Six Ways of Safeguarding Employee Workstations
Until recently, hybrid work was promoted as the future. However, it has swiftly been welcomed by corporations and their employees who want and expect more.
Updated
On this page
Key takeaways
- However, it has swiftly been welcomed by corporations and their employees who want and expect more freedom post-Covid.
- It significantly reduces an adversary’s reach while mitigating the consequences of unintended (but unavoidable) employee blunders, such as clicking on a phishing link.
- Organizations that want to prevent this and boost their security against destructive attacks must act quickly to safeguard endpoints.
Until recently, hybrid work was promoted as the future. However, it has swiftly been welcomed by corporations and their employees who want and expect more freedom post-Covid. Organizations all around the world are fast embracing this hybrid workforce model, which places employee workstations at the edge, far beyond the typical corporate network’s “walls.”
Recent engagements with nearly all IT firms reflect this reality: workstations are now one of the easiest methods for attackers to compromise identities, conduct ransomware attacks, abuse privileged credentials, and begin advancing toward critical IT systems and exfiltrate private data. This is a dangerous condition for enterprises to be in, and typically, by the time incident response professionals are brought in during an endpoint assault, the environment has already been overrun by threat actors.
Threats to Employee Workstations #
A recent ESET survey found that 80 percent of global firms think home-working employees have the ability and technology to cope with caber risks. When individuals work from two different locations, typically using two different sets of work devices, the attack surface nearly doubles for attackers. Here are some of the most pressing security issues in this job method. Some examples are as follows:
Unprotected Home Networks #
Most employees are unaware of network security beyond the knowledge that they should password-protect their personal Wi-Fi network. They have no notion of how strong a password should be or what Wi-Fi security standards exist.
Work Devices Stolen or Lost #
In a hybrid work model, computers are really transportable, and an office setting is significantly more physically secure than the ordinary household. Expensive business computers are a lure for thieves. Work equipment may also go lost at airports and other public locations.
Phishing Attacks on Specific Individuals #
Employees that operate a hybrid work paradigm that combines office, home, and other distant locations are frequently distracted, something phishers are aware of. They also understand that remote employees cannot just consult a teammate for a second opinion on an odd email message, which encourages them to conduct more targeted phishing attacks.
Lackluster Patching #
Unmatched devices pose a substantial cybersecurity risk since they are susceptible to well-known flaws that fraudsters are ready to exploit. Furthermore, unlike IT professionals, workers typically underestimate the need for patching or actively ignore available fixes because they do not want to restart their devices.
Shadow IT Proliferation #
Shadow IT is the use of information technology services, systems, software, devices, and applications without the permission of the IT department. By allowing employees to customize their assignment environment, the hybrid work paradigm provides an excellent breeding ground for shadow IT.
Best Practices to Prevent it and Safeguard Them #
Remove local admit privileges. Administrator accounts in Microsoft Windows, macOS, and Linux are used to install and update workstation software, modify system settings, and manage user accounts. Attackers target privileged accounts in order to deactivate antivirus software or disaster recovery tools, as well as to launch ransomware and other sorts of malicious malware. The quickest and easiest step in hardening staff workstations is to move local admit powers away from normal users and into a secure digital vault with credential rotation. It significantly reduces an adversary’s reach while mitigating the consequences of unintended (but unavoidable) employee blunders, such as clicking on a phishing link.
Require the least amount of privilege. Employees frequently have a justifiable need to complete an administratively required task. Just-in-time privileged access allows employees to do certain actions based on policy at the appropriate time and for the right reason – without needing end-user action or help-desk involvement, which may stymie productivity.
Institute application control policies. Endpoint protection against ransomware and other threats involves more than simply the ability to allowlist and denylist recognized programs. Organizations must be able to
- Mitigate ransomware threats by using “greylist” programs, such as sandboxing an unknown application and enabling it to execute but not connect to the internet.
- Implement complex conditional policies so that employees may securely utilize trusted apes. Allow Excel to continue but prevent it from running PowerShell to protect against the BazarBackdoor malware.
- Create extensive rules that cover single executable (for example, by looking at a hash, file name, or file path) as well as groups of executable (i.e., default-allowing applications that are signed by a particular vendor have a pre-defined product name associated with them and originate from a designated trusted updater source).
Keep cached credentials secure. Credential theft is the number one risk for businesses today. Many major business apes support storing credentials in memory, and many web browsers and password managers locally cache application and website credentials. Once signed in with these stolen credentials, attackers may attempt to bypass single sign-on (SSO) systems. Because threat actors may frequently acquire cached credentials without requiring administrative rights, the ability to automatically identify and reject credential harvesting attempts is a critical endpoint security layer.
Set up traps. Endpoint protection technologies that provide privilege deception capability, such as establishing false “honeypot” privileged accounts, can assist in warning would-be attackers immediately away.
Keep tabs on privileged actions. Attackers frequently operate behind the radar, testing defenses and plotting their next steps. Organizations may automatically identify and stop adversaries before they can move laterally, increase privileges, and inflict major harm by proactively monitoring privileged workstation behavior. Complete logs of privileged workstation activity are also essential for easing compliance audits and expediting forensics investigations.
End Note #
Organizations must go above and beyond to embrace a hybrid work model and lifestyle to remind workers of their security responsibilities. This should ideally include security awareness training and responsibility, highlighting the possible risks of working from home and the differences between productive remote and office work habits.
Unfortunately, poorly protected staff workstations are the ideal target for attackers to exploit, and they frequently become exactly that. Organizations that want to prevent this and boost their security against destructive attacks must act quickly to safeguard endpoints.
This is where the previously mentioned protections come into play, and by following the main mitigation stages and implementing a tiered defense-in-depth approach, organizations may better identify attacker behavior, mitigate the damage of a breach, and restore control of their environments.
Related reading