Magazine menu Close Magazine menu

endpoint security

Latest stories

security home working

Securing home workers isn’t just about technology. It’s about business culture.

  • min read
    • In recent years we've become accustomed to hearing how new technology is changing how people think and interact. But throughout most of history, it's been more a case of needs must – we've created technology to overcome challenges our environment has thrown us. The technology that lets us work from home is good for more than carrying on business in a crisis. Employees escape cramped cubicles and noisy open offices. They cut hours (and pollution) from their daily commute. We work at times that suit us, in a place we're most comfortable, closer to loved ones. Businesses can tap into talent around the world and reduce the cost of assets and buildings. They also benefit from home-based employees being more productive, engaged and loyal. Change your culture as well as devices There's more to enabling working from home than giving employees a laptop and corporate smartphone or introducing a bring-your-own-device (BYOD) policy. It's a culture change. Business executives must lead by example and administrators must find ways to stay in control of digital assets. Charl Ueckermann, CEO of Kaspersky's Africa Partner of the Year 2020, AVeS Cyber Security says: "You want the best of both worlds: minimize business disruption and open opportunities to create new business models." Business leaders may fear losing control. Taking devices outside company buildings expands attack surfaces substantially, giving cybercriminals many new opportunities to exploit your most valuable asset – data. And when people connect to company resources over unsecured home networks, the risk multiplies. Ueckermann goes on to say: "You have to get the core things right to keep the lights on. Leadership will play a crucial role in setting the organization's cultural tone. "A new talent pool becomes available if your business is set up for teams who can work from anywhere, at any time. Highly-skilled people who were previously limited by family responsibilities or geographic location now become potential candidates to recruit." We're guilty of appalling security habits Principal Security Researcher at Kaspersky, David Emm, says: "Our ability to communicate, work and transact online has never been more critical. We also have to face the reality that where people go, cybercriminals follow. If there is an opportunity to exploit a situation and lure people into disclosing personal data or sending money, you can guarantee cybercriminals will be working on it." With the number of Internet of Things-connected devices at 3.5 for every person on Earth and growing exponentially, information security must be scalable, multilayered and centrally managed. Let's face it: Many of us are guilty of some appalling mobile security habits. Despite using our smartphones for everything from business email to personal banking, over a quarter of us don't even lock our smartphone screens. When you consider how often these devices are lost or stolen, it's a big problem. Losing the device is nothing compared to hackers or other unauthorized third parties having access to every connected account and file on the device. Here's three ways you can help your home and remote workers to work more safely. 1.  Start by laying down the ground rules Check and update your cybersecurity policy so it fits the current situation for remote work. It should say clearly which devices and apps employees may use, which security measures they must adopt and how they can share corporate data. For example, you probably won't want remote-working employees accessing your data from a jailbroken iPhone or an ancient laptop with a long-obsolete operating system. Having employees well-versed in policy is essential, but we all make mistakes. Remote workers shouldn't be living in constant fear of opening the door to cybercriminals. Focus on cyber-awareness training so homeworking employees understand their responsibilities to protect corporate data and what risks they may be exposed to from social engineering. Kaspersky's David Emm's warns that, "Staff should be especially wary of messages that claim to give important information about current events, as cybercriminals are known to use this tactic." 