It feels nearly unbelievable that after over a yr of getting to make money working from home, we now have lastly reached a stage when, because of the rising vaccination charges and different efforts by governments, life appears to be returning to nearly regular. Alas, for many individuals this not solely means a possibility to go to a theatre or a pub after a protracted break, but additionally the looming prospect of returning to their places of work.
Again in early 2020, once we first confronted nationwide lockdowns, IT employees discovered themselves combating for the survival of their companies as a result of only a few corporations have been ready to help a completely distant workforce. Luckily, most have been capable of adapt throughout the first months of the pandemic. For some companies, Covid was the decisive argument to lastly embrace the cloud. For others, digital companies have even develop into the brand new product. These have been really “fascinating occasions”.
Let’s face it: workplace work is not regular
Quick ahead to June 2021 and evidently many IT employees – particularly these liable for safety – are wanting ahead to the approaching finish of lockdowns as some sort of return to normalcy, going again to the “good previous occasions”. In actuality, this could be the largest mistake a CISO could make! Even as soon as everyone seems to be absolutely vaccinated and the remaining restrictions are lifted, the brand new “regular” might be nothing like pre-Covid occasions.
First, many individuals like working from residence. Some are critically planning to proceed, and are even ready to take a pay reduce or transfer to a special firm to take action. Many companies have additionally appreciated the price and time financial savings, to say nothing concerning the profound environmental influence of distant working.
Ultimately, many corporations must redesign their workplace areas to place extra emphasis on shared workplaces and hotdesking, in addition to to cater to the sharp enhance in teleconferencing and distant collaboration, even in places of work.
For folks in IT and cyber safety, this implies there may be merely no going again to the previous idea of perimeter safety. Even probably the most conservative corporations that have been nonetheless clinging to their firewalls, VPNs and on-premise functions needed to lastly make a leap of religion and undertake fashionable, cloud-native alternate options to accommodate their distant employees and to make sure their security and compliance outdoors of the standard company perimeter.
These days, the native space community (LAN) is the least protected a part of the company community, and returning workplace employees will solely make the scenario worse. Masks and exams might assist shield towards Covid within the office, however what’s going to assist towards ransomware and phishing assaults?
Zero belief: not a buzzword anymore, however a strategic objective
Does it imply, nevertheless, that we now have to put money into extra safety instruments to guard our places of work from the sudden influx of recent exterior and inner risk actors? Properly, sure and no.
The most important enemy of safety is complexity, and including safety controls particularly for workplace employees is a waste of time and cash. A extra wise technique is to make sure that the identical safety stack can shield any employee, inside and outdoors of the workplace, together with staff working from residence, cellular employees, contractors and different companions.
In sensible phrases, this implies extending the definition of a distant employee to everybody throughout the organisation. Anybody ought to be capable to expertise the identical stage of productiveness and safety from cyber threats inside or outdoors of the workplace, transferring seamlessly between IT environments like cell phones between cell towers. Evidently, probably the most radical technique of reaching this seamless behaviour is by eliminating the very notion of an area community – the one and solely holy grail of zero belief!
This buzzword has been a preferred matter for dialogue amongst IT specialists for years, typically resulting in a lot confusion amongst folks pondering they’ll buy zero-trust networks as turnkey options. Nevertheless, whereas that is undoubtedly not the case, adopting a zero-trust safety mannequin is simpler than many individuals consider, offering they’ve a correct long-term technique.
Along with deploying varied applied sciences – which many corporations may have already got finished exactly due to Covid – it would require corporations to revamp some organisational ideas or enterprise processes as nicely. However the outcome will all the time result in the general simplification and unification of IT infrastructures, diminished prices and administration overheads, and, hopefully, elevated worker productiveness and satisfaction.
It’s time to retire the LAN
Step one on this strategic journey in the direction of zero belief may be fairly easy: simply fake that your workplace not has an area space community. Even when a employee is again at their previous desk, deal with their units as if they have been nonetheless working from residence – for instance, solely allow them to hook up with the visitor Wi-Fi community.
In fact, when you have been counting on old-school VPN options for all these months, this may trigger issues, however for those who’re already utilizing a cloud-based zero-trust community entry (ZTNA) platform to supply safe connectivity to your company functions, it ought to work fully transparently – in or out of the workplace. As an additional benefit, this strategy will shield your legacy LAN from lateral actions of a possible malicious actor, exterior or inner.
The identical applies to safe entry service edge (SASE) options that ship safety capabilities instantly from the cloud – even when they can’t but absolutely substitute your fastidiously configured stack of on-premise safety home equipment, they’ll in all probability present 80% of safety for simply 20% of the price, within the workplace, at residence or wherever in between.
If there may be any silver lining behind the entire Covid catastrophe, it’s that every one these cloud-based options have been completely battle-tested and might accommodate the necessities of even the biggest companies.
The world has modified profoundly over the previous 15 months, and there might be no return to pre-Covid occasions any time quickly. As an alternative of lamenting the loss, nevertheless, we must always embrace the brand new regular, proceed adopting fashionable safety applied sciences, and use this distinctive alternative to eliminate the massive technical debt of our legacy IT infrastructures. If finished strategically, it ought to be a win-win scenario for everybody. Properly, excluding hackers, maybe.
Alexei Balaganski is lead analyst at KuppingerCole and a specialist in synthetic intelligence and cyber safety. At KuppingerCole, he covers a broad vary of cyber matters together with database, utility and API safety, safety analytics, date safety, and AI-based safety automation. He holds a grasp’s diploma in utilized arithmetic and pc science, and in addition beforehand served as KuppingerCole’s chief know-how officer.