Secure remote access: a growing challenge for businesses

Today, more people than ever use remote access in their day-to-day work. The technology enables authorised users to access a device, server or network over a network connection – whether it’s on the other side of the room or the other side of the planet.

The technology is essential to ensuring that modern organisations remain productive, agile and competitive. However, as with any technology, security is a concern. Cyberattacks are becoming more frequent and sophisticated, and remote access presents a significant target.

To address these risks, secure remote access practices call for several additional considerations, such as the use of multifactor authentication (MFA), endpoint protection, zero-trust access, virtual private networks (VPNs), intrusion detection and more. Security is a perpetual arms race with cybercriminals, and organisations that are slower to update are more likely to become targets.

The state of remote access

Increases in computer power, growing networks and more advanced software have significantly lowered the barriers to remote access technology. Whereas it was once highly technical and speed-limited, non-expert users today can seamlessly use remote access technology to use any connected computer as if it was sitting in front of them.

The use case for accessing devices remotely was catapulted into the mainstream during the Covid pandemic, as organisations of all kinds began to adopt remote and hybrid working. However, in an Impero survey of 2,000 employees, 47% of respondents expressed that they feel more concerned about cybersecurity while working remotely, and 76% say they believe their company can do more to make remote work more secure.

The rising popularity of bring your own device (BYOD) policies have also contributed to the broader adoption of remote access. However, improper use of these devices can pose a security risk. Impero data shows that 91% of employees who have been involved in a security incident have used their personal devices to access work data, and 51% were able to do so because their company had not implemented a clear security policy.

Simultaneously, the increasing use of Internet of Things (IoT) tech in commercial environments has driven an increase in remote access. Analysts estimate that there will be a total of 14.4 billion active IoT devices this year, including many connected by next-generation technologies like 5G. Controlling and monitoring these devices manually is often impractical, so it is common practice for operators to manage them remotely.

Best practice for more secure remote access

Industries such as retail, healthcare, manufacturing, and financial services – including many with extremely serious consequences for a cyber breach – have come to depend on remote access. This

suggests that it is possible to use securely. Here are seven examples of best practice derived from these industries:

1. Consider which users need remote access. Many – but not all – users require remote access. If an attacker gains access to an account with remote access permissions, they may be able to do significantly more damage than if the account doesn’t have them. Therefore, organisations should limit permissions to users who require them for their work.

2. Implement a zero-trust system. Today, users use all sorts of devices from multiple locations to access company resources. In this world, every device is suspect, so it makes sense for administrators to use “least privileged access” permissions and to verify users’ identities at every step along the way.

3. Select a dedicated remote access security solution. General security systems are not enough – remote access is a significant enough security risk to warrant using a dedicated security tool. The good news is that 57% of organisations already have dedicated remote access security solutions – but that means that 43% are left vulnerable.

4. Set clear policies. Good “cyber hygiene” is an essential part of an effective defence. Requiring multifactor authentication, for example, can significantly limit an intruder’s access, even if they are able to compromise a remote access system. Similarly, employees with remote access permissions must change their passwords regularly and ensure that they have the latest security patches installed.

5. Ensure every employee receives training. Almost a quarter of employees surveyed by Impero (24%) expressed that they did not feel confident recognising cybersecurity threats at work. While sophisticated attacks on remote access systems are possible, they are rarer than unsophisticated approaches such as phishing. Ensuring that every employee understands what they need to do to keep the organisation secure is essential.

6. Use a VPN. Requiring that employees use a VPN while remotely accessing company devices creates an additional layer of security by making it harder to intercept the data being transmitted. Unfortunately, just 52% of employees report that their organisation provides them with a VPN. For the remaining half of organisations, this is an easy win.

7. Select strong encryption. There is a real risk of a man-in-the-middle attack when sending unencrypted data over any network, but this is especially significant when remotely accessing a secure system. Organisations must employ end-to-end encryption to keep both endpoints secure – but just 50% of employees surveyed said that their company currently provides encryption software.

Businesses that use remote access benefit from boosts to efficiency and opportunities to work in entirely new ways. However, this must be balanced with the imperative to minimise the business’s attack surface. There is a middle ground, but finding it depends on decision makers to remain proactive and security focused.