Work has changed dramatically thanks to the global COVID pandemic. Workers across every market sector in Australia are now spending their workdays alternating between offices and other locations such as their homes. It\u2019s a hybrid work model that is certainly here to stay.\n\nBut moving workers outside the network perimeter presents cyber security challenges for every organisation. It provides an expanded attack surface as enterprises ramp up their use of cloud services and enable staff to access key systems and applications from just about anywhere. \n\nSenior technology leaders gathered in Melbourne recently to discuss the cyber security implications of a more permanently distributed workforce as their organisations move more services to the cloud. The conversation was sponsored by Palo Alto Networks.\n\nSean Duca, vice-president, regional chief security officer, Asia-Pacific & Japan at Palo Alto Networks, says with the primary focus now on safety and securely delivering work to staff, irrespective of where they are, organisations need to think about where data resides, how it is protected, who has access to it and how it is accessed.\n\n\u201cWith many applications consumed \u2018as a service\u2019 or running outside the traditional network perimeter, the need to do access, authorisation and inspection is paramount,\u201d Duca says.\n\n\u201cAttackers target the employee\u2019s laptops and applications they use, which means we need to inspect the traffic for each application. The attack surface will continue to grow and also be a target for cybercriminals. This means that we must stay vigilant and have the ability to continuously identify when changes to our workforce happen, while watching our cloud estates at all times,\u201d he says.\n\nBrenden Smyth from Palo Alto Networks adds the main impact of this more flexible workforce on organisations is that they no longer have one or two points of entry that are well controlled and managed.\n\n\u201cSince 2020, organisations have created many hundreds if not tens of thousands of points of entry with the forced introduction of remote working,\u201d he says.\n\n\u201cOn top of that, company boards need to consider the personal and financial impacts [of a breach] that they are responsible for in the business they run. They need to make sure users are protected within the office, as well as those users connecting from any location,\u201d he says.\n\nGus D\u2019Onofrio, chief information technology officer at the United Workers Union, believes that there will come a time when physical devices will be distributed among the workforce to ensure their secure connectivity.\n\n\u201cThis will be the new standard,\u201d he says.\n\nIain Lyon, executive director, information technology at IFM Investors, says the key to securing distributed workforces is to ensure the home environment is suitably secure so the employee can do the work they need to do.\n\n\u201cIt may be that for certain classifications of data or user activity, we will need to set up additional technology in the home to ensure compliance with security policy. That challenge is both technical and requires careful human resource thought,\u201d he says.\n\nMeeting the demands of remote workers\n\nDuring the discussion, attendees were asked if security capabilities are adequate to meet the new demands of connecting remote workers to onsite premises, infrastructure-as-a-service and software-as-a-service applications.\n\nPalo Alto Networks\u2019 Duca says existing cyber capabilities are only adequate if they do more than connectivity (access and authorisation).\n\n\u201cIt\u2019s analogous to an airport; we check where passengers go based on their ID and boarding pass and inspect their person and belongings. If the crown jewel in an airport is the planes, we do everything to protect what and who gets on.\n\n\u201cWhy should organisations do anything less?\u201d he asks. \u201cIf you can\u2019t do continuous validation and enforcement, what is the security efficacy of the security capability?\u201d\n\nMeanwhile, Suhel Khan, data practice manager at superannuation organisation, Cbus, adds that distributed workforces need stronger perimeter security and edge security systems, fine-grained \u2018joiner-mover-leaver\u2019 access control and entitlements, as well as geography-sensitive content management and distribution paradigms.\n\n\u201cWe have reached a certain baseline in regard to the cyber security capabilities that are available in the market. The bigger challenge is procuring and integrating the right suite of applications that work across respective ecosystems,\u201d he says.\n\nHeld back by legacy systems\n\nMany enterprises are still running legacy systems and applications that can\u2019t meet the demands of a borderless workforce.\n\nPalo Alto Networks\u2019 Smyth says cyber impacts of sticking with older systems and applications are endless.\n\n\u201cDirectly connected to SaaS and IaaS apps without security, patch management, vendor support \u2013 the list goes on \u2013 means organisations will not have full control of their environment,\u201d he says.\n\nDuca adds that organisations running legacy platforms could see an impact on productivity from their employees, and the solution may not be able to deal with modern-day threats.\n\n\u201cEvery organisation should use this as a point in time to reassess and rearchitect what the world looks like today and what it may look like tomorrow. In a dynamic and ever-changing world, businesses should look to a software-driven model as it will allow them to pivot and change according to their needs,\u201d he says.\n\nCbus has challenges around optimally integrating software suites for end-to-end seamless process flow, like most enterprises that have built technical systems for core business functions over the past 10 years, says Cbus\u2019 Khan.\n\n\u201cThere are several app modernisation transformation programs to help us move forward. I believe that there will always be \u2018heritage systems\u2019 to take care of and transition away from.\n\n\u201cThe only difference is that in the near future, these older systems will be built on the cloud rather than [run] on-premise and we would be replacing such cloud-native legacy applications with autonomous intelligent apps,\u201d Khan says.\n\nMeanwhile, IFM Investor\u2019s Lyon says that like very firm, IFM has several key applications that are mature and do an excellent job.\n\n\u201cWe are not being held back. Our use of the Citrix platform to encapsulate the stable and resilient core applications has allowed us to be agnostic to the borderless nature of work,\u201d he says.\n\nCentralising security in the cloud\n\nThe advent of secure access service edge (SASE) and SD-WAN technologies has seen many organisations centralise security services in the cloud rather than keep them at remote sites.\n\nPalo Alto Networks\u2019 Duca says that for many years, gaps will continue to appear from inconsistent policies and enforcement. With the majority of apps and data that sit in the cloud, centralising cyber services allows for consistent security close to the crown jewels.\n\n\u201cThere\u2019s no point sending the traffic back to the corporate HQ to send it back out again,\u201d he says.\n\nThe decision about whether or not to centralise security services in the cloud or keep them at remote sites is based on the risk appetite of the organisation.\n\n\u201cIn superannuation, a good proportion of cyber security programs are geared towards being compliant and dealing with threats due to an uncertain global political outlook. Organisations that can afford to run their own backup\/failsafe system on premise should consider [moving this function] to the cloud. Cloud-first is the dominant approach in a very dynamic market,\u201d he says.\n\nUnited Workers Union\u2019s D\u2019Onofrio, adds that the pros of centralising security services at remote sites are faster access and response times, which is ideal for geographically distributed workforces and customer bases. A con, he says, is that a distributed footprint implies stretched security domains.\n\nOn the flipside, security domains are easier to manage if they are centralised in the cloud but will deliver slower response times for customers and staff who are based geographically afar, he says.