{"id":7893,"date":"2020-09-15T00:00:00","date_gmt":"2020-09-15T00:00:00","guid":{"rendered":"https:\/\/www.esecurityplanet.com\/2020\/09\/15\/securing-remote-workforce-is-top-security-priority-gartner-2\/"},"modified":"2021-12-20T18:52:50","modified_gmt":"2021-12-20T18:52:50","slug":"remote-workforce-security","status":"publish","type":"post","link":"https:\/\/www.esecurityplanet.com\/endpoint\/remote-workforce-security\/","title":{"rendered":"Remote Work Security: Priorities & Projects"},"content":{"rendered":"
\n
\n
\n
\n
\n
\n
\n

Each year, Gartner analysts recommend 10 security projects that combine high business impact with high risk reduction. Privileged access management (PAM)<\/a> topped the list in 2018<\/a> and 2019<\/a>. This year, after the COVID-19 pandemic forced nearly half of workers to telecommute, Gartner’s focus has now turned to securing the remote workforce<\/a>.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

As if to underscore the point, Gartner analyst Brian Reed unveiled the list of top security projects for 2020-2021 at Gartner’s Security & Risk Management Summit – held virtually this week a few months after the annual in-person event was canceled because of the pandemic.<\/p>\n

Remote workforce security, Reed told attendees, “is the single greatest existential imperative for all organizations in the wake of COVID-19.”<\/p>\n

He later added, “If you can only do one project, focusing on securing your remote workforce and going back and looking at some of those changes we might have made earlier in the year would be a really good use of time.”<\/p>\n

Among the issues security teams should examine are whether they’re granting too much access or not enough. One sign of the latter might be users bypassing security to get their jobs done.<\/p>\n

Other remote security considerations include job function, device type, the kind of application and data being accessed, whether in the cloud or on-premises, and the user’s location. That last consideration should also include an assessment of the company’s compliance<\/a> with local labor and privacy laws.<\/p>\n

The challenge with remote workforce security, Reed said, is to craft a zero-trust strategy<\/a> that enables business while securing remote workers – and that means making sure that both managed and unmanaged devices can securely access applications.<\/p>\n

He listed 14 vendors that can potentially help: Akamai; Cato; Cloudflare; Cisco; Cyxtera; Google Cloud; InstaSafe; Meta Networks; Microsoft; Okta; Pulse Secure; Perimeter 81; and Zscaler.<\/p>\n

COVID-19 creates new security threats<\/h2>\n

The rapid move to telework has revealed security weaknesses in remote desktop protocol (RDP), VPN<\/a> and videoconferencing solutions<\/a> and forced security teams to develop new protocols for remote endpoint management and patching<\/a>, said Gartner senior research director Jonathan Care.<\/p>\n

Before the pandemic, security was designed around the notion that remote work was the exception, so when COVID-19 led to a dramatic surge in telecommuting<\/a>, always-on VPNs and BYOD<\/a> suddenly became urgent issues.<\/p>\n

Rising threats because of the pandemic include coronavirus-related business email compromise (BEC)<\/a> and phishing<\/a> scams, including SMS phishing (\u201csmishing\u201d) and credential theft attacks, he said. Nation-state actors have launched advanced persistent threats (APT)<\/a> against healthcare and essential services by using scan and exploit techniques and password spraying to take advantage of unpatched vulnerabilities.<\/p>\n

Remote access security technologies<\/h2>\n

Gartner analyst Rob Smith will also discuss remote access security in a Sept. 16 presentation at the conference.<\/p>\n

Smith says enterprises should avoid using always-on VPN unless they have to. He recommends three technologies for remote workforce security:<\/p>\n