What are the cyber security challenges of hybrid working?

When it comes to the ideal post-pandemic work environment, employers and employees and have very different ideas.

According to a Microsoft study, 73% of workers want to keep the flexible work arrangements created in response to COVID-19, and 67% want a return to in-person collaboration.

The overlap in these figures suggests that there isn’t a clear divide between those who want to stay at home and those that want a return to the office.

Rather, many people want a hybrid working option that gives them the benefits of both set ups.

Depending on how hybrid working is implemented, this could mean fixed days in which employees come into the office, or the organisation could create a hotdesking system that gives employees the option to come into the office when they want.

Although employees and employers may rejoice at the flexibility that hybrid working affords, you must understand the cyber security risks associated with it.

In this blog, we look at three things you must consider before implementing a hybrid work model.

1. Public networks are vulnerable

One of the main benefits of the office environment is that all employees are protected by the same network defences. The ‘castle and moat’ approach makes it easy for your IT team to adopt appropriate controls and to see when unauthorised actors are trying to access the network.

However, when employees work from home, they are using public networks that offer restricted bandwidth and exposed modem control interfaces, which makes them possible targets for cyber attacks.

Additionally, if employees use Internet of Things devices, such as printers, cameras and TVs, this presents another vulnerability.

If organisations are to protect remote workers, they must provide a VPN (virtual private network). It ensures that information is encrypted as it travels across networks, mitigating the risk that someone could intercept it.

Another benefits is that VPNs can be used anywhere. As such, employees using work laptops in and out of the office don’t need different security controls based on where they’re working.

2. Employees must take personal responsibility

There’s only so much an organisation can do to protect its employees from security incidents. Ultimately, it’s their job to follow the advice from training courses and practice strong habits.

That includes things such as creating unique passwords for work accounts, spotting phishing emails promptly and disposing of sensitive information appropriately.

Unfortunately, few employees are doing this, with Verizon’s 2021 Data Breach Investigations Report finding that almost one in four security incidents is caused by employee error.

This perhaps isn’t a surprise, with the increase in remote working removing the security infrastructure and discipline that comes with the office environment. Employees don’t have immediate IT support or the option to speak to a colleague if they aren’t sure what to do.

Likewise, there isn’t anyone to point out an error – like physical records being improperly disposed of – before it’s too late.

If organisations are to implement a hybrid work model, they need to take extra steps to remind staff of their security responsibilities.

Ideally, this involves training courses and other awareness practices that highlight the mistakes employees may make while working from home, and the differences between effective remote and office work practices.

3. You need an incident response plan

Before the pandemic, your incident response plan probably assumed that most employees would be working in your premises. In a hybrid work model, this obviously isn’t the case, and your incident response plan must account for that.

The most important issue that you’ll have to deal with is how dependent you are on technology to contact remote staff. If your IT infrastructure is compromised during the disruption, you need to find an alternative way of contacting staff.

To complicate matters, a revised incident response plan for a hybrid work environment isn’t simply a case of deciding what remote workers should do in the event of a disruption, because not all your employees will be remote.

In fact, your plan might be dramatically different depending on the day or the week or whether particular members of staff are hotdesking on that day.

You should therefore consider what changes are necessary depending on who is in the office, which will likely result in a more complex plan.

We’ve written previously on the ways you can improve your incident response plan, but if you’re looking for comprehensive guidance on what to do when you face disruption, IT Governance can provide immediate support.

Our Cyber Incident Response service provides the support you need to deal with the threat, as our experts guide you through the recovery process.

They’ll review the breach, mitigate the damage and ensure that you are up and running again as soon as possible.