IT's Quick Security Checklist for Remote Workers

Client-Side Security

Goal: Remote but not forgotten

• Comprehensive EDR Solution - Having a robust endpoint detection and response solution ensures that you can identify and respond to security problems regardless of where people are working.
• Granular Logs Stored + Forwarded to Central Log Utility - Ensure you can log data - especially in the event of an attack - where you can try to gather forensics, whether you user is on or off premise.
• Firewall Telemetry With On-Net / Off-Net Detection - Ensure you can use or see user activity with the same level of granularity as you see in your firewall logs, even when users are not at the office. 
• Offline Web Filter, Antivirus, Application Control + VPN All-in-One - Sending home your web filter policies, anti-virus rules, application and compliance controls so that even when they’re not on your network, you can still enforce the same type of policies you have when they are in the office.
• An Endpoint Management Console to Make 1:MANY Changes Fast - If your policies are changing and evolving frequently, implement a system where you can reconfigure multiple settings across your entire enterprise without having to touch every device.
• Automated Quarantine Upon Infection - If a user gets infected while working from home, you should be able to contain and prevent a security breach, remotely.
• Compliance Checks Before Access is Granted - Be able to validate that your user has necessary security software, critical patches, etc before they connect to the VPN or plug into a network port.
• Multi-Factor Authentication - This should be a requirement for every critical system, including VPN. 
• Identify + Access Management  - When users are connected, their access should always be exclusive to what they need. Ensure you have a way to easily revoke that access when it’s misused, or not accessed for a period of time.
• User Behavior Analytics (UEBA) - If a user logs in to the VPN from Miami at 12:01 PM, and then they log in from Cairo at 12:03, two minutes later - make sure you have a system to alert you when that activity happens.

 

SaaS

When IT systems fail to provide the desired level of functionality to the business, users often resort to shadow IT tactics. 

• Direct API Integration to Cloud Services Without Proxification - Make sure you can see API access into solutions like Office 365, Dropbox, Salesforce, etc. so you can know what’s going on.
• Policy-Based Data Leak Management + Compliance - Be on the lookout for any suspicious activities that may alert you to shadow IT. Helpful Tip: You should have rules that determine if people are moving large volumes of data - this should be one of the biggest concerns a business executive should have while their workforce is working remotely.
• User Behavior Monitoring - Ensure you can see how users are leveraging SaaS tools, so you can put barriers around activity that could create problems - i.e. Documents that have HIPPA information that’s being posted in the cloud. 
• Comprehensive Reporting - Having reports that give you insight into how SaaS tools are working - i.e. where your security problems are.
• Antivirus + Advanced Persistent Threat Detection - You should be able to perform integrated anti-virus scans and look for advanced, persistent threats, or malware that has not been discovered yet.
• On-Premise + Remote Seamless Functionality - Be able to see all of the above, regardless if your users are in the office or at home.

Get Your No-Cost Cybersecurity Assessment

Public Cloud

How to have the flexibility of the Public Cloud… and be able to sleep at night.

• Integrated + Automated Security Integrates Everywhere: Public Cloud, Private Cloud, Hardware + Virtual Appliances - Cloud security should be automated and integrated everywhere. For example, if you have VMs that are running in the public cloud, the private cloud, in a data center on a physical appliance, or on ESXi at HQ, ensure you can manage ALL of them from a single pane of glass, and be able to determine how it’s functioning in real-time across the entire enterprise.
• I Need More Than a Stateful Firewall in the Cloud - Ensure your firewall in the cloud is indeed a NEXT-GENERATION firewall.
• Public Cloud Should Be an Extension of My Corporate Network, Not an Island - Treat everything that’s in the public cloud no different than what you have in your branch office locations.
• Central Management + Logs Everywhere - Have consistent control across your entire enterprise, and also consistent real-time visibility into what’s going on.
• IAM, SSO, UEBA, WIFI Controls, SD-WAN - All of these should work just like the firewalls in your data center, AND they should be available in EVERY public cloud, not just AWS or Azure, but ALL others as well (IBM, Google, Alibaba, etc).

 

Removing Obstacles Back at the Office

Cutting costs, transferring budgets, and more. 

• Trade expensive WAN links for lower cost redundant internet connections and maximize their value with SD-WAN.
• Integrate a central management utility for your firewalls, switches, AP’s, and SD-WAN across the entire enterprise to save time and ensure consistency.
• Consolidate Management Consoles - If you have 30 different management consoles (which is not uncommon), that means you are not able to watch what’s going on, in real-time. It also means that when employees get sick, who is going to manage that? It becomes harder to scale the more interfaces you have. If you are needing to shrink your budget, consider getting a consistent level of hardware and software running your IT organization in a smarter way.
• Patch Management - Do you have the tools to enforce patch management?
• Enforce Your BYOD Policy - How do you enforce BYOD policies that make sure people aren’t abusing VPN access? If Steve has two VPN sessions active, and only one work-issued device - there’s a problem.
• Safe File Sharing - Ensure you have the infrastructure to share and store sensitive data.

Branch Locations

How to improve branch architecture, and benefit cost-wise. 

• Cut Expensive MPLS Links + Use SD-WAN Instead: MPLS links are not only expensive, but they are SLOW. Determine how to replace MPLS links with SD-WAN, IPsec tunnels, and augment that environment to save money, but also increase performance.
• Centralize Branch Operations with a Central Management Appliance - This will reduce the error that may result in you getting locked out of your branches, and will give you a more consistent configuration.
• Streamline Authentication for Users - Look at 802.1x for Wired/Wireless, NAC, and central managed switches and access points. Make sure everything is consistent everywhere to reduce error.
• Remove expensive point products that are hard to manage, costly to renew, and that often do not offer automated or integrated capabilities.
• Use a 3G/4G solution to provide out-of-brand remote access even when an internet connection fails.
• Make it easy for users to choose a branch VPN location that is located nearby and provides reliable access to the entire enterprise when possible.

 

Want to learn more? Watch our engaging Webinar on Secure Connectivity: An Introduction to the Fortinet Telework Solutions.