2.  Secure employee devices To protect your corporate data, give your employees, and contractors who can access your network, the tools and hardware they need to work safely at home with easy access to IT support teams for troubleshooting. IT administrators must maintain visibility of their digital assets across an expanding array of devices and operating systems. Mobile device management (MDM) technology should accompany your cybersecurity policy to help enforce the rules. It lets administrators monitor, manage and secure devices used for work, and grant or revoke access rights. If a device is reported lost or stolen, they can remotely wipe it and revoke access rights to any online accounts from that device. Device encryption is also a no-brainer; it's vital to prevent data being compromised if the device falls into the wrong hands. 3.  Level up your data protection 90 percent of cyberattacks include social engineering, exploiting human foibles rather than technological weaknesses. It's often dead easy for scammers to dupe victims into giving away confidential information over unsecured channels by impersonating a colleague, client or business partner. If an employee gets an email masquerading as a technical support agent from a known service provider asking for remote access, there's a good chance they'll fall for it.  They can then gain access to confidential data if it isn't secured. According to Kaspersky's 2019 research about digital clutter, 72 percent of employees store documents at work that contain personally identifiable information or sensitive data. From this, the attacker can gain access to the entire business network from compromising that one employee-owned laptop. As well as educating your employees, keep all devices updated with latest versions of endpoint security. Automate measures for better data protection, like password protection and data backups. David Emm also advises to "make sure operating systems and apps are always updated. Provide a virtual private network (VPN) staff must use to connect securely to the corporate network and restrict their access rights once connected. They should protect corporate devices, including mobile devices, with security software that allows remote wiping of data from devices reported lost or stolen, segregates personal and work data and restricts app installation." Cloud-managed security can drive innovation Working away from the office is critical to be able to innovate. With business apps and data hosted in the cloud, IT administrators can enjoy centralized management by maintaining full visibility of their digital assets. Instant protection comes with reduced reliance on endpoint security since all confidential data is kept in a secure data center rather than on local devices. Business leaders no longer have to depend on their policies and device-level endpoint security – though this is still essential. They can instead build a centrally managed, software-defined computing environment where adding new users means simply creating an account, then letting the remote-working employee access everything they need through the web. This approach is not only better for information security; it reduces the need for remote workers to exchange files over email or unsecured file-sharing services. Make sure your cloud set-up is configured with the relevant level of cybersecurity protection for your company's data needs, don't expect this to be installed or run by the cloud provider. Work anywhere, secure everywhere Remote working shouldn't be a source of fear. It's not about losing control. It's about decentralizing your workforce and letting them work in new ways. In the long term, it delivers enormous value for the whole business. Today's security solutions let you control the security and compliance of your digital assets. No matter where your workers are, you can keep your corporate data safe.
cybersecurity for MSP

