings and goings of staff and any off-site work. I also suspect the amount of off-site work was limited to begin with if it impacted security/defense.
Those networks are also not accessible from home networks, then.
The issue of using a work device outside of the office is if you ever connect it to your home network off of the VPN, then there is a chance the device is compromised. A malicious actor could have targeted you because they want to gain access to your company and they saw on your LinkedIn that you work remotely. So they simply use some OSINT to find your address, run a geo search on shodan and wiggle to identify your homes IP, then use that as an entry point to compromise your router and wait for your device to connect to continue the attack. This may sound complicated or a lot of work but this is actually quite simple to do and takes only 10 - 15 minutes.
It’s also about physical security, protecting access to your work laptop and protecting IP. That VPN is completely useless if someone can get into your home and access your device. It’s way easier to get into someone’s home than into a properly secured office.
That’s also why you encrypt your drives. The average enterprise figured out how to let somebody work from an airport long ago. It’s really not a huge deal.
Ever hear of a VPN? This is pretty standard “security” for most Fortune 500s. Home network can be a Starbucks WiFi, but unless you have the decryption keys you are not going to be able to intercept the traffic tunneled through a VPN.
It’s not just network security though, that was just one example I used. Another is protecting company IP. They could be working from home and a neighbor peek through the window and see what you’re working on. Also that VPN isn’t worth a damn if someone can get into your home and gain physical access to your device. Sure they could also break into an office, but offices usually have a security system with alarms, cameras, and sensors. They also usually have stronger doors and locks. Security is absolutely a valid reason to return to the office. I work in cybersecurity for the record and this is an actual reason being pushed for a return to the office.
If you use vdi that runs on a corporate thin client security is basically a non-issue. Data never leaves the data center and so long as you harden the thin client it should be difficult to breach it.
It’s also about physical security, protecting access to your work laptop and protecting IP. That VPN is completely useless if someone can get into your home and access your device. It’s way easier to get into someone’s home than into a properly secured office.
Right… that’s why you would use a VDI. There’s nothing local except a thin client that runs your citrix/vmware/whatever client. There’s a reason that VDI is generally used for PCI-compliant business cases but VPN is not.
Having implemented this sort of stuff for the mind if companies you probably think of when you’re thinking of enterprise… You’re making a mountain out of a molehill.
The use of a VPN to secure data in transit and the use of strong encryption on the device, endpoint protection and management features, along with good password security make it easy for any organisation not dealing with literal SECRET or TOP SECRET information to enable remote with.
Even the government has capitulated to the idea that devices themselves should be secure:
https://csrc.nist.gov/pubs/sp/800/207/final
If you can deal in government data on your laptop at a starbucks, we most certainly can work at home behind locked doors in our own offices with anything equivalent.
See my other comment. It’s also about physical security, protecting access to your work laptop and protecting IP. That VPN is completely useless if someone can get into your home and access your device. It’s way easier to get into someone’s home than into a properly secured office.
deleted by creator