Secure Remote Access and Contingency Planning: Don't Catch a Cold
In the IT sector, you often get a strong sense of déjà vu when a new trend is announced. An example is the recent drive towards secure remote working among corporates. The current business climate and concerns over external factors, such as possible pandemics, have renewed interest in this well-established technology, as organisations look to rein in their fixed costs and ensure business continuity.
Businesses need a remote working solution that’s secure, that’s flexible enough to scale quickly to accommodate surges in demand, and that doesn’t require expensive, ongoing licensing and support – especially when the solution is not being fully utilised.
Sounds simple enough, doesn’t it? But the demands of secure remote access sometimes make it difficult to meet these business needs – giving a real headache to IT staff charged with delivering the solution. Let’s look more closely at these demands.
Firstly, there’s the issue of knowing how many remote users you will need to support. A client-based VPN solution may not give the flexibility you need just when you need it, because it requires deployment and licensing of client software before users can get remote access.
For example, what if there’s a major power outage at your head office? If only senior management have VPN clients deployed on their laptops or home PCs, how will the rest of your staff access applications and work remotely?
So the remote access solution must be flexible and able to cater both for managed devices (company laptops and smart phones) as well as unmanaged devices (home PCs, partner computers, Web kiosks).
It also needs to give close management over users’ access, with the ability of to grant or restrict access rights depending on individual needs, levels of trust, device type and security status.
Then there’s the need to authenticate remote users. Some solutions demand an authentication server, and an ID token per user to overcome the problem of easily guessed, potentially insecure passwords. This can prove costly to buy and run unless a large number of users are regularly working remotely – making it difficult to meet the need for flexibility.
Also, there’s the need to ensure the remote user’s computer has fully up-to-date protection against malware, and that it is patched against software vulnerabilities. Without this, a malware exploit could use the remote connection to attack the corporate network. If you open up remote working to large numbers of staff, who may be using their home computer for access, how do you ensure security compliance at each endpoint?
As such the solution needs to include specific, on-demand controls to secure the endpoint during the remote session. This includes on-the-fly malware checking, data encryption to stop usable information remaining on endpoints, and cache cleaning to remove traces of work from the endpoint device when the session ends.
The upshot is, it’s potentially very complex for an organisation to satisfy the need for flexible, cost-effective access, while keeping sensitive information secure. The business requirements conflict with the security requirements. So is there an approach to remote access that can reconcile these apparently conflicting demands? Let’s look at an example of how a UK financial institution approached the issue and achieved truly secure and flexible remote access for its entire staff.
The Norwich and Peterborough Building Society (N&P) wanted to improve remote access security to its core business applications (such as teller software), to enable wider use of flexible working for its staff. This would also be a key part of the Society’s contingency planning strategy against pandemic diseases or other serious business-disrupting incidents.
Andrew Winkless, systems architect for the N&P, said: “We wanted to enhance remote access security, but also needed a solution that was flexible and cost-effective to maintain. This ruled out token-based authentication methods and client-based VPN solutions, because of the costs of managing and supporting ID tokens and client software at every endpoint.”
The Society chose Check Point’s Connectra NGX R66 remote access gateway, licensed for 50 concurrent users. This enables users to connect from laptops and PCs without using a VPN client, via an IPSec connection.
The solution also removes the need for a dedicated authentication server, and expensive two-factor authentication smartcards or ID tokens for users. Instead, a one-time or single-use password is allocated by the solution and sent to the remote worker’s mobile phone by SMS, overcoming the issue of weak passwords that can be lost or easily guessed.
As well as centralised management for all users, remote access gateways can ensure that even infected remote computers do not pass threats onto the corporate network. Its integrated intrusion prevention and endpoint security scanning capability blocks viruses, malware and malicious attacks. The user’s session and PC can also be protected with the Secure Workspace option, which encrypts all session files such as attachments, cookies, emails and passwords. This prevents sensitive information from being viewed or stolen even after a session ends and the user leaves the PC.
“The VPN interface is intuitive, which makes it easy for us to distribute remote access by delivering a text message to authenticate the end user, and the automated endpoint compliance scan increases security,” said Winkless.
“It has proven easy to deploy and manage. It’s also flexible, as we can expand and top up the number of concurrent users for short periods as we need to, which makes it cost-effective. We estimate the solution will pay for itself in a year, compared with the costs of licensing and support for a client-based VPN solution.”
It is possible to satisfy both the business and security requirements for remote access, whenever and wherever access is needed. This flexibility helps to ensure an organisation is prepared for any event.