IT Necessities for a Distributed World

Chapter 4. Security Best Practices

When companies made the quick shift to remote work, many had to prioritize speed over optimization, which led to security vulnerabilities in their infrastructure. Further, the tumultuous business landscape pulled leadership’s focus away from security, causing many businesses to overlook those vulnerabilities. Hackers, however, are adept at spotting and exploiting them. As such, security must be integrated into every element of your IT infrastructure and processes.

In this chapter, we’ll discuss the key approaches and tools to establishing reliable security in your distributed organization.

Zero Trust Security

According to the JumpCloud 2021 State of the SME IT Admin Report, Zero Trust security has already been adopted by 24% of surveyed organizations and another 33% plan to adopt it. Inevitably, all organizations will need to adopt Zero Trust security sooner rather than later.

At its core, Zero Trust is a simple concept: trust nothing, verify everything. This approach emerged as a response to the inadequacies of perimeter-based security in the face of distributed networks. On-prem environments were well-suited to a perimeter security model, where the building provided a layer of physical security and the network was similarly guarded by a physical security perimeter made up of firewalls, antivirus software, and VPNs protecting the crown jewels within the network. However, perimeter-based security proves inadequate in protecting distributed environments.

With Zero Trust security, devices and identities are never intrinsically trusted and are required to authenticate their identities before they’re authorized to access any resource. This goes beyond traditional perimeter-based security, which only verifies identities before granting them access to the central network; once inside, users maintain their level of trust and only need to abide by the security that each resource prescribes independently. This relies on individual resources to uphold sufficient security, becomes time-consuming for the end-user, and complicates management significantly. Zero Trust is an absolute necessity when it comes to securing your organization’s data in a distributed environment. Breaching one perimeter is much easier for cyber attackers than having to authenticate at every point of entry on your network.

Establishing Zero Trust in a Distributed Environment

As Zero Trust was designed to address the issues of a distributed environment, Zero Trust–based tools and tactics go hand-in-hand with remote and hybrid-remote environments. They help establish identity-driven policies and take a holistic approach to security. The following tools and tactics are recommended steps to implementing Zero Trust in a distributed environment.

Multi-Factor Authentication (MFA)

Zero Trust security heightens its standards of authentication, prescribing complex authentication over a simple username/password combination. MFA achieves this by requiring more than one authentication factor verifying a user. This exponentially increases security and eliminates the vulnerabilities of common passwords, making it a critical component of Zero Trust.

Single Sign-On

SSO should always use MFA during authentication; however, once authenticated, it allows users to access their applications without logging into each application individually. It accomplishes this without sacrificing security by using secure authentication protocols. These authentication exchanges happen without action on the user’s part, delivering a secure, seamless experience.

SSO solutions typically work well with web-based authentication. And when combined with a centralized directory, they can extend to all of the resources the directory connects to—with a robust directory, that’s just about everything.

Principle of Least Privilege

In a Zero Trust environment with identity-driven policies, permission assignment should always follow the principle of least privilege (PoLP): assign each user the least amount of privilege they need to complete their work. In a distributed environment where IT relies heavily on automation, this is critical to correctly provisioning and authorizing users to their resources. PoLP prevents both malicious activity and human error, which can result in data breaches and misuse.

Segmentation

Network and infrastructure segmentation can play critical roles in attack mitigation. However, segmentation should be strategic and complementary to environments and workflows to avoid siloing and unnecessary information dispersal. While centralization is beneficial to maintaining data integrity and unification, segmentation in moderation can regulate data access and minimize damage from breaches.

VLAN segmentation, for example, is a common method for securing WiFi networks. Admins segment networks based on roles and permissions, following PoLP. Some directories can facilitate dynamic VLAN provisioning, automatically assigning users to the appropriate network based on their permissions.

Encryption

Data should always be encrypted in transit and at rest. Ensure your directory uses secure, encrypted protocols for authentication and authorization, and check the encryption policies on other applications—especially those used to store or share information, like collaboration and file-sharing tools.

In addition, require all devices on the network to enable full-disk encryption. Some directory services with device management capabilities allow you to enable and enforce this policy remotely.

Testing

Organizations should conduct periodic security testing to ensure ongoing security. We recommend the following tests and checks. These suggested frequencies are minimums; always err on the side of too often than not often enough:

• Phishing tests: once per quarter.

• Penetration tests: once every six months.

• Vulnerability scans: once per quarter; every other vulnerability scan can fall under the scope of a penetration test.

• Full-risk assessments: once every six months, or when new technology is added to your stack.

• Application-specific security checks: frequency varies by application. Mission-critical ones, like your directory, should be checked at least once per quarter.

Redundancy

On principle, your IT infrastructure should never be subject to a single point of failure. Redundant infrastructure reduces downtime, protects data, and recovers quickly when facing a breach. This requires systems like data backups, high-availability (HA) clusters, and WAN failover configurations. To optimize your redundant setup, identify all mission-critical functionality, and make sure it’s prioritized in your backup configurations.

Redundancy configurations are sometimes described in terms of N, where N is the single-point-of-failure infrastructure. Thus, an N + 1 approach supplements the infrastructure with one independent backup point; 2N duplicates the entire infrastructure. Lean IT teams often take an N + 1 approach, but 2N is more secure and preferable. Even better, 2N + 1 duplicates the entire infrastructure and adds another independent backup point.

For any data you store on premises, the 3-2-1 backup rule is a good baseline to use to ensure the data is sufficiently backed up with redundancy: store three copies of your data on at least two different types of media, with one copy of your data stored off site.

