The world of how we do business was already changing leading up to March 2020. Companies were increasingly allowing for remote work and implementing hybrid work scenarios. It wasn’t until the pandemic that it went from optional to a necessity, and it’s sped up digital transformations in a drastic way.
Rapidly employers had to consider evolution as far as their IT infrastructure, how employees could access the resources they needed to do their jobs, even when working from unsecured Wi-Fi networks, and how to create policies conducive to this new way of doing business.
Employers and IT teams have lost much of their centralized visibility to see what’s happening on their network. Employees are laxer about cybersecurity when they’re working from home.
There’s also often a lack of clarity on remote work because there aren’t well-defined policies in place.
With all of this in mind, the following is a guide to what businesses should know about transitioning to a more permanent version of remote work, or at least a hybrid environment.
An Overview of Remote Work
Now that we’re significantly into the pandemic, both limitations and benefits of employees working remotely has become much clearer. There was a time in 2020 where we didn’t know what the future would look like, but now that we’re in it, it’s a more appropriate time to become strategic and refine the policies and procedures surrounding remote work.
Some people are returning to work, and there of course were others who couldn’t work remotely at all. More commonly, at least at larger corporations, it seems to be the use of hybrid policies growing in prevalence.
It’s estimated more than 20% of the workforce could work at least part of the week remotely. That could mean, if practice followed the estimation, that three to four times as many people would be working from home than they were before the pandemic.
As was touched on above, there are challenges, including not just the technical considerations but also how to coach employees, ensure there’s recognition and maintain a cultural connection to the company.
Specific business considerations stemming from remote work include:
- Fraud—there’s the potential for fraud to become a more significant risk when employees work from home. For example, internal controls might not be followed.
- Technology—do your employees have what they need to do their jobs properly from home? Are you allowing for a bring-your-own-device policy, and if so, how does that affect you as the employer in other ways? For example, will your cybersecurity coverage still apply?
- Taxes—when your workers aren’t in the physical office, you have to make sure you’re compliant with any state or local tax guidelines.
- HR and Internal Communications—your employees have to feel like they have a robust support system, even as they work remotely. You want to make sure that leadership is regularly communicating with them, sharing goals, and reinforcing your corporate vision. Transparency and staying in touch should be top priorities in the management of hybrid and remote work employees.
Cybersecurity and Remote Work
Employees do derive benefits from a work-at-home or hybrid workforce. They get access to more global talent in many cases, and employees are often happier and more productive when they have flexibility in how they work.
There can be lower costs associated with remote work on the employer’s end too.
Along with those upsides come challenges. Undoubtedly, cybersecurity is one of the biggest.
In the past, the go-to for remote work was a virtual private network. Companies would use this simple and affordable solution for security when employees weren’t in the office. Now, it seems like the VPN might be part of the past.
Before getting into what the solution might look like, specific cybersecurity challenges associated with remote work include:
- Phishing: With phishing attacks, employees can give hackers access to the network and sensitive business data it contains. Employees may not know how to work securely when they’re remote, or they may be less vigilant when they’re not in the office environment. It’s also hard for employees to discern what’s a phishing scam because they’re highly sophisticated in many cases.
- Passwords: Even when you’re utilizing VPNs, firewalls, and more traditional means of securing your network, if employees have weak passwords or reuse them, you’re at risk. If a hacker can crack a password to one account or app an employee uses, they’ll then try it across the board including to access business accounts, and it’s often successful.
- File sharing: You might already encrypt data on your network, but do you encrypt it when it’s being transmitted? Think about how much potentially sensitive information is sent daily by your employees and clients. When sensitive information is intercepted, it can lead to theft and identity fraud, and ransomware attacks.
- Using unsecured Wi-Fi: When your employees work remotely, they have to access the internet somehow, which can mean home Wi-Fi. They might also use public Wi-Fi if they’re working at a coffee shop for example. When employees work onsite, firewalls monitor network traffic and block anything potentially malicious, but most people don’t have this at home.
Is Zero-Trust the Solution?
When it comes to the above problems related to cybersecurity, Zero-Trust might be the appropriate solution and the best approach moving forward with increasing remote and hybrid work.
With a Zero-Trust cybersecurity model, there’s never an assumption a device or user is authorized for access. Each connectivity request has to be authenticated. This contrasts with traditional, on-premises approaches to cybersecurity. In a conventional model, everything within the perimeter is secured.
When it comes to remote and hybrid work, there isn’t a perimeter because the workforce is dispersed.
Even using a VPN isn’t going to give you comprehensive protection with remote work environments, although it might be one small part of your larger strategy.
Zero-Trust lets you provide least-privilege and as-needed access to your employees and vendors, partners, customers and contractors. According to one survey, 60% of responding enterprises said the pandemic and remote work spedup their Zero-Trust strategy.
Integral to Zero-Trust is advanced authentication of users.
Leastprivilege is a core element. With leastprivilege, users can only access the networks, applications and data that they have a business need for. There’s also micro-segmentation so that if an unauthorized user does happen to get access, they’re limited in what they can do and the impact.
Create Remote or Hybrid Work Policies
While cybersecurity is a massive consideration for remote and hybrid work, another one is making sure you have solidified policies for how people work and what your expectations are.
As you create remote work policies, keep some of the following in mind specifically:
- Talk to your employees if you haven’t already done so. Revamping or creating entirely new policies from scratch can be overwhelming, and you might not know where to start. Your employees are the ones who are going to be living these policies, so it makes sense to get their feedback. Ask them what’s most important to them and how you can facilitate smoother, more productive and more fulfilling remote work.
- From there, start to create expectations. How do you expect employees to both work and communicate? To get more in-depth with this, think about how your employees’ collaboration and culture will be affected and whether or not employees will need additional training or resources beyond what they already have.
- What tools and technology will be needed, and who’s responsible for obtaining and maintaining those?
- Will working remotely or in a hybrid way affect taxes or benefits or employees in different states or countries?
Thinks to think about as far as giving your employees the tools they need for the best work outcomes include:
- How do you expect your employees to communicate with their other team members while they work remotely?
- What are your expectations as far as how quickly employees should respond to communication?
- What are the tools and platforms to be used for communication, and are there situations where one should be used versus the others?
- Do you plan to offer a reimbursement or stipend for employees to buy the communication tools they need?
When establishing rules for working from home, consider how you’ll do performance reviews and how often. When are your employees expected to be online or available? Can your employees work almost entirely independently, as long as they’re meeting larger goals?
What are the legal rights of your employees? You may not even understand the legal implications of having remote or hybrid employees, so this is something you need to address perhaps after getting guidance from a legal professional.
Finally, are there going to be changes in perks or compensation? Some companies are making the controversial decision to lower salaries for employees who work remotely and move to less expensive parts of the country. Is that something you’d consider?
There’s a lot to remember when you’re identifying challenges and solutions for remote work, but once you have a framework in place, there are likely to be fewer hurdles along the way.
