A dramatic rise in hybrid and remote work has shifted the landscape for cybersecurity. In the early days of the pandemic, remote work offered companies business continuity. Now, many employees have gotten used to the flexibility that accompanies it.
To accommodate employees, organizations, including financial services companies, have embraced hybrid work models. One survey showed that just 20% of financial services employees wanted to be in the office three or more days each week once COVID-19 is fully behind us. As things stand now, about 70% of financial services companies expect to have the majority of employees work remotely at least one day a week.
But, while hybrid work has been shown to boost productivity, it can wreak havoc on cybersecurity.
When employees were all working in the same office, it was easier to know what devices they were using, what data they were accessing, and whether their behavior was dangerous. With a hybrid workplace, things are a bit trickier. Far more company data lies beyond the old-school perimeter and more employees are working from unmanaged personal devices.
Attackers could gain entry from an employee’s home network and pivot to the corporate network, while theft or misplacement of a personal device could leave confidential business data exposed. Distractions abound in a hybrid setting as well, raising the chance that employees will fall for phishing emails and let malware or ransomware in.
Financial services companies also face particularly stringent regulations regarding how data can and should be handled. GDPR in the EU and the Gramm Leach Bliley Act in the U.S. each outline guidelines for the proper handling of sensitive consumer data—guidelines that still apply when employees are working from home. The SEC also recently proposed new cybersecurity guidelines for financial services firms, ranging from simple (establishing written cyber procedures) to complex (patching and data monitoring).
With so much to consider, some financial services companies may not know where to start. Here are four tools to help you begin ramping up cybersecurity in your newly hybrid workplace.
Multi-Factor Authentication (MFA)
Multi-Factor Authentication, or MFA, is a tried-and-true method to ensure the user logging into a particular device or network is who they say they are. For instance, logging into your email may trigger an alert to be sent to your phone—a device only you possess—that must be validated before the login proceeds. Biometrics are another authentication factor, though passwords and security questions may also be used.
MFA is meant to stop bad actors from gaining access to company devices and networks, preventing most common attacks and breaches. That’s why it’s important that every platform that is accessible from the Internet—including VPNs, G-Suite, Office365, and other SaaS platforms—have MFA turned on. Additionally, high-risk actions like initiating wire transfers should require two people to sign off on the transaction.
Continuous Monitoring
Because a hybrid workplace expands the attack surface, it’s more crucial than ever for investment firms to engage in continuous monitoring. To do so, firms should implement a managed Security Information and Event Management (SIEM) system. A SIEM solution aggregates and analyzes data and activity across IT infrastructures, offering real-time security analysis to proactively identify risks.
With employees logging in from anywhere, at any time, having around-the-clock intrusion detection and prevention is non-negotiable. While machine learning and statistical analysis can help flag anomalies, you also need a team of experts that can analyze those threats in real-time, filter out the noise, and respond to them in a timely manner.
VPNs or Remote Desktops
Virtual private networks, or VPNs, are another important tool for securing the hybrid workforce. VPNs establish an encrypted, private connection, even on a public network.
But not all VPN access is created equal. Employees can access VPNs via unmanaged personal devices, managed personal devices, and managed corporate devices. The latter two options are preferred, as any device managed by your firm is more secure.
Another way to enable secure access is through a remote desktop. With virtualized applications, there’s even less risk that corporate information or assets will be compromised.
Education
Finally, setting up and communicating clear, stringent, no-excuses cybersecurity protocols—and communicating them to employees—is crucial. Clearly state acceptable and unacceptable hybrid work practices, including which applications or devices are authorized for use.
Encourage employees to perform routine and regular checks to ensure they are running the latest software and set up a separate network for guest Wi-Fi. This helps prevent malware from making its way to the corporate network via a guest’s compromised device.
Training and phishing attack simulations can help raise the bar, too. ECI can help you create a fake social engineering attack; these simulations are always great teaching moments.
The use of MFA and VPNs requires training as well. Sometimes hackers try to take advantage of multi-factor fatigue. Remind employees to be mindful when authenticating requests.
The bottom line is that cybersecurity is more important than ever in the here-to-stay hybrid world. For more information on ECI's cybersecurity solutions and how we can help secure your hybrid workplace, contact us today.
