Working from home is a security decision
Mar 25th, 2020 by Jesper Kråkhede
In a few days a large part of Sweden has moved home. Management teams all over the country are working on keeping the business running, and rightly so. But in the rush I see a lot of security decisions being made without anybody noticing that they are security decisions.
‘Let people use their own computers.’ ‘Open up remote desktop so they can reach their workstations.’ ‘Skip the second factor, it´s too hard to roll out right now.’ Every one of those might be the right call for a few days. The problem is that they tend to stay.
So here is my advice to management. Accept that you need to take some risks right now, but write them down. Every exception should have an owner and an end date. Ask your IT department what was changed this week and what the plan is to close it again. Make sure the security team is part of the crisis group, not only informed afterwards. And give your users clear instructions: Which tools are allowed? Who do they call if something looks strange?
The attackers are watching the same news as you. They know that a lot of new and hastily opened doors appeared this week.
A crisis is a bad time to build security. It is a very good time to find out what you are missing.