Video: 10 Minute IT Jams - Bitglass director on the evolution of remote working risks

Remote working brings new dangers. As millions of employees continue to log in from kitchens, spare bedrooms and coffee shops, companies are fast realising that their traditional security models are no longer enough.

Jonathan Anderson, Senior Director of Marketing at Bitclass, joined the '10 Minute IT Jams' podcast to explain why businesses must rethink security in a world where hybrid and remote workforces are the norm rather than the exception.

"The first thing to know about remote workers is that they're no longer behind the enterprise data boundary and the firewall," Anderson explained. "They don't have the protection of our traditional layered security that we have in our data centre or perhaps in our branch office."

As a result, Anderson said, companies must rely on each worker's individual device—be it a company laptop or a personal phone—for frontline defence. It's a risky proposition. "Remote workers are more at risk because typically they're less protected," he said. "They're at risk of malware attacks. If they've got personal devices, they're probably looking at personal stuff at the same time, which can cause a problem for business data."

This vulnerability has not gone unnoticed. "Cybercrime knows that people are working remotely and position some of their attacks to target that particular vector," Anderson added.

The rapid rise in remote working has led to the popularisation of a new security framework: Secure Access Service Edge, or SASE. Anderson broke down its three core components: protecting access to cloud data, ensuring robust web security, and enabling secure connections back to workplace applications that remain on-premises.

Protecting cloud data is increasingly important. "So much of our traffic is cloud to cloud or uploaded and created in the cloud," Anderson said. A Cloud Access Security Broker (CASB), a key part of SASE, "provides visibility into your data going into the cloud, being downloaded from the cloud and created in the cloud."

The second major pillar is web security, which has evolved from physical appliances to software-based services. "In today's world, we're used to software as a service models. We can provide web security in a SASE context much more efficiently and effectively, on the endpoint or at the edge," Anderson said.

The third SASE component is Zero Trust Network Access (ZTNA), which replaces traditional VPNs for connecting to company resources. "VPNs don't provide the security we need, they just provide an encrypted tunnel. ZTNA gives us the data protection and the threat protection combined with contextual access, so we only get access to the things we need, and more securely," Anderson explained.

The humble VPN, despite its decades-long reign, simply cannot keep up with the demands of modern hybrid workplaces. "We relied on VPNs when maybe 5 or 10 or 15 percent of our workforce was remote," Anderson said. "But now with like 80, 90 percent of people working remotely, it just doesn't scale." Not only do VPNs suffer from "configuration challenges and the performance issues of having to tunnel all the way into the data centre," he said, but many users also find them clunky and inconvenient.

More seriously, VPNs are not tailored to how data flows today. "They don't provide the security we need for today's cloud data or even data in general. In today's world, data once it leaves the enterprise is gone forever. It can be a very big problem," Anderson said.

SASE, Anderson argued, offers a better solution. For hybrid workers, SASE means they can be "secure and productive at the same time." The main use cases include stopping cyber threats like phishing, managing and preventing data leakage, and providing secure access to private applications in both data centres and the public cloud. "Very important to have a layer of security for those workers because these applications are not built for security, they're built for productivity—and we need to make sure that they're configured correctly, there's nothing left open that cybercrime can leverage to get your data," Anderson said.

Importantly, as employees increasingly use multiple devices—often a mix of corporate and personal—companies need security policies that reflect this. "No matter whether the user is using a managed device or their own personal device, we want to provide protection for your enterprise data. Policies may be different—I may not get access to everything on my personal device, I may be read-only for some applications—but no matter where the user is, we need security across all devices, all applications."

But as companies rush to deploy the newest security tools, Anderson emphasised the need to strike the right balance between robust protection and employee acceptance. "I've seen companies deploy security solutions that look, on the surface, to be secure—but users resist them or they slow down the business," he explained. "If you put security agents everywhere, that can be a problem. You'll very rarely get a 100 percent take up on all your devices."

The key, he suggested, is to use security agents only "when absolutely necessary"—for example, only when accessing certain protocols or managed devices. "People want to do their work how they want to do it. They want to work remotely on multiple types of devices. They don't want security to slow things down—and if you slow things down, users will typically find a way to go around it and then you've got other security issues," Anderson said.

Scalability and reliability are the final pieces of the puzzle. With the remote work model here to stay, Anderson urged IT teams to focus on solutions "that scale up in the public cloud." He advised: "Ask your vendor how many outages they've had, because if you've had an outage your security totally is exposed. We want to minimise outages. We can do that by being on the public cloud and having a polyscale architecture."

In the end, the goal for any company should be to provide "not just security for your hybrid workers but to create a workplace that is fundamentally very productive, where you could use the latest applications, the latest devices and really get your job done quickly while being secure," Anderson concluded.