In 2019, the office is wherever your workers are and, wherever they are, it's likely they're going to need to connect to the corporate network, ideally using devices that allow them to do so securely.

For many enterprises, it's time to rethink traditional cybersecurity practices and consider how this is best done.

Increased time outside of the official workplace has become the reality of working life for employees in a rapidly digitising economy.

A study published by International Workplace Group in 2018 found almost half of all Australian employees worked remotely for at least 50% of the week, while more than two-thirds spent at least one day a week off-site.

There are benefits aplenty for companies which embrace mobile working arrangements. They include the opportunity to reduce office space and overheads and the enhanced productivity of employees who appreciate being able to cut their commute times and enjoy a better work-life balance – and who are more likely to stick around for longer as a result.

Making mobile working more secure

While the benefits of mobile working are compelling, it's a modus operandi which can present a challenge for cybersecurity professionals accustomed to approaching corporate network protection in a traditional way.

Throwing a virtual cordon around the enterprise becomes less effective when employees are dispersed and critical systems are running, not in the corporate data center but offsite in the cloud, as increasingly they are in both the public and private sectors.

What's needed is a flexible solution which makes it possible for employees to access core systems, anywhere, any time and from any device, without compromising the security of corporate software and customer data.

The zero trust approach

Implementing a zero-trust environment can be that solution.

The term ‘zero trust' is used to refer to a security model which works on the premise that no individual or system requesting network access should be trusted by default.

The requirement to verify identity is extended to those operating inside the network, as well as outsiders seeking access.

In such an environment, everything has an identity – users, applications, services and systems – and every user, device and network flow must be authenticated and authorised.

Once the appropriate infrastructure is implemented, every application and service is potentially reachable by every other one, regardless of physical location.

Identification that works

Being able to establish and validate identities in a secure manner is the key to establishing a zero-trust environment which can provide an enterprise with the same rigorous protection that perimeter security typically delivered, a decade or two ago.

There are a number of means by which this can be achieved – think identity proofing, the issuing of secure certificates and multi-factor authentication.

Machine learning-powered authentication solutions can make the process simpler and more streamlined.

They're able to remove unnecessary authentication steps when confidence is high that a user is who they purport to be.

They also have the capability to analyse access patterns to detect botnet and data exfiltration attacks and deny access when these appear to be occurring.

While technology plays the lead role in ensuring individuals and systems attempting to access the corporate network are bona fide, it works best when augmented by regular security awareness training for staff.

Recent times have seen phishing attacks become more sophisticated.

A modest investment in employee education is the best way to ensure workers don't negate their employer's investment in security technologies by inadvertently giving their credentials away to hackers and cyber-criminals.

Time to act: why businesses should get serious about protecting their mobile workforces

It's official: mobile working is no longer an unusual, occasional or experimental practice.

It's gone mainstream and it's here to stay.

Companies that don't offer their employees the opportunity to work remotely, where practicable, may find themselves at a competitive disadvantage to those that do.

However, organisations that allow workers to go mobile without implementing commensurate security measures lay their enterprises open to the very real risks of cyber-compromise or crime and the serious economic consequences that can come in their wake.

Implementing a flexible and stringent security environment, underpinned by robust identity management technology, is key to ensuring systems and data are not compromised.