What SMBs want: How to implement cybersecurity to suit a company’s needs

  • min read
    • It looks so good on the rack, but when you try it on – ouch! The style, color and fabric are fine, but when it comes to the fit, it feels like it was made for the wrong body. Overlong sleeves that flap about, narrow shoulders so you can't twist, and the waist in the wrong place. In the business world, this happens when a company occupies an office space that doesn't match its size or needs. It may be too small or too large, lack meeting rooms or not even have restrooms for night shift personnel. The business may have to pay for a car park that's too big, or there's not enough network capacity for business tasks. In the same breath, a company can feel this way about how it approaches cybersecurity. It may struggle to recognize what's needed to keep the business secure and be using a service or solution that isn't fit for purpose. In this scenario, it's paramount that security service providers understand and respond to specific business demands when offering protection to their customers. What level of protection works best? With small companies, made up of several dozen employees, and larger businesses both having similar core cybersecurity functions, it's possible to become confused about what level of protection would work best. The only way to understand a company's cybersecurity needs, when the company itself is unclear about what it wants, is to evaluate how the business works and the maturity of its IT. This helps identity the specific tools and level of customization that would suit them best. Imagine a small company that makes and sells its own brand of clothes locally and has an office of 50 people. The business is rapidly growing: over the past two years, the number of employees has nearly doubled. Several people are responsible for the purchase of fabrics, as well as sales of ready-made clothes to stores, but they're almost never in the office as they work remotely or at different sites. In such a company, IT is often outsourced to an external IT administrator remotely providing IT and cybersecurity system maintenance. Along with the installation of office applications and the purchase of corporate PCs, it manages protection by installing a security solution to new devices, checking for program updates and ensuring that protection is always active. The company doesn't need in-depth incident analysis and tuning of user access rights for different services. Its infrastructure may include one server rack or even no on-premises servers at all, with everything stored in the cloud. And there's plenty more reasons for clients to move their IT delivery to managed services providers (MSPs):  according to Forrester, 28 percent of companies with 100 or more employees that purchased SaaS (software-as-a-service) from an MSP indicate "customer service, support, and experience" was a top purchase driver for choosing this option (source: Forrester Analytics, Global Business Technographics® Security Survey, 2019). Finding the right fit This local clothing brand could be any other kind of small- to medium-sized business: an advertising agency, a consulting firm or a small publishing house. Regardless of what they do, the approach is the same: to manage cybersecurity in such companies, service providers need to offer an inexpensive, compact solution from the cloud which requires minimum resources for installation and management, but at the same time provides protection across all devices – from office desktops to mobile phones and tablets of remote-working employees. Let's examine what a larger firm, with a well-established IT infrastructure, expects and needs from cybersecurity. For example, an online retailer stores and processes a large amount of sensitive data, and uses a variety of CRM, ERP and customer service systems. For servicing such a complex environment there should be an internal IT department and a dedicated cybersecurity administrator, or an entire team – either internal or from a service provider – to protect it. In such organizations, the attack surface is much wider. They use more applications than smaller businesses, increasing the likelihood that they will become vulnerable, as well as more devices that could be compromised by malicious software infecting the network. Working with many contractors and partners also increases the infrastructure's vulnerability to supply chain attacks. The task of a cybersecurity manager, whether it's an internal specialist or service provider, is to enable protection against malware on each device. They must also configure it in a way that ensures all employees have access to necessary services, depending on their role. Finally, administrators need detailed reports on the state of the system and, in the event of an incident, they should be able to quickly detect it, analyze and respond to it. What are the risks of data breaches? Any downtime caused by an incident or data breach can cost a company money, customer loyalty and reputation. Medium-sized companies are at risk of losing up to $US 120,000 as a result of a data breach, a big part of which will go towards resolving reputational damage, as well as paying compensation and fines. While 100 percent protection against cyber-incidents cannot be guaranteed by any information security company, the use of specialist protective tools can minimize the damage and consequences of an incident. We can safely assume a small business is unlikely to be overpaying for a more expensive security service. But a large company seeking to save money and using a product which doesn't meet its needs will quickly realize the error of its ways. To make the right service choice for their customers, providers need to look at the maturity of clients' cybersecurity function, which commonly correlates with the size and maturity of the entire business. Weodeo it our way We talked about it with one managed service company from France — Weodeo. Its owner, Philippe Aymonod, said: "Smaller businesses are aware of the importance of IT security, and they face many of the same cyberthreats as large enterprises. But they don't have the same resources to deal with them. Consequently, they expect their partner to act as a security advisor that will be able to offer them simple and efficient security, with no impact on their productivity." "We evaluate our customers' protection level according to several parameters: the company's awareness level regarding security and the threat landscape; the customers' infrastructure complexity; any specificity related to their business, equipment and potential upcoming strategy adjustments." It's equally important that service providers identify their own goals and resources, such as infrastructure, human resources and technical skills. For example, if providers work only with cloud services ('born in the cloud' MSPs) or look to speed up deployment to new customers and  easily manage all clients through a single console, they'll work best with cybersecurity delivered as a service that can be overseen through a cloud-hosted console. On the flip side, providers who have developed their own infrastructure can choose an on-premises managed solution and focus on customers who have more mature IT infrastructures and demand more granular protection. It's a good opportunity to provide flexible services for more demanding customers, maintain service level agreements (SLAs) and be an expert in the eyes of the customer. In this case, the service company also needs to have appropriate talent in the team to manage advanced protection. Which approach is best? There are advantages to both approaches. Providers delivering cloud security can focus on wider cloud services and extend their portfolio to include SMBs who are consuming SaaS services at a growing rate. MSPs working with medium-sized businesses and have their own infrastructure can use their resources to develop advanced and scaled security services. While you could say that any kind of cybersecurity protection is better than nothing, if it doesn't meet the company's needs, surely it makes sense to change to a solution that's a custom fit?

