Why Wireless Security Protocols Won’t Protect Your Roaming Remote Workers

Whether it’s in a coffee shop, airport or crowded mall, wireless networks present a range of security risks not inherent in wired networks. Wireless access points (WAPs) and wireless routers broadcast data over the air in every direction. In hotspot environments where this traffic is unencrypted, any eavesdropping device within a limited range can easily pick off the signals and steal information.

The threat, while diminished, isn’t eliminated when WEP, WPA or WPA2 wireless encryption standards are employed to protect the data. WEP encryption can be cracked in minutes, and hackers have also compromised modern routers utilizing WPA and WPA2. Organizations can patch the vulnerabilities in their WPA and WPA2 protection, but the threat doesn’t end there.

Using readily available wireless sniffing devices such as the popular WiFi Pineapple, determined hackers can spoof the WiFi network as part of a man-in-the-middle attack to steal user credentials, insert malware, and compromise machines, whether the user is still in the café or has returned home or to a nearby office.

Outside the enterprise firewall, VPNs help with these mobile worker scenarios, but remote endpoint security relies heavily on the human element: What people do, what they don’t do. Even the best employee will temporarily disconnect from the corporate VPN to access the Internet directly, exacerbating the risk of infection from spyware, malicious sites or embedded files. Users go into coffee shops and airports and board trains and then bang away on their keyboards and do work. They make sustenance purchases. With the right level of caffeination, they can be rather productive in their contributions of digital and perhaps even audio- or video-delivered work. They’re focused on the job at hand, and they don’t want to be hassled by too many security steps in order to maintain a productive pace. You know the drill: Log into the VPN, complete two-factor authentication, and then, due to any extended human pause such as deep thought or bathroom break, you have to do it all over again just to resume your work.

In addition, wireless data encryption and VPNs, even when used, can’t stop shoulder surfing, and unattended machines are a big no-no since thumb-drive malware insertions can successfully be executed in seconds.

According to IDC research, more than 70% of breaches start at the endpoint. From there, a hacked employee, or a hacker or malware piloting the compromised device, might then use a “secure” tunnel to access your organization’s active directory, or a customer communication tool. Here, the compromised endpoint can lead to widescale network infection including the loss of data, network control, reputation and business.

Distributed Network Security Requires Endpoint Visibility

Do you know all the assets connecting to your network? The pathways they’re taking, the payload or suspicious behavioral tics or storms they’re carrying? Can you recognize immediately who is trying to connect to your network, using which app, on which device, and quickly authenticate identity, monitor and control for appropriate network usage?

Traditionally, on-device endpoint protection is managed sporadically and inconsistently, which is not an effective way to maintain a shrewd Zero Trust approach across your network. Ransomware, bots and malware have a way of morphing to get past static, outdated antivirus protection at the endpoints. In the majority of cases, especially when involving BYOD, the hardware drive isn’t encrypted and the VPN isn’t used. Exposure to ransomware threats increase outside the private network – for example, a largely unprotected mobile employee opening email or entering data into your network from a crowded restaurant or a public hotel. Intrusions such as spyware, password theft, and open-port assaults can all result from a malicious presence lurking, listening and entering from a nearby or remote location.

Do you really want an employee plugging his laptop into a public charging station at an airport and then reconnecting directly to your live conference, private network or datacenter without first orchestrating detection and authentication? Do you want to leave network pathways open so new worms, viruses, malware and other hacker schemes can spread? Firewall and VPN defenses are vulnerable to this lateral exploitation. Workers, whether mobile or in the office, as well as certain types of computing architectures, can inadvertently leave open windows for malware and file-less malware schemes such as social engineering ploys to spread deeper into the network. As if that’s not enough, denial-of-service (DoS) attacks are increasingly targeting prone remote users for an easy entry point (sometimes via another protocol known as Remote Desktop Protocol, or RDP) and they can then flood your network.

Advanced Always-On Endpoint Protection

You can’t rely on wireless security protocols, disciplined VPN use, and static antivirus protection to secure your remote workers as they run the gauntlet of cybersecurity threats outside your firewall. Your endpoint protection must be always-on, even when your people aren’t.

Through efficiencies in the cloud, OPAQ enables organizations of all sizes to bolster and continuously refresh remote security with:

  • Always-on end-user protection and advanced malware detection and prevention.
  • Strong authentication, including multi-factor and/or directory-based.
  • Encrypted communication over SSL or VPN, as well as on-device hard-drive encryption.
  • Suspicious activity alerts about what a company device has connected to.
  • Smart processes and safeguards before the device connects to your organization’s private networks, including a sensible screensaver timeout policy.
  • Microsegmentation, which provides additional layers of security against the spread of malware or unauthorized network control. Microsegmentation works by isolating workloads from one another and creating secure network zones that prevent infected hosts from connecting to each other or to the core network. It produces separate secure tunnels for users who are roaming and those who have been authenticated for more private network and data access. In the past, the cost and effort of network segmentation versus the risk of lateral infection was too much for many organizations to bear, but the cloud has enabled organizations to implement such advanced security controls more efficiently and cost-effectively.

Reinforce your security at the endpoints and reduce your attack surface with just a push. Apply smart, on-device security-as-a-service at the endpoint without compromising user experience or performance.

Learn more
Read the OPAQ Securing Remote Workers report.