How to adapt your security policy to a hybrid workspace
The pandemic forced companies to set up remote access. Efficiency was the main priority. To the detriment of data and flow security...
Various studies estimate that around 20% of French employees telework two or three days a week. Despite the government's determination, this proportion is unlikely to increase for a variety of psychological, technical and organizational reasons.
Nevertheless, the idea of a hybrid workspace is gaining ground. This is not good news for stressed and overworked security teams, who are already struggling to respond to internally-generated security events. The pandemic has only exacerbated the stress.
According to a recent report by ESG and ISSA, COVID-19 has not only forced cybersecurity professionals to change their priorities/activities, it has also increased their workload. They must now monitor a larger and more heterogeneous attack surface.
A recent report from VMware Carbon Black revealed that the shift to working from home has led to a 148% increase in ransomware attacks. CE highlighted key areas for security teams to address.
Personally identifiable information (PII) is the main target of cybercriminals. According to Ponemon Institute's latest Cost of a Data Breach Report 2020, 80% of data breaches involve this type of information. This poses two major problems. The first is data security, as remote working effectively widens the attack surface; the second is that the confidentiality of customer data is also compromised.
Hybrid Workspace recommendations
More than ever, companies need to establish a solid foundation for identity governance using the following recommendations:
- Increase efficiency by implementing automated request and approval processes for system access
- Cataloguing who has access to which systems and applications
- Associating identities with roles
- Ensure that access rights change as role functions evolve
- Enforce segregation of duties so that multiple roles associated with an identity do not lead to inadvertent access to sensitive systems.
- Perform regular audits of access and compliance data
Failure to secure data and maintain confidentiality can lead not only to breaches, but also to heavy fines for non-compliance. Governance of data and identities is therefore essential to ensure its long-term survival.