Migrating to TLS 1.3: What are the cybersecurity challenges?

  • min read
    • Most of the things we do on the internet – buying things, transferring to a supplier, or sending a confidential email – rely on transferring data securely. For all of this, we rely on Transport Layer Security (TLS), the protocol that enables the security and privacy of online transactions through encryption. In August 2018, the most recent version, TLS 1.3, was approved as a standard by the Internet Engineering Task Force – an international community working on the evolution of the internet's architecture. The adoption has so far been swift. An Enterprise Management Associates survey found that, as of the end of 2018, the majority (73 percent) of enterprises are either already working on enabling the updated protocol for inbound connections, or are planning to do so. TLS 1.3 was introduced to solve some of the issues seen in the previous version; it's designed to bring better performance, privacy and security for internet users. However, there's a fear that the new protocol may have an impact on being able to effectively monitor your organization's networks. Network-based protection before TLS 1.3 Your company's network probably includes many different devices like laptops, servers and mobile devices. Each device needs its own endpoint protection. But to protect the entire infrastructure, you need to implement network security solutions at the perimeter. These can be next-generation firewalls or intrusion prevention systems, through to data-leak prevention and deep-packet inspection systems. These solutions often rely on a man-in-the-middle (MITM) approach. Here's how it works: a network security device – known as a middlebox – acts as an intermediary. It intercepts a request sent from an endpoint, understands what a destination resource is and connects to it. By analyzing the server certificate, the middlebox understands if the resource is legitimate or not. After that, it creates another certificate to communicate back to the client. Once it has both certificates, it then decrypts the previously encrypted traffic to analyze it. To send data back to the server, it encrypts it again to maintain privacy. This process allows the solutions at the perimeter to control what's happening over the network and prevent malware downloading or detect intrusions, and – crucially - avoid data leaks. How TLS 1.3 'breaks' network security TLS 1.3 provides improved security by removing legacy features and delivering stronger standards for encryption. But these new features create other risks. For example, it prevents MITM-type attacks when a malefactor intercepts a message, but this makes it impossible for organizations to look into the traffic flowing in and out of the middlebox. TLS 1.3 encrypts certain values which were sent in unencrypted clear text previously, including messages to establish a connection between the server and client. Most importantly, encryption also touches the certificate message. As a result, middleboxes can't see the server certificate to understand where the endpoint is trying to connect to and can't decrypt all the data. Another issue is eliminating the static key which allows the middlebox to decrypt data. Under TLS 1.3, it's replaced with a new mechanism of exchanging unique keys for each session established between the endpoint and server. This means that the network security tool can't decrypt and control the traffic. So will all middlebox devices become bricks? Not just yet. They can still analyze metadata – such as packet size or ports that initiate the communication – which could be indirect indicators of malicious actions, but TLS 1.3 will significantly impact their visibility over the network. How to get ready for the shift to TLS 1.3 TLS 1.3 is a big step forward. Vulnerabilities in outdated ciphers, which could otherwise be leveraged by cybercriminals, will be removed. Latency will be reduced, making online communications faster and more secure. TLS 1.3 is already gaining traction, so enterprises need to act now to adapt to the upcoming changes. There's no silver bullet to replace network monitoring. You need to rethink your enterprise's approach to protection and focus on areas you may not have paid much attention to before. Here's what you should do now to protect your business. As it's harder to decrypt network traffic, focus more on endpoint-level security. Endpoints are the most common entry points for intruders. In addition to indispensable Endpoint Protection Platforms, install an Endpoint Detection and Response (EDR) solution to detect and quickly respond to complex incidents. For visibility over your entire IT infrastructure, it's essential to monitor logs from endpoints. To deal with this volume, use a solution that can automatically collect and analyze records. EDR allows endpoint data to be stored centrally and provides access to it, which is useful for the post-mortem after an incident has happened. Invest in your experts But you can't rely on technical security solutions alone, focus on your team too. Since network detection may become weaker with TLS 1.3, focus more on your response capabilities and provide training to your teams. Access to actionable and regularly updated threat intelligence can help teams to analyze incidents more quickly and efficiently. If you lack these specialists internally, it is best to outsource this function. To detect and manage threats effectively, internal security specialists need up-to-date skills and knowledge. Specialist training will help to improve their expertise. Security awareness initiatives teach all employees how to avoid putting the company at risk. This helps to reduce the number of incidents caused by what is often the weakest endpoint of all: human error. TLS 1.3 brings many benefits to end-users and ultimately will help the business too. But you'll need to double-down your efforts on internal cybersecurity to keep your organization safe to fully embrace its benefits.
nothing happens

