The pandemic brought about a sudden and rapid change in how we work. We discovered that most processes could be carried out remotely from our homes. This forced IT departments in companies to find the best way to provide connectivity for their employees, avoiding rework or additional tasks that could decrease productivity. Furthermore, they didn’t have enough time to evaluate the best options or all the factors that make up this new work model. Many companies neglected to ensure the security of their remote users’ browsing and focused on providing secure access to resources still hosted on-premises or in the cloud, neglecting the security of the equipment online, since previously this security was embedded in the network.
According to a study conducted by INTERPOL during the pandemic (https://www.interpol.int/es/Noticias-y-acontecimientos/Noticias/2020/Un-informe-de-INTERPOL-muestra-un-aumento-alarmante-de-los-ciberataques-durante-la-epidemia-de-COVID-19) , cybercrime increased up to three times compared to the previous year. Just as we had to accelerate the digital transformation of our processes, criminals also evolved in how they carried out their crimes. The significant increase in users working remotely, the lack of cybersecurity education, and the use of company computers for personal activities led to a series of new vulnerabilities in many businesses. We observed that cybercriminals now intended to target employees to gain remote access to data, encrypt information using ransomware, and hold data hostage, stealing it and then selling it or demanding a ransom.
Now that we’ve overcome the pandemic, the behavior of cybercriminals hasn’t changed, nor has the number of attacks decreased. Although we’ve largely returned to the office, many people are now considering remote work due to its significant benefits. This gives us a second chance to review our company’s remote work model and pay closer attention to those security details we previously neglected due to the urgency of providing remote access to all users or a lack of knowledge.
In this publication we will address a solution that, in addition to its many benefits, gives us the opportunity to address this challenge presented by teleworking.
Currently, most companies lack a robust security solution to protect remote workers. Typically, they use antivirus software with additional features such as IPS, IDS, firewall, and application control, providing an extra layer of security. However, this comes at the cost of system performance depending on the modules enabled. While this solution helps protect employees outside the corporate network, it also increases the need for increasingly powerful hardware to avoid disruptions to work activities due to the significant resource consumption required to run this security software. Furthermore, it’s difficult to apply the same security permissions and exceptions as on the corporate network, as the solutions used are often from different vendors or don’t offer the same level of configuration granularity. This often leads to neglecting security controls on remote devices and adopting a more flexible approach due to the additional tasks involved in maintaining consistent configurations.
Thanks to cloud processing, we can perform these security analyses and checks without impacting our employees or their teams. The most important thing to verify when selecting the manufacturer or tool that will help us with this task is that it has the following components:
- DNS layer security – over 90% of malware uses DNS to gain remote control, leak information, or redirect traffic to malicious sites. A tool is needed that blocks dangerous user connections to malicious domains and even neutralizes security incidents before they occur.
- Threat Intelligence – these are threat identification groups that constantly analyze internet traffic to find new threats and zero-day vulnerabilities. Identifying threats based solely on signatures is now considered obsolete. A specialized security team is required to work daily to identify new threats.
- Web Traffic Analysis – Due to the increase in encrypted internet traffic, cybercriminals have taken advantage of this new landscape to encrypt malware content and thus try to avoid detection by security tools. For this reason, we now need tools capable of decrypting SSL traffic to identify and analyze the files, packets, or data traveling to or from the internet. Furthermore, it is important to have granular tools that categorize URLs and web applications.
- Third-Party Integration – Finally, integration with third-party tools via API is essential. Since it’s not possible to rely on products from a single vendor, having integration options with other vendors becomes crucial for optimally correlating data and detecting threats in a timely manner, allowing us to take action before security incidents occur.
At ITS, we have all the experience your company needs in security solutions. We support our clients every day to minimize the security risks they may face. With Cisco Umbrella, we can effectively protect remote workers and safeguard your network from internet traffic.
Cisco Umbrella is a cloud-based platform that allows us to promptly address various online threats. It also helps us identify infected devices to prevent data theft and take timely action to stop further infections on the network.
Umbrella provides the first line of defense against online threats, regardless of where users are located. Users will be protected and will also have complete visibility into their online activity, enabling more informed and security-focused decisions. Remember, security is not something to be taken lightly. We must always be aware of the dangers we face, and the greater our visibility and control over all our users, the faster we can act. Threats are constantly evolving, and so are our security solutions.
