In March 2022, Gallup surveyed more than 140,000 U.S. workers with remote-capable jobs. Based on the results, it's clear that "we're not returning to the same workplace we left." More than half of the respondents, 59%, prefer to work in a hybrid environment, while only 9% are willing to go back to the office full-time. The remaining 32% would rather work exclusively remotely.
Indeed, COVID-19 has single-handedly altered the work landscape. Pre-pandemic, six out of 10 workers preferred to work fully on-site, compared to less than one in 10 opting for full-time remote work.
As a result of this shift in preference, many companies are recreating their entire work ecosystem to provide more flexible options for employees.
For example:
- Target: Target is vacating a sizable portion of the office space it has occupied for the past four years, spreading some personnel throughout various locations in Minneapolis, where its headquarters are located. At the same time, it has allowed employees to decide when to come to the office or work remotely. By doing this, Target is hoping to reduce issues related to commuting, which has emerged as a primary employee complaint over the last two years.
- Amazon: Amazon has, on multiple occasions, claimed to favor an office-centric work model. However, in light of the pandemic, it decided to embrace hybrid work in 2022. Management will not require workers to come to the office a certain number of days a week. That decision will be made by team leaders, based on what they think is best for their teams.
As more organizations take similar steps to embrace the hybrid work model, an important question rises to the surface: How does this shift impact the threat landscape?
But First... What's a Hybrid Work Model?
Hybrid work is a flexible work setup in which employees can work both in-office and remotely. It comes in different forms:
- Remote-first: The first option is for employees to work remotely, but the company also has space available for those who want to work in the office.
- Office-occasional: The first option is for employees to work in the office, but they can also work from home.
- Remote allowed but office first: The first option is the office. Remote work is only allowed sometimes and with certain employees. This setup usually depends on factors such as office remodeling or employee health issues.
As for the difference between hybrid and remote work, a hybrid model presumes that every employee will have at least some access to the office, while fully remote work involves employees working 100% of the time away from the office.
Advantages and Disadvantages of the Hybrid Model
Although hybrid work is now fast becoming essential for employee happiness, there's a reason some bosses aren't entirely convinced it's for everyone's good.
Advantages
- Better employee morale: One primary advantage of the hybrid work model is employees get "face time" with supervisors and executives, as well as the rest of the team—at least from time to time. This allows team members to feel more connected to the company and their colleagues, boosting morale in the process.
- Less commuting: Hybrid work makes it possible for employees to spend less on fuel and avoid other commuting expenses. Given rising fuel costs, this will greatly help with their finances.
Disadvantages
- Sense of disconnect: When employees work remotely most of the time, they may feel disconnected from their colleagues. A recent study found that 53% of remote employees worry about being excluded from in-person meetings or activities taking place in the office.
- Increased cybersecurity incidents: With more workers working away from the office, where cybersecurity measures are usually in place to thwart attacks, cyber criminals are in for a treat. Hybrid work initiatives should, therefore, include plans to protect all devices that employees use to connect to the company network.
Cybersecurity Risks in the Hybrid Work Model
Even pre-pandemic when workers predominantly worked in the office, no organization—big or small—was immune to cyberattacks. With the hybrid work model, employees can work virtually anywhere, pretty much doubling the size of the attack surface for most companies.
Some of the most prominent cybersecurity risks that come with the remote work model include:
1. Unsecured Home Networks
Workers' ability to connect remotely is the backbone of hybrid work. But often, employees' idea of network security is limited to password-protecting their home Wi-Fi. Some aren't even aware they need to change the default password that came with their router. As such, it’s a good idea to double-check:
- The security of your hybrid workers’ home network passwords
- Who has access to their home network, including friends and family members
2. Targeted Cyberattacks
In 2020, Evil Corp, a Russian hacking group, was found to have been targeting American remote workers to infiltrate government and corporate networks. According to Symantec, hackers were able to identify which company a remote employee worked for through the virtual private networks (VPNs) they used to access work systems. They then infected the employee's computer, and as soon as the employee connected to their company network, the hackers launched an attack.
WastedLocker, Symantec added, was the ransomware variant Evil Corp used in the attacks against 31 organizations that included Fortune 500 companies.
Ransomware attacks on major corporations usually result in hackers demanding expensive ransom settlements for the company to regain access to its digital assets, such as the $11 million meatpacker JBS had to pay and the $4.4 million paid to resolve the Colonial Pipeline attack.
3. Lackluster Patching
A lackluster patching system leaves your network and devices open to a long list of issues that may have already been addressed. Patching vulnerabilities is often one of the easiest ways to protect your environment, especially because manufacturers and developers frequently release patches to fix problems. Even though it can take time to implement patches, these free updates are worth the extra effort.
4. The Proliferation of Shadow IT
Shadow IT, which involves employees using devices, apps, software, or services without the IT team's explicit approval, may be less expensive on the surface. But when left unmitigated, it can result in common cyberattacks crippling your entire network. To curb the proliferation of unapproved devices or tools in your hybrid work ecosystem, set up strict device policies for employees to follow—and be sure to implement them.
Impact of the Hybrid Work Model on the Threat Landscape
To ensure your organization reaps the benefits the hybrid work model promises, there are certain adjustments you have to make to minimize your threat exposure. These include:
- Implementing borderless security: Traditionally, network borders were confined within a company's four walls, and perimeter security was all it took to safeguard digital assets from intruders. But as the world becomes the workplace, traditional network security no longer cuts it. Now, borderless security, which enables secure access to work resources from anywhere, has become imperative for organizations with a highly mobile workforce. In this way, they can address the security of individual endpoints no matter where they are.
- Securing Internet of Things (IoT) devices: IoT devices are notorious for having lax security protocols, which is why they are prone to cyberattacks. By implementing practices to secure your IoT network—such as getting rid of default passwords, applying network segmentation, patching and updating firmware, and employing device discovery tools for complete visibility—you limit your exposure to IoT-related attacks.
- Enhancing training and communication: They say knowledge is power, and this can't be any truer when it comes to cybersecurity. By educating your employees on the importance of security and encouraging good cyber hygiene habits, you enable them to stay safe online, which, in turn, protects your networks as well.
Staying Safe in the New Normal of Work
With 64% of global workers likely to quit if forced to return to in-office work full-time, the hybrid work setup has become a way for companies to retain and attract top talent. As such, a hybrid work infrastructure that's rooted in cybersecurity gives your organization the kind of flexibility it needs to empower workers to perform their best jobs—without exposing your network to threats.