If we do our job, nothing happens

  • min read
    • There is a line in a 2019 keynote speech by Mikko Hypponen, the CRO of F-Secure that goes something like this: "If we do our job in cybersecurity, then nothing happens." It's so true and made me think of the times when various corporate executives challenge their investments in cybersecurity, wanting to see something tangible. Hypponen made this point by asking the audience to look around at the conference room where these conversations are taking place, asking them if it's cleaned to their satisfaction. If so, perhaps they should fire their cleaning staff, because they're no longer needed. Cleaning up the virtual dirt Now, the difference between your security engineering staff and your cleaners is obvious. You can't see all the virtual dirt and digital clutter that's building up across your network, the cruft of old software that needs updating and polishing, and the garbage that your users download onto their PCs that will leave them susceptible to attack. And that's part of the problem with cybersecurity: most things are invisible to mere mortals, and even specialists can't always agree on the best cyber-hygiene techniques. Most of us have an innate sense that mopping the floor before dusting the shelves above is the wrong way to go about cleaning the room. That's because we all understand (at least on a basic level) how gravity operates. But when it comes to cybersecurity, should we be changing our password regularly (some say yes, some say nay)? Or using complex strings of a certain length (some say 10 digits is fine, others say longer ones are needed)? Be prepared for a breach Hypponen ends his talk by saying that we must assume that we're all targets for someone, whether they're a hacker who's still in high school, or an international spy that's eager to get inside our company's network. He says: I agree completely. We must get better at seeing the virtual dirt on our networks. Building a better or bigger wall won't stop everyone and will just foster a false sense of cyber-immunity. And just because nothing happens, this doesn't mean that cybersecurity folks aren't hard at work. They're the cleaners we don't ever see, unless one day they fail to clean up. This article represents the personal opinion of the author.

