How to ensure IT security in times of permanent remote work?

Remote work during a pandemic is a huge challenge from a security perspective. Each of us should protect sensitive data, video conferencing and files shared with other users. Responsibility also lies with the company's network administrators, who should not only use the latest technologies, but also educate users.

IT permeates virtually every element of our lives today. Now even more than before. Therefore, we can see the need to train digital competences and pay more attention to online security.

What will happen if we order thousands of unskilled people to use teleconferencing software? We did this simulation at the beginning of the quarantine period, when teachers were to teach remotely. In some cases it did not end well. The lack of securing meetings meant that unauthorized persons could enter them. Ba, even exchanges with links to unsecured meetings were created, where online trolls were organized. Even the CCC conference was a victim. The presentation of the board of the Polish company unexpectedly proceeded on a public channel. Of course, without the knowledge of those involved, which could cause image losses.

That is why it is crucial to know the safeguards we can use in teleconferences so as not to fall prey to the so-called boombingu.

Let's look at the security of the Webex Meetings application.

I have looked at the possibilities of the Cisco ecosystem before, now it's time to look at security.

Meetings at Webex can be based on rooms created for specific meetings or the so-called each user's private rooms, which can be started at any time. You can customize their name, link and PIN. The latter seems crucial, because even if the attacker gets to know our link, he will probably not be able to guess the password, if we take appropriate precautions.

You can also automatically close the meeting 5, 10 or 15 minutes after it starts. Then we will be sure that inappropriate people will not interrupt our conversation. Guests can be verified in the lobby and only allowed invited people.

We can also set up a notification in case we forget we have an appointment. We will then receive an email that someone is waiting for us. If it is an appointment, the application running in the background will display a notification of an upcoming conversation.

Finally, we can also choose the hosts of our room during our absence. In a business environment, these may be our colleagues who will take over command in case of our connectivity problems, and in the case of teaching, e.g. a class host who will take care of order when the teacher will have to leave the desk for a while.

In addition, we can also connect Webex with Google or Microsoft accounts, thanks to which we will be able to directly integrate the invitation, e.g. with our Outlook. Then the invitation will be in the footer of the email. By default it will also contain a password, but we can turn it off in the settings and then send the password by another e-mail or text message.

Controlling the list of participants during a meeting

Appropriate management of participants during the meeting is very important. First of all, we can mute participants or even beg in an extreme situation. In a typical office meeting everyone has the opportunity to present, but in school situations, for example, the teacher may want to have sole control over the presented material and block the ability to share the screen. Much more moderation tools. It is the meeting host who decides what permissions to give meeting participants.

It's good to share only the right screen elements. To do this, it's better to choose to share a single application instead of the entire screen. We can easily imagine a situation in which we accidentally minimize the browser window or presentation and inadvertently share the view of our mailbox. Everyone would rather avoid it.

A good label also includes the use of the Focus Assist function built into Windows. It allows you to turn off all notifications that appear on the screen, so that no one will see new messages in messengers or incoming emails.

How to take care of security in the company without losing flexibility?

Challenges will accumulate if we move the question about security to the level of the entire company working remotely. In the office, companies carefully protect their internal networks, devices and resources. Tele-work introduces another level of complexity.

So what can a company do to make sure its employees are protected? The first element is encryption. If we used the unencrypted video-conferencing service, then our conversation would be susceptible to man in the middle attack , i.e. eavesdropping on our communication. With end-to-end encryption, this is not possible. A similar care should also be given to stored files or recordings, which in the case of Webex happens automatically.

Secondly, you need to properly implement DNS protection. In short, it is one of the cornerstones of today's internet that translates browsers to the names of domain addresses into the IP addresses of destination servers. That is why it is often a vector of hacker attacks - in as many as 9 out of 10 cases. Meanwhile, properly configured protection will filter all unsafe queries to and from the network, ensuring security to end users.

Firewalls and tunnels

Filtering internet traffic is another foundation of protection. Such a firewall would only pass secure queries and stop others, so that computers and the data on them would not be vulnerable to attack. A firewall can come in two variants: hardware or virtualized, when it can be installed on a server with specific hardware parameters.

Another type of security is to create a virtual private network, i.e. simply a VPN. The intra-company infrastructure can be configured in such a way that employees must first connect to it from the home network in order to be able to use shared files in the next step.

Take care of verification.

Finally, two absolutely basic elements: two-factor authentication (2FA) and password protection. Both allow us to avoid hacking your account. In the case of 2FA, we must always confirm our identity using an additional tool, e.g. phone applications or tokens. If they don't fall from the hands of burglars, we can sleep peacefully.

If we are with the slogans, then ... people are usually weak in this matter. We provide easy to predict and uncomplicated passwords, so it is much better to use a program that will not only generate but also store all necessary passwords. Then it will be much more difficult to crack, and in addition we will be sure that each website uses its own original and complicated password. We must remember one password - the program itself.

Start with education

Regardless of the security measures used, the first step in companies should be education, because it is people who are the weakest link in any IT system. Machines are predictable when it comes to making mistakes - people are not. That is why social engineering attacks are so popular, e.g. when an attacker tries to impersonate our colleague and asks for sensitive information to be sent. The message can get into the corporate e-mail - and that the amount of digital communication increases rapidly with telecommuting - our attention can be greatly distracted. In such a situation, it is easy to downplay the threat. Let's not be afraid to call the other party for clarification. Let's be especially suspicious of e-mails with links. If the link to the alleged document does not point to a corporate resource, it is better to ignore it. Developing the right culture for reporting scams is an important challenge for coronavirus.

All of the above hardware and software protections are included in Cisco's offer. The fact that they come from one producer additionally supports their cohesion and better interaction within a single ecosystem. Such an ecosystem is worth adding support from the Warsaw company Atende, which deals with Webex on a daily basis and helps to increase user security.

* The entry partners are Atende and Cisco.

How to ensure IT security in times of permanent remote work?