Presented by Lookout

---

Over the past several years, organizations have undergone a roller coaster of digital transformations. First, they accelerated the onboarding of cloud services and adopted bring-your-own-device (BYOD) policies so that users could effectively work from anywhere. Now, in the name of security and productivity, many industry leaders are coaxing employees back into the office.

With the way we work constantly in flux, it’s been easy for organizations to lose track of exactly where their data resides. It used to be that you kept your critical data behind a firewall, ensuring that you had  complete control. But things have changed. The typical mid-sized organization uses hundreds of SaaS apps and legacy tools, and users are accessing corporate data from their own devices. With that sprawl, it’s become extremely difficult to keep track of the data — much less control and secure it.

To fully secure your digital transformation while ensuring that sensitive data is protected, you need to rethink various aspects of your security operations. Simply forcing users back into offices will set back productivity and it doesn’t solve many of the cloud-based threats that you face today. To ensure your organization’s security is headed in the right direction in 2023, here are the biggest challenges that you should focus on.

It’s time to move on from VPNs

For years now, virtual private networks (VPNs) have been the go-to remote working solution. With only a small subset of employees working outside offices, whether it’s a traveling salesperson or an executive, it made sense to simply connect those users back onto your perimeter.

But now that data resides in the cloud and most of your users are connecting from anywhere, this puts strains on VPNs, which were designed to only support a small number of remote employees. By backhauling traffic to your headquarters, you are slowing down network traffic and eliminating the productivity gains of using cloud apps.

VPNs also introduce risks of their own. By connecting users back to your perimeter, they punch through your firewall. And once a bad actor has gained access, they can move laterally throughout your entire system. Even though most organizations are well aware of the risks associated with VPNS, giving them up also means giving up their legacy security tools like data loss prevention (DLP). Instead of relying on the status quo and introducing unnecessary risk, organizations should seek out a more modern approach to DLP and remote access.

Keep an eye on device risks

Moving forward, cyber attacks will rely less on malicious code and instead focus on vulnerabilities created by impersonation. Rather than deploying malware, which is much easier to detect, bad actors might purchase compromised credentials off the Dark Web or trick one of your users into sharing their information. This change in tactics makes your organization’s endpoints — both managed and unmanaged — a point of risk.

Many organizations are still relying on a mindset of “We manage this device, so we trust it.” They assume that if they have the device under management, it’s not a threat. But management only enforces basic measures, like restricting the types of software used or making sure the operating system is up to date,  they don’t have visibility into the actual risk level of the device. What would happen if the user receives a phishing text and clicks on it? Or maybe the user downloads confidential corporate documents. Instead of assuming a device is low risk, you need to continuously authenticate users and devices — especially when you consider the proliferation of BYOD programs.

SaaS apps introduce complications

With every SaaS app an organization onboards comes a different set of operational controls. Salesforce works differently than Box which works differently from Microsoft 365. When you were using on-premises applications, you could set access controls and privileges centrally using tools like active directory group policy, but there’s no standardized policy administration for the cloud.

Because the access controls for each app are so different, in order to protect your data, you have to have someone in your security organization that is an expert in each individual app in order to set data authorization rules consistently. Of course, with hundreds of apps, this isn’t a realistic way to handle security, and it’s the reason SaaS app misconfiguration creates such a high risk for breaches.

Endpoint-to-cloud security with a data-centric approach

As your organization continues the transition to the cloud, you’ll need to drop legacy tools like VPNs and on-premises DLP and start to think about how you can move your security to the cloud as well. Instead of slowing users down by sending traffic back to the perimeter or even forcing them to come back into the office, cloud-based tools like zero trust network access (ZTNA) and cloud access security brokers (CASB) will enable organizations to keep track of their data and secure cloud apps without opening themselves up to risky situations like cloud misconfiguration and credential theft.

Combine that with cloud-based data protection capabilities and endpoint security that allows you to continuously assess the risk levels of all the devices that are interacting with your data, and you’ll have a security environment that will promote productivity through work from anywhere while keeping your data safe.

Aaron Cockerill is Chief Strategy Officer at Lookout.

For more information on the Lookout Cloud Security Platform, visit us here.

---

Sponsored articles are content produced by a company that is either paying for the post or has a business relationship with VentureBeat, and they’re always clearly marked. For more information, contact [email protected].