Working in the ‘post-email’ era

  • min read
    • It's been more than two decades since Marshall Rose and I wrote our book about internet email. Since then, it's become an almost redundant term: how could you have email without using the internet? For that matter, how can you have a business without any email connection to the outside world? It seems unthinkable today. But for something so essential to our work and lives, email system management today leads to many ironic situations. Today, I want to consider the last ten years or so. I call this decade the 'post-email era' because email has now become the enabling technology for an entire class of applications that weren't previously available, or easily accessible, before. Like Slack, multi-factor authentication logins, universal SMS and the thousands of apps that notify us, if we choose, by email. Ironically, all of this has almost eclipsed the actual use of email itself. While ten years ago we had many of these technologies, now they're in more general use. And by 'post-email' I don't mean that we've stopped using it – quite the contrary. Now it's so embedded in our daily operations that we rarely think about it. It's taken for granted, like the air we breathe (its second irony). Email hosting – the choice is binary When a new business is formed, usually the decision for its email provider comes down to hosting its email on either Google's or Microsoft's servers. That's a big change from ten years ago when cloud-based email was still being debated and (in some cases) feared. Another change is reduced costs. This has made email an affordable commodity: for just a few dollars per month per employee, everyone can have up to 1TB or unlimited storage. It's immense. Remember when the first cloud emailers had 1GB of storage? That seems so quaint – and so limiting – now. For all the talk back then about 'inbox zero' (culling messages from your inbox), we have set the perfect conditions for email hoarders. Another irony. Choose your own email client Apart from all this room to keep our work documents, another major reason for using the cloud is that it frees up the decision as to which email client to run (and to support) for each user. A third reason is that the cloud allows end-users to run multiple email clients, depending on what device they're using and for what task they want to accomplish. Both concepts were pretty radical 20 years ago, and even five years ago they weren't as well accepted as now. Today, many of us spend as much time using email on our phones as our desktops, and use multiple programs for our email without a second thought. Some of us – including myself – have switched to using web-based email almost exclusively. That was almost unthinkable a decade ago. Self-host your email server Why would anyone want to host their own email server anymore? Here's another irony: one reason is privacy. The biggest thing to happen to email in the past ten years was a growing awareness of how exposed our email communications could be. Between Edward Snowden's revelations and Hillary Clinton's server, it's now crystal clear to the world at large that your email could be read by your government. When Marshall Rose developed the early email protocols, he didn't hide this aspect of its operations. It just took the rest of the world many years to catch on. As a result, we now have companies that are deliberating locating in data havens to prevent governments from gaining access to their data streams. Today, a business should ask where its potential messages will be stored, whether they will be encrypted, and who has control over its encryption keys. That certainly wasn't the topic of many IT security conversations – or even decisions about selecting an email provider – ten years ago. One way to take back management over your email is literally to host your own email server so your message traffic is completely under your control. That has been a difficult proposition even for tech-savvy smaller businesses – until now. This is what Helm is trying to do, and they've put together a sexy little server (about the size of a small gingerbread house) which can sit on any internet network anywhere in the world and deliver messages to your inbox. It doesn't take a lot of technical skill to set up (you use a smartphone app), and it will encrypt all your messages end-to-end. Helm doesn't touch them and can't decrypt them either. Because of this, the one caveat is that you can't use a webmail client. That's a big trade-off for many of us who have grown to like webmail. Now users can pick two items: security, privacy or convenience. But not all three. That's the rub. With Helm, you get privacy and security, but not convenience (if you're a webmail user). Another irony: webmail has become so pervasive but you need to go back to running your own server and email desktop clients for totally locked-down security. Strengthen your email encryption Speaking of email encryption, one thing that hasn't changed in the past decade is how it's rarely used. One of the curiosities in the Snowden revelations was how hard he had to work to find a reporter who was adept enough at using PGP (Pretty Good Privacy) to exchange encrypted messages. Encryption is still hard. And while Protonmail, Tutanova and others have come into play, they're still more curiosities than in widespread general use. The rise of spam and phishing Another trend is how spam and phishing have become bigger problems. This is happening as our endpoint security gets better at filtering malware out of our inboxes, so hackers are finding new ways to infiltrate organizations – and they're getting sneakier at doing it. It's something of a contradiction: you'd hope that better spam processing would make us safer, not more at risk. Although the volume of spam mail is reducing, what does get through the net is more harmful to your business. All it takes is just one user on your network who clicks on one wrong attachment and a hacker can gain control over your desktop, and eventually your entire network. Now, that scenario is a common one witnessed in many TV shows and movies, like pop singer Rihanna who played a hacker in Ocean's 8. Not very realistic, but certainly fun to watch. To get better protected, you need to educate your employees to be better aware of the risks. Welcome to the many, many ironies of our 'post-email era'. This article represents the personal opinion of the author.

