News
CISA Outlines VPN Best Practices for Supporting Teleworkers
The Cybersecurity and Infrastructure Security Agency (CISA) issued an alert on Friday outlining virtual private network (VPN) best practices for organizations supporting remote workforces.
The alert from CISA, part of the U.S. Department of Homeland Security, is timely for IT shops, especially as coronavirus pandemic concerns draw more employees toward the teleworking option. Tech companies such as Google, Microsoft, Twitter and now Intel, among many others, have recently enacted work-from-home recommendations for employees that can do so.
VPN Requirement
VPNs are required to support these remote workers, CISA's alert contended, and proper VPN patching needs to be maintained.
"Remote work options -- or telework -- require an enterprise virtual private network (VPN) solution to connect employees to an organization's information technology (IT) network," the alert stated.
One catch is that organizations may have a "limited number of VPN connections, after which point no other employee can telework." The alert also contended that employees using VPNs for teleworking can be susceptible to targeting by "malicious cyber actors," including e-mail phishing attempts to steal user names and passwords.
CISA also stressed requiring multifactor authentication (a secondary means of verifying a user's identity besides a password) for teleworkers, although that's likely a soft spot for many organizations.
"Organizations that do not use multi-factor authentication (MFA) for remote access are more susceptible to phishing attacks," CISA warned.
The alert included links to documentation, offering help for IT departments.
Vendor Offerings
Technical support for remote workers, perhaps accelerated by the coronavirus pandemic disaster, is emerging as a major marketing opportunity for various solutions vendors. That's become apparent from the many product support announcements and offers from tech companies, which have become rampant in the last week.
For instance, this week, Microsoft offered itself as a case study in how to support remote workers using various Microsoft products. To support its employees, Microsoft used its own Azure Active Directory service with multifactor authentication for credentialing, Microsoft Intune and System Center Configuration Manager (Microsoft Endpoint Manager) for device management, Microsoft Teams for remote meetings, Windows Virtual Desktop for remote access to applications, and Office 365 with OneDrive for cloud storage.
Microsoft announced last week that it expanded VPN partner support in its Microsoft Endpoint Manager solution. It's possible to use Microsoft Endpoint Manager to create a VPN profile of user and device settings within an organization. Partners mentioned in the announcement included NetMotion, Citrix ADC and Blue Cedar.
Microsoft also this week offered general security tips to support teleworkers using various Microsoft products and licensing.
Hunkered-down Microsoft employees are showing off their home workspace setups (with three screens, mostly) and swapping teleworking tips in this newly created Microsoft Tech Community channel. Home-working productivity tips are also shared in this post by Jared Spataro, corporate vice president for Microsoft 365.
Collaboration solutions vendor Slack announced last week that its San Francisco office had a potential exposure, and it's getting scrubbed. The announcement assured readers that Slack has pandemic plans, and can scale its operations to support business demand. Slack also published tips for remote workers on how to best use the Slack service.
Google offered tips for IT pros managing Chrome Enterprise solutions and devices for remote workforces in this announcement.
Cisco issued an announcement this week to highlight some of the free security solutions that can be used to support remote workers. In particular, Cisco expanded its free Webex Web videoconferencing service offering to include free licensing on three security technologies through July 1, 2020. One addition under the free offer is Cisco Umbrella, which blocks malicious Internet sites. Another is Duo Security, which helps verify user identities. The third under the offer is the AnyConnect Secure Mobility Client, which adds client protections.
About the Author
Kurt Mackie is senior news producer for 1105 Media's Converge360 group.