Phase 1 was all about employee access, network communications confidentiality/integrity, and basic endpoint security. The next phases will move quickly from risk assessment to mitigation.

As most CISOs know all-too-well, large-scale work from home (WFH) initiatives due to COVID-19, where the priority was getting users up and running as quickly as possible, forced security leaders into an unanticipated follow-on sprint to deliver elementary security safeguards for remote employees (i.e., VPNs, endpoint security controls, network security controls, etc.).

This is the new reality, and it’s an ongoing scramble, but what comes next? 

Let’s call the current situation phase 1, which is about employee access, network communications confidentiality/integrity, and basic endpoint security. 

Some organisations are implementing split tunneling so key employees can access VPNs and the internet simultaneously.  Some are paying to upgrade employee bandwidth — especially for executives spending their days on videoconference meetings while their children use the same networks for home schooling.  Back at corporate, there’s also lots of load balancing and SD-WAN activity.

From a security perspective, forward-thinking CISOs are now on to phase 2 focused on situational awareness and risk assessment.  This is directly related to the fact that a lot of LAN traffic has been rerouted to WANs and internet connections.  The goal?  Scope out the new realities of usage patterns and the attack surface.

In about 4 weeks, organizations will have visibility and enough historical data to proceed to phase 3, a full risk assessment and a board-level report.  These reports will examine the WFH infrastructure, new traffic patterns, perceived vulnerabilities, rising threats, etc.  They will also dig into a more thorough look at emerging WFH issues like insider threats, expansive privileges, data security exposures, insecure cloud application configurations, and others.  The goal?  Quantify risk and then work with executives to prioritize actions.

This leads to phase 4, which is all about risk mitigation.  Based upon my conversations, the goal is to address this by mid-May at the latest.  During the risk mitigation phase, organizations will likely employ controls for data privacy/security, least privilege to networks and applications, and segment home network traffic to protect WFH assets from gaming systems, smart refrigerators, security cameras and the like.  We’ll see more deployment of technologies like multi-factor authentication (MFA), zero trust networking tools, privileged account management, and DLP/eRM at that point.  Process automation will also be added during this period. 

At the end of phase 4, WFH should be set up for threat prevention, detection and response — at scale.

A few final things I’ve heard:

  1. While the four phases are a general project plan, CISOs are also busy patching tactical holes like blocking Zoom bombing by using meeting IDs and issuing passwords. Issues like this come up daily.
  2. Another thing I’m hearing about is securing “shotgun” applications, developed and deployed quickly to support remote workers, business partners and customers.
  3. Security will continue to play catch up with IT leading to network performance and service availability. User support and productivity is paramount while security remains behind the scenes.
  4. The need for speed is causing CISOs to have a “SaaS first” mentality.
  5. CISOs are taking a long-term approach since no one can tell how long the lockdown will last. Many also feel like this is a game-changer for the future of IT and security.