Flexible working: Why your workforce (and finance director) will love you for it

  • min read
    • No sweaty morning commute. Lunch in the comfort of my home and, most importantly, bucket-loads more work done to a better standard. After swapping full-time for a flexible working arrangement recently, the benefits are clearer to me now more than they've ever been. So I'm celebrating how virtual offices are transforming the way we work for the better. And these amazing people around the world are enjoying the benefits too. First things first: working outside the standard 'nine to five' helps. A lot. Since switching, it's clear to me that my best work as a writer doesn't come within a constrained time frame. I'm free to spend my days doing things I enjoy, then buckle in for an evening of working from my laptop – sometimes at a café. Which brings me to my next personal highlight: no more offices. One previous situation springs to mind, a job I had a few years ago. A packed central city workplace, the humdrum of idle kitchen sounds, the crippling pressure of making small talk in the said kitchen and, for my sins, a bottomless biscuit tin which I spent most of my day slowly devouring. My motivation and productivity were at an all-time low. Now, having the chance to work anywhere, at any time, has given me a new lease of life. And I'm not the only one who feels that way. By having more responsibility in managing our workload, we can all create the best office in the world – and one that's right for you. And this is just the beginning for job flexibility. A recent LinkedIn study concluded that over the last three years, global job postings offering flexible working have increased by 78 percent. Here we go. Let's get flexible Dimension Data's research suggests that globally there will be a 40 percent increase in flexible arrangements over the next two years. Compare that with Forbes' findings on the US flexible-working market (it currently stands at 50 percent), and the Chartered Institute of Personnel Development's estimation that the UK's flexible-working market will reach 70 percent in 2020. We have a trend on our hands. This might sound great from an employee's perspective, but why should employers care? Happier workforce Flexible working will make your employees happier. By giving them an element of freedom over their hours, or where they work from, you're investing in their well-being. And it pays back. Psychologist Shawn Achor's inspiring TED talk explains how happier people are actually more productive. Happiness spreads: they'll have a little extra time they would have spent commuting to do something they love, like walking their children to school, supporting a family member or friend, or just getting some rest. The latter being particularly important for those who work long hours, travel a lot for work or live a long way from their workplace. It also helps those managing health conditions, or just people whose productivity doesn't necessarily flow during conventional working hours. I'm lucky enough to take a few hours out here and there if I'm not feeling 100 percent, which means I can recharge my batteries physically and psychologically. Something that, in today's fast-paced world of work, many don't have the luxury of doing. Increased productivity What happens when you mix flexible working arrangements with a happier workforce? Productivity goes through the roof. Or at least that's what this study from HSBC in the UK showed – indicating 89 percent of those surveyed believe flexible working is key to getting more work done. The amount I can do from home, a café or somewhere else in comparison to what I used to achieve in an office is, quite frankly, frightening. Talent attraction A recent Zenefits survey indicated that in the US, 77 percent of employees consider flexible-work arrangements when weighing up a job offer. Think about it: you're offered two jobs, one with flexible working, one without. Which one are you likely to take? It's a no-brainer, really. This is especially important if your business is looking to hire millennials like me. Why? A Global Shapers Survey noted that over 30 percent of under-30s place value on work-life balance when considering job opportunities. Flexible working – it pulls a crowd. If I were to move jobs, opportunities that offer flexible working in comparison to those that don't will always get my vote. Who could benefit? In short: everyone. More specifically, there are certain groups who might welcome it more than others – from parents who are juggling childcare with a demanding full-time job, to those desperately trying to coordinate multiple teams in different time zones. Flexible working is transforming the way employment, businesses and talent attraction work, but how will it impact cybersecurity? Protecting employees on the go With a growing tendency for workforces to work remotely and a burgeoning BYOD (bring your own device) culture, built-in security is not enough anymore. IT managers can increase their security budgets and reinvent endpoint protection to empower employees on the go. So if you want to reduce the number of security incidents while providing your employees with a flexible arrangement, you'll need to tool up. Home office and remote-working users aren't protected by the corporate firewall, so the data on their devices should be encrypted and their internet connection should be secured by a firewall or web controls. This requires endpoint protection with reach functionality, which also helps your IT team to meet compliance and security requirements by applying patches, detecting anomalies that could be cyberthreats, and controlling what websites and services employees can safely use. Find out more in this article about teleworking and cybersecurity. Flexibility in action As today's workforce becomes more connected, and our lives more hectic, flexible working arrangements that help staff support their lifestyles while meeting demanding job needs are more important than ever. If you're not already offering flexibility to your workforce, or thinking about it, my advice is this: do it before your competitors get there first.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries