sb-as logo
Story image

How flexible identity systems support mobile working – Ping Identity

21 Jun 2019

Article by Ping Identity APAC chief technology officer Mark Perry

In 2019, the office is wherever your workers are and, wherever they are, it’s likely they’re going to need to connect to the corporate network, ideally using devices that allow them to do so securely.

For many enterprises, it’s time to rethink traditional cybersecurity practices and consider how this is best done.

Increased time outside of the official workplace has become the reality of working life for employees in a rapidly digitising economy.

A study published by International Workplace Group in 2018 found almost half of all Australian employees worked remotely for at least 50% of the week, while more than two-thirds spent at least one day a week off-site.

There are benefits aplenty for companies which embrace mobile working arrangements. They include the opportunity to reduce office space and overheads and the enhanced productivity of employees who appreciate being able to cut their commute times and enjoy a better work-life balance – and who are more likely to stick around for longer as a result.

Making mobile working more secure

While the benefits of mobile working are compelling, it’s a modus operandi which can present a challenge for cybersecurity professionals accustomed to approaching corporate network protection in a traditional way.

Throwing a virtual cordon around the enterprise becomes less effective when employees are dispersed and critical systems are running, not in the corporate data centre but offsite in the cloud, as increasingly they are in both the public and private sectors.

What’s needed is a flexible solution which makes it possible for employees to access core systems, anywhere, any time and from any device, without compromising the security of corporate software and customer data.

The zero trust approach

Implementing a zero-trust environment can be that solution.

The term ‘zero trust’ is used to refer to a security model which works on the premise that no individual or system requesting network access should be trusted by default.

The requirement to verify identity is extended to those operating inside the network, as well as outsiders seeking access.

In such an environment, everything has an identity – users, applications, services and systems – and every user, device and network flow must be authenticated and authorised.

Once the appropriate infrastructure is implemented, every application and service is potentially reachable by every other one, regardless of physical location.

Identification that works

Being able to establish and validate identities in a secure manner is the key to establishing a zero-trust environment which can provide an enterprise with the same rigorous protection that perimeter security typically delivered, a decade or two ago.

There are a number of means by which this can be achieved – think identity proofing, the issuing of secure certificates and multi-factor authentication.

Machine learning-powered authentication solutions can make the process simpler and more streamlined.

They’re able to remove unnecessary authentication steps when confidence is high that a user is who they purport to be.

They also have the capability to analyse access patterns to detect botnet and data exfiltration attacks and deny access when these appear to be occurring.

While technology plays the lead role in ensuring individuals and systems attempting to access the corporate network are bona fide, it works best when augmented by regular security awareness training for staff.

Recent times have seen phishing attacks become more sophisticated.

A modest investment in employee education is the best way to ensure workers don’t negate their employer’s investment in security technologies by inadvertently giving their credentials away to hackers and cyber-criminals.

Time to act: why businesses should get serious about protecting their mobile workforces

It’s official: mobile working is no longer an unusual, occasional or experimental practice.

It’s gone mainstream and it’s here to stay.

Companies that don’t offer their employees the opportunity to work remotely, where practicable, may find themselves at a competitive disadvantage to those that do.

However, organisations that allow workers to go mobile without implementing commensurate security measures lay their enterprises open to the very real risks of cyber-compromise or crime and the serious economic consequences that can come in their wake.

Implementing a flexible and stringent security environment, underpinned by robust identity management technology, is key to ensuring systems and data are not compromised.

Download image
Email: The most common way cyber threats pierce organisations
Learn about the threats, the possible aftermath, as well as how to protect your people and your systems from email-borne attacks.More
Story image
Interview: Checkmarx on the state of software security in Asia Pacific
"While the benefits of software are obvious, this proliferation also creates a massive and ever-evolving attack surface,” says Checkmarx A/NZ country manager Raygan Flores.More
Story image
Illumio launches Zero Trust endpoint protection solution for our digital, remote world
“As organisations were forced to transform overnight to allow for remote work, a host of endpoint security issues that have either been ignored or invisible until now were brought to the forefront."More
Story image
Rackspace and Cloudflare join forces for managed edge security
Rackspace and Cloudflare join forces for managed edge security The solution includes a web application firewall, DDoS protection, DNS services and a global content delivery network, backed by 24/7 support.More
Story image
CrowdStrike recognised as leading endpoint security vendor on global scale
IDC's report shows that CrowdStrike demonstrated a 2018-2019 growth rate of 99% and close to doubled its market share, while the market shares of the top three vendors in the corporate endpoint segment declined.More
Story image
Gartner recognises Pulse Secure for Zero Trust Network Access solution
In the market guide, Gartner states that ZTNA augments traditional VPN technologies for application access, and removes the excessive trust once required to allow employees and partners to connect and collaborate. More