Businesses have had to make massive adjustments to the way they function over the past year. And the pandemic has most certainly provided a wake-up call to IT departments previously resistant to change.  (Or in many cases, the folks responsible for making financial choices for them.) When organizations moved their staff to remote work, IT teams had to quickly step up to accommodate new cybersecurity risks. And now that we are all slowly shifting to a new hybrid work model that bounces between home, office and travel, we face even more new challenges. Consider these 5 security strategies for this new hybrid workplace to help ease the pain.

“Vaccinate” Returning Laptops

Endpoint Detection and Response (EDR) technology is used to monitor and mitigate cyber threats on any hardware device  — known in this platform’s terminology as “endpoints” — within a system. Deploy it on returning workers’ laptops and assure these devices are continually monitored for malicious behavior as they are brought back into the office system. Essentially, an endpoint is scanned each time it needs to re-enter the trusted network. All security controls on the laptop are reverified, and hidden threats are caught before they infiltrate the network. As one security pro put it, think of EDR as a “vaccine” given to each laptop to prevent “cyber outbreaks”. After all, much like a person out-and-about during the pandemic, you don’t know where that laptop has been!

Consider Segmentation

Along with EDR, another security strategy to think about is segmenting. Hacks happen. It’s inevitable your organization will experience a successful cyberattack at some point. But by segmenting different areas of workloads and endpoints within the network, you can limit the damage. If a particular server gets compromised, IT can quickly isolate it so it doesn’t infect the rest of the network. IT can also limit the harm caused by an attack by setting rules and policies for which systems can talk to one another within the network. (For example, your HR department system may not need to communicate with your research department system.) Again, this segmentation limits the infection to fewer parts of the network, as opposed to damaging the network as a whole.

Sharpen the Focus on Identity and Access Management

Take a fresh look at identity and access management, particularly as staff devices are moved in and out of your office’s perimeter. Even with EDR software and network segmentation for better security, identity and access management will be important for maintaining productivity.  By additionally fortifying staff with strong privileged access security controls, you will ensure that work can get done by the people who are authorized and verified to do it.

Prepare for hackers playing the long game

There is likely to be an increase in alerts to IT as people return to the office and try to connect compromised laptops to the system. But besides these obvious intruders, IT teams need to stay on their toes for under-the-radar threats. According to one cybersecurity pro, it takes more than six months for a typical organization to detect and respond to modern cyberattacks. In an effort to avoid detection, some attackers will lay dormant for weeks or even months, or take just the smallest of steps to quietly advance their attack. For this reason, IT teams must not rest easy once the initial influx of security alerts dies down. They must be prepared for the eventuality that those hackers hiding in the shadows will eventually make themselves known.

Re-train your staff

Hackers favorite targets are people who are distracted and disoriented. We know the pandemic triggered COVID testing — and later vaccine — phishing scams. Now we should expect criminal activities based on the “return to a new normal”. In other words, any time we enter a period of the unknown, attackers will try to take advantage of our confusion. What does this mean for your organization? Security awareness training is crucial. Or retraining, if this is something you were diligent about before the pandemic. Educate your users on the latest things to be wary of. For example, too-good-to-be-true promotions and deals for corporate travel. (“The travel industry is trying to get back on its feet so we’re offering these cheap tickets…today only!”). And it never hurts to give a refresher of even the most basic security awareness tips. Especially after this long, strange year away from our offices.

So good luck to us all as we head into to our new hybrid work environment! By implementing any or all of these 5 security strategies you will hopefully give your organization a shot at making the transition far less painful.