Redundancy and backups are especially important in distributed environments, which are fully reliant on cloud infrastructure availability and uptime. Fortunately, cloud providers often provide redundancy and failover as part of their offerings. Make sure all your providers guarantee high uptime and check your cloud provider’s SLA and policy on redundancy to ensure secure backups and prompt reaction to any issue or downtime.

Multicloud solutions can also provide redundancy with an extra layer of security: if one cloud provider is compromised, the data would still remain intact with the other provider as well. Organizations using multiple cloud providers might consider hosting their most critical data with more than one of the providers for a fail-safe.

Tip

When establishing a redundancy plan, be careful to clearly assign sources primary or backup status. Create controls that restrict access to backup data. Allowing users access to backups can quickly confuse things, compromise the integrity and centrality of your data, and endanger the safety of your backups.

Reporting and Review

As I discussed previously, unified and proactive reporting is key to supporting a distributed environment. There are a few tools and practices that can facilitate reporting, monitoring, and management:

SIEM (security information and event management)

SIEM can be helpful technology for creating automated alerts, helping IT respond quickly to issues, and preventing missed events of note.

Reporting tools included with existing solutions

In distributed environments, robust insights from cloud providers and cloud directory solutions can be especially useful.

Automated data exports

Automated exports of reporting data can help your team develop workflows around reviewing and storing insights.

Security-specific tools

There are many security tools on the market, from robust, AI-powered software that spans your entire infrastructure to more tailored and focused security tools for specific needs. Different tools can offer reporting, automatic alerts, intelligent automated response to suspicious activity, and more.

Contracting with a managed service provider (MSP)

Working with an MSP is becoming increasingly common in IT organizations; the JumpCloud 2021 State of the SME IT Admin Report found that 84% of the respondents were already engaged or planning to engage with an MSP. You can contract with an MSP for different levels of service; 24/7 monitoring and management is a popular service that helps supplement your IT team during and outside of your organization’s work hours.

Employee Training

Regardless of office setup or IT environment, employees need to know how to use the tools they’re given. This need is amplified when employees are working from different locations, often without in-person supervision. Skipping or downplaying employee training can lead to incorrect tool usage, shadow IT, and a lack of security best practices knowledge. This, in turn, creates inefficiencies, discrepancies, and security vulnerabilities.

Security Awareness and Behavior Training

Security training should include both awareness and behavior training. Security awareness should inform employees of the importance of following security procedures; common threats to your employees, customers, business, and industry; and the risks of breaking security protocol. Security behavior encompasses how to recognize, react to, and report threats.

Security training should empower employees to cultivate and contribute positively to a culture of security. Security training should ensure employees understand the security risks present in their working environment and best security practices for preventing and reporting threats.

Topics should include:

Phishing

Train employees on the signs to look for and what to do when they receive a phishing email. A formalized reporting process, e.g., a designated company email account for reporting phishing attempts, which the security team reviews, is recommended.

Password and authentication

IT should enforce MFA wherever possible and create password length and complexity requirements for every resource. Note that password length is now considered more important to security than complexity.

Device security

Employees using personal devices must follow the company’s AUP and security guidelines. In BYOD environments, this includes downloading prescribed antivirus and antimalware software, implementing updates when available, locking and encrypting their devices, and avoiding sharing the device with others.

Network security

When working outside the office, employees should understand what makes an internet connection secure and avoid accessing company resources on an unsecured network (like public WiFi). Many companies require a VPN when working on an unsecured network, and some solutions with conditional access policies can automatically enforce this rule.

Secure communication

Employees should understand and follow best practices for all communication channels. Employees should also understand what data is considered confidential or PII (personally identifiable information) and rules around how to treat it. This should include which channels are safe for discussing, saving, and transmitting this data; how and where to store it; and how and when to destroy it. Compliance guidelines may help inform this messaging.

Media relations

Employees should understand company policies around what to say and not say to media representatives (many companies prescribe that no one except designated PR and leadership personnel speak with media relations; all other employees point media inquiries to a specified PR or leadership recipient).

While policies need to support the security stance and needs of an organization, they should not be too onerous. If they are, people are more likely to ignore them. Try to keep technical language accessible and simple. Most employees won’t be interested in the intricacies of how IT functions or how cybercriminals execute on threats; they want to know what to do, what not to do, what red flags to look for, and how to report them.

Tool Usage

Every tool should have a set of usage specifications that is communicated through both written and verbal training. Employees should understand how to use each tool. Often, vendors provide end-user training; use this where available and add in any company-specific direction around usage.

If you have to create your own training for a tool, consider including the following:

General usage

Clarify what the tool is used for and how to use it. Demos or hands-on training are often helpful.

Acceptable use

Outline your company’s expectations around the tool’s usage. These guidelines can help with security, privacy, and data integrity.

Access parameters

How can they access the tool? Some directories offer policy creation that can enforce these parameters automatically.

Security and compliance best practices

Clarify any security and compliance best practices and the importance of following them.

Troubleshooting workflow

Where can employees go for help with the tool: the tool provider, your help desk team, or another party?

Common misconceptions and issues

Check-in with your help desk team periodically once the tool is in place to identify recurring issues. Work these common issues and their solutions into your training to improve it over time.

Naming, saving, and sharing conventions

Make sure employees understand how and where to store data and resources associated with the tool.

Understanding best practices is one thing; getting them approved and putting them into action is another. In the next chapter, we’ll discuss implementation processes and tips for garnering leadership buy-in and approval.