Secure Remote Access: Technology, Policies & Usage

Secure remote access aims to thwart unauthorised access to a network. 

As more office workers work from home (from remote locations or personal devices), it becomes more important than ever for businesses to ensure that remote access to the company’s information is secure. When an employee signs into the company network, that login must be secured from hackers, who might use the email address or password to steal the employee’s personal information and corporate information from your organisation. 

If you are an IT manager, it is important to understand how secure remote access works, which technologies function best, and how to implement security policies to ensure that the system is protected from prying eyes. Secure remote access requires a combination of approaches that work best for your company, including all employees. 

Why is secure remote access an important company policy?

The term secure remote access covers all security policies, processes, and solutions that protect your network from unauthorised access. By metaphorically guarding the entrances, you protect important company data, including employee information, intellectual property, and financial transactions. 

Secure remote access can benefit from new technology, but it is not contingent on one technology. Rather, it is a coordination of technology and human power. 

Internet access, lighter and more powerful computers, and cloud-based computing have all revolutionised the way people work. This means that securing connections to company information requires considering multiple new points of failure, including personal devices like smartphones, remote cloud server systems, and public Wi-Fi rather than secured internet connections. 

Where IT managers could once monitor the security of internet access, server access, and physical devices on site, modern IT managers must take these skills and apply them to a wider range of potential issues. 

Steps & technologies to consider for secure remote access

When creating your secure remote access setup, you may implement technologies and strategies like:

• Virtual private network (VPN): VPNs are increasingly common, not only for businesses but also among individual consumers. A VPN is an encrypted private network that sends the user’s data through a different server in order to “spoof” where the person is located.

For personal or public internet connections, this allows the user to access the internet more securely by using multiple protocols to make network connections. If employees work remotely or use personal devices to access company information, a VPN can create a secure connection to the company’s servers, or prevent hackers from finding the actual IP address of the employee’s internet location. 

• Zero trust network access (ZTNA): These solutions create seamless, secure connections to private applications, without exposing users or apps to the public internet. 
• Endpoint security: Many security solutions involve managing network connections, but another important part of secure remote access is the security of the device accessing your company’s network. This device is the endpoint. Securing the device includes choosing antivirus software, maintaining firewalls, updating all important company software to prevent security holes, and using access management to monitor who accesses important information and when. 
• Network access control (NAC): This step in a secure remote access plan helps you manage the combination of authentication and login processes, endpoint security measures, and enforcement of your network security policy across the company. This also includes logging and tracking security information (security information and event management, or SIEM). 

Software can automate this logging process, allowing you to find unusual activity faster. 

• Single sign-on (SSO): Managing which employees log into which systems is a vital component of your secure remote access process, but you also want to make login as easy for employees as possible. Using one set of login credentials across multiple systems within the organisation helps streamline this process for workers. It can also mean that you as the IT manager can monitor this identity for suspicious behavior. 
• Multi-factor authentication: Once you have an employee set up with SSO, you will want them to verify this identity if they use a new device, like a phone or a tablet, to access their work information. Using two-factor authentication (2FA) requires the user to provide two or more pieces of information to ensure they are who they say they are. This information often includes passwords or authentication tokens. 
• Privileged access management (PAM): The concept of privileged access centers around certain users receiving special privileges on their accounts, so they can access information that may not be available to other workers. PAM is the set of tools implemented to allow, monitor, and manage this type of access. 

Teaching employees about secure remote access procedures

Coordinating these technologies and policies through documentation can help you create a company-wide process for managing information security. Educating employees and contractors in safety measures protects everyone’s personal information. 

These are additional tips for employees to follow:

• Change the preset passwords on your home router to something you can remember that is not issued by your internet service provider.
• Keep the router’s software up-to-date, and upgrade the device every few years.
• Consider enabling full disk encryption on devices that will connect to the company network. This can reduce the risk of identity theft if the device is lost or stolen.
• Change settings on devices, especially phones and tablets, so they do not automatically connect to available Wi-Fi in public.
• Maintain up-to-date antivirus software and run consistent scans.

Make the introduction to secure remote access policy part of staff training, and create new trainings along with updated documentation when there is a policy update. Ensure you make copies of company policy on cybersecurity available to all, both in digital and hard copy. 

With more employees working from home, you should also offer consultations to determine if devices meet company security requirements. 

The benefits of secure remote access

A strong, intuitive secure remote access policy has many benefits for business, such as these:

• Secure access from any device: With SSO and 2FA, you allow employees to verify their login credentials quickly and easily, so they can use any device necessary with a simple login process. 
• Robust endpoint protection: Since employees typically have multiple devices, both issued by the company and for personal use, protecting these devices means that employees can complete their work, even if one device like a laptop is not available. 
• Safe and secure web access: Protecting users whenever they access the internet prevents security issues, even if the employee is not directly accessing company servers. By preventing employees from getting viruses or having their information stolen, even on personal time, you can protect the organisation’s data from being scraped or hacked later. 
• Raised awareness of security issues outside of IT: You and your team in the IT department are largely responsible for company security, but you cannot do this alone. Creating a secure remote access process means that all employees know how to help protect their information. 

Maintaining secure remote access with VPNs

Although you can create a strong secure remote access policy without VPN technology, implementing a VPN across company devices can help you ensure that you know who is accessing your company’s databases. This means you can monitor the login processes more effectively, and ensure that employees are looking at the information they have secure access and rights to. 

References

Secure Remote Access Explained. (July 2020). AT&T Business. 

CNI System Design: Secure Remote Access. (November 2020). National Cyber Security Centre. 

Secure Remote Access: Cybersecurity for Small Business. Federal Trade Commission (FTC)