How office networks have changed under lockdown

by Mike Campfield, VP, GM International and Global Security Programs at ExtraHop

Due to lockdowns, companies have implemented remote work arrangements leaving many offices empty for months. As organisations wait for onsite and office-based activities to resume, offices have been largely dormant, but this does not mean businesses are at all quiet.

In March, ExtraHop analysed four petabytes of data from more than 15 million devices and workloads across cloud, data centre and remote site deployments. This data provides insights into how office networks have changed under the quarantine. With remote and hybrid work arrangements becoming a vital part of business continuity strategies, these insights offer businesses valuable direction on how to handle future disruptions.

What the numbers are telling us

The most obvious insight that can be drawn from Extrahop's data is the overall decline in the use of devices, which confirms the mass migration of employees toward remote working. With computers and laptops turned off and devices disconnected from office networks, smartphone connections were down by 69%, laptop connections decreased by 64%, and the use of digital assistants was reduced by over 70%.

However, these numbers do not take into account the number of people remotely connecting to office networks through virtual private networks (VPNs) or accessing their office desktop using their home computers through virtual desktop infrastructure (VDI). Also, many companies are utilising cloud infrastructure and services, which do not require a VPN for connection.

What is perhaps more interesting is the enduring increase in the activity of other devices within the network. For example, despite shutdown of offices, voice over Internet protocol (VoIP) phone connections went down by only 7.5% and printers are down by only half a percentage point. Meanwhile, the increase in presence of Internet Protocol (IP) cameras by almost 50% is understandable. As workforces have gone home, enterprises would want to keep an eye on their offices by turning on their cameras to bolster their physical security.

While most employees have been working remotely, devices that were left on and still connected to the office network such as IP cameras, VoIP and printers stand as potential entry points for cybercriminals. According to Interpol's Cybercrime: COVID-19 Impact report, the lack of cybersecurity awareness and ‘hygiene’ among businesses and organisations is listed as one of the main challenges in Asia and South Pacific region. With the increasing number of cyberattacks amid the health crisis, defences on all fronts should be strengthened.

How enterprises should respond

Enterprises have largely shifted their security efforts to remote working. However, this should not mean that office network security can be overlooked. Instead, enterprises need to establish strong visibility over both their remote workforce and the office.

The first step is to revisit the IoT device procurement process of the business. According to IDC, despite the COVID-19 crisis, IoT adoption in Asia Pacific (APAC) will continue to grow as the region's communication infrastructure and coverage improve. The potential applications and promises of the Internet of Things (IoT) cannot be easily refused. However, the risks that IoT devices pose on enterprise security also cannot be ignored.

For enterprises to get the most of the clear benefits of IoT like IP cameras and VoIP phones, they need to seriously inspect their security pre-purchase. IT departments should always configure IoT devices before deploying them and not trust the default settings to provide proper security.

Remote working is going to be part of the future of the enterprise and the current public health crisis has only accelerated that upward trajectory. Based on a study conducted by Deloitte, up to 47.8 million people in Southeast Asia could shift to remote working over the next few years. As traditional enterprise endpoints and devices are used less, and employee-owned devices are used more, enterprises have to be smart about how they manage security and access for remote workers.

Employees working remotely need to know how to protect themselves and the enterprise while using their own devices. They need to be aware of the unique threats that they face such as phishing or insecure local networks while outside of the office and without the protection of enterprise controls.

Fundamentally, without appropriate security measures in place, IoT devices in the office can expand the cyberattack surface. Moreover, control over a remote workforce must be maintained despite limited visibility over employee-managed devices. With employees accessing the enterprise network remotely, IT teams need to recalibrate security protocols in place. Enterprises should be able to monitor odd IP addresses of connecting employees or failed login attempts which may indicate an attack attempt. For traffic inside the local network, IT teams should focus their attention on account activity and how users access sensitive data.

Many organisations were forced to adopt remote working arrangements as an emergency measure to continue operating. Given the benefits remote work has to offer to both the business and the employees, organisations may have to look at remote work as a permanent fixture moving forward. However, conditions and processes need to be improved to capture the most value out of remote work. Improving network security is the best place to start.