2020 and 2021 were busy years for the infosec community, overflowing with cybersecurity lessons to remember. It all started in March 2020 when the COVID-19 pandemic disrupted the business and IT environments in ways that many organizations had not anticipated. Many companies were forced to move from well-established IT infrastructures to makeshift solutions in response to the new contactless business environment. Remote work quickly became the norm, and virtual collaboration tools replaced physical offices.

Amidst the frantic digitization and shift to remote work, many organizations lost clarity of their cybersecurity posture, with some unwittingly exposing themselves to serious risks such as social engineering, DoS, ransomware, data theft, and zero-day exploits. This shows in the record-breaking cybercrime figures reported in 2020 and 2021.

It’s now been two years since this turning point. Here are the hard cybersecurity lessons we’ve learned from mistakes, successes, and experiences in dealing with remote, hybrid, and deskless work since early 2020:

Endpoint security is critical – cybersecurity lesson one

Most remote employees access corporate assets through shared workstations or personal laptops, smartphones, or home computers, sometimes over questionable internet connections. Employers have no control over the kind of security measures or apps installed on remote devices or how they’re even used.

Endpoints are the first line of defense against cyberattacks in a remote workspace. Companies now realize the importance of taking back security control over endpoints, even when they’re still in the hands of remote employees. Remote endpoint security management involves:

• Software and patch installation
• Routing connection through VPNs
• Device auditing and validation
• Managed antimalware
• Active web and email filtering

Trusting is a mistake – a lesson as old as time

Trust has no place in modern cybersecurity, especially in virtual workplaces. You simply can’t afford to blindly trust every external connection by assuming it’s from a legitimate user or device. This is where the idea of zero-trust comes in. Zero-trust is not a tool or a quick cybersecurity fix. It’s an overarching foundational framework for network security. In general, it stands for “never trust, always verify,” meaning to continuously verify network requests on a case-by-case basis. The zero-trust concept basically boils down to three key elements:

• Verify every user: MFA, behavioral analytics, password management, etc.
• Validate every device: Comprehensive endpoint device management
• Intelligently limit resource access: Least privilege access, microsegmentation, lateral movement limitations, etc.

IT resilience is key to business continuity

Entrepreneurs have grown more appreciative of enterprise IT over the last two years. Companies turned to technology to cope with the pandemic’s new cybersecurity challenges and enable remote collaborations. Although this was only meant as a temporary fix to wait out the pandemic, telecommuting and the supporting technologies have become a staple in the business community. This makes enterprise IT a crucial component in planning business agility, survival, and continuity.

Employee cybersecurity training is more important than ever

Studies show that human error is the #1 cybersecurity threat to businesses and that most cyber incidents can be prevented through employee awareness training. This is especially true with remote work, where employees are mostly left to their own judgment and devices. Training employees on cybersecurity lessons, industry best practices, threat awareness and response, cyber hygiene, and observing security guidelines can turn your weakest security link into the most valuable security asset. The idea that humans error causes the most damage is more than a cybersecurity lesson for veterans in the industry.

It’s time to discard legacy security practices

Old solutions do not always work on new problems. Legacy IT and security systems simply don’t cut it in the remote work setting. Given the prevailing threat landscape and the nature of remote work, businesses can’t rely on antiquated legacy tools to protect digital assets. For instance, passwords, traditional firewalls, and antivirus tools alone are not enough to combat current threats. You need a more robust arsenal with advanced tools such as 2FA solutions, next-gen firewalls, and smart intruder detection systems to stand a chance against relentless cybercriminals.

Final word

Many companies learned these lessons the hard way — through cyberattacks and operational mishaps. That’s why it’s essential to read the business and IT environments before making major changes to the IT infrastructure. Unfortunately, many companies didn’t get a chance to thoroughly analyze their digital and business transformations during these chaotic times. But at least we now know the dos and don’ts when it comes to safe, efficient remote work.

Strong user authentication matters a great deal in the modern business world, and GateKeeper is here to help you with that. We specialize in cutting-edge user authentication solutions ranging from MFA and proximity-based login to passwordless access and more. Get in touch with us to learn more about automating authentication to reduce the cybersecurity lessons needed.