Why Strictly Controlling Candidate Access is Vital in Remote Onboarding

Remote work is now firmly entrenched in the U.S., with around 35% of workers working from home full-time. This new way of working has created specific IT risks, including those linked to onboarding. Companies hiring remote workers typically create an email account, provide access to cloud applications, issue devices, and grant access to internal information. Research compiled by CSNP shows that about 73% of organizations experienced remote work security incidents in the previous year, with remote workers three times more likely to fall prey to phishing attacks and the average cost of a remote work breach at around $4.86 million. Companies must adopt proven strategies to reduce the security risks remote workers pose.

Why Remote Onboarding Is a Security Risk

A recent study found that phishing susceptibility is 71% among new hires versus 49% among tenured employees. Because new employees expect numerous emails, login instructions, file-sharing offers, and information requests, attackers can more easily disguise phishing and social-engineering attempts as legitimate communications from IT or management. New hires may need time to learn the company’s security procedures and communication methods, making suspicious requests harder to spot. A convincing HR or IT request can give thieves the chance to take over an account or access a wide range of data.

The Need to Secure Identities and Devices

Safety and security begin with procedures in place before granting new hires access. Identities can be secured by verifying new employees, using strong authentication, enabling multi-factor authentication (MFA), and granting access to systems with more than one password. Devices must also be secured. Whenever possible, employees should utilize managed corporate devices rather than their personal devices. Additionally, all operating systems must be patched. In particular, Windows or macOS, as well as all browsers, must be updated, since updates often fix security issues. Installing endpoint protection is key to enabling computers to detect and block malware. Devices such as laptops should be encrypted to protect data in case of theft. Finally, companies must ensure that vital security policies are applied before granting access to hires. That is, all laptops must have updates installed, encryption enabled, screen locks, and running security software.

Steps for Controlling Remote Access and Permissions

Least privilege – granting hires the access they strictly need to carry out their roles—can help reduce damage from phishing and other schemes. In many cases, attackers obtain access via VPN authentication. In one case, attackers entered a system via a compromised FortiGate VPN and spent days trying to escalate their access. Windows Defender blocked one of their tools, while SOC analysts connected the suspicious activity and stopped the attack before it caused major damage. Cases such as these show the need to take remote access and permissions seriously. Beyond MFA, unused accounts should be closed without delay so attackers cannot exploit them after employees leave a company or move to a different department. A third key strategy is network segmentation – giving employees access only to the parts of a system they need and controlling how they communicate with team members on other networks. Finally, companies must log all actions that occur in their systems, including who logs in, when they do, where logins come from, which devices are used, and whether logins succeeded or failed.

Maintaining Access Throughout the Employee Life Cycle

Security must be a continuous process throughout every employee’s lifetime. It does not end when onboarding is complete, or even when employees have used networks responsibly for many years. Companies, along with their SOC analysts, must continually watch for unusual login locations, new devices, suspicious authentication, unexpected privilege changes, and other unusual activity. They should additionally revoke unnecessary permissions and disable accounts immediately when employees leave.

Remote work is here to stay, which means companies must be prepared to establish strict security protocols for new hires. To combat cyberattacks successfully, companies need a multifaceted approach. This approach should include MFA, device control, limited access, and steps to ensure remote access and permissions are restricted to what is necessary. Finally, companies should consider investing in SOC analysts, who can help monitor employees’ devices and network use to identify and address problems quickly before costly damage occurs.