Skip to content
Tiatra, LLCTiatra, LLC
Tiatra, LLC
Information Technology Solutions for Washington, DC Government Agencies
  • Home
  • About Us
  • Services
    • IT Engineering and Support
    • Software Development
    • Information Assurance and Testing
    • Project and Program Management
  • Clients & Partners
  • Careers
  • News
  • Contact
 
  • Home
  • About Us
  • Services
    • IT Engineering and Support
    • Software Development
    • Information Assurance and Testing
    • Project and Program Management
  • Clients & Partners
  • Careers
  • News
  • Contact

Securing the front-line

Cyber attacks are big business for scammers, and frontline workers – 80% of the global workforce* – are a ripe target.

It’s a common scenario, played out in retail, healthcare, manufacturing, logistics… a worker uses a computer that’s left logged in, or alternatively, asks a coworker ‘what’s the login?’  

Then they jump on to get their task done. Their activity – and everyone else’s – is logged as “Ward 9 North PEC team” or “Warehouse”, not by their name. 

Without a network identity of their own, they can’t have a company email account, so they log on to their personal email to send some customer information to another coworker, or type it into a personal messenger app on their phone. 

“Can you get Psychiatry CL to see Jane Jones 9 North bed 6 URN 9551389 today — pt has been inpatient for 74 days with recurrent infections / spinal surgery and has been feeling hopeless about her return home.”

That’s dummy information, but if it made you uncomfortable reading it, consider that this kind of potentially calamitous information sharing over personal apps happens every day in many settings. 

Although this may be well-meaning, sharing of access and use of personal apps puts organisations at enormous risk, both of breaching privacy regulations and reputational damage. 

There are also often huge costs of remediating security breaches if an attacker takes advantage of leaked information, as highly paid consultants are parachuted in to forensically analyse what happened. 

Employees may not even know they’re doing the wrong thing by emailing sensitive company information to another coworker on a personal email system, but even if a company wants to stop it, it may be hard to determine who is doing it. 

Of greatest concern, though, is that staff are left unprotected against social engineering attacks when they’re using a patchwork of different personal apps to communicate. 

Corporate messaging and email apps are designed with layers of machine learning anti-spam and anti-phishing systems, but personal apps may only have the most rudimentary protection against unsolicited contact, if at all. 

The cost of frontline security breaches

A ransomware attack in May 2021 on the Colonial Pipeline in the USA was the result of a single leaked username and password combination. 

The company paid over $6 million ($US4.4M) in ransom to the attackers for the key to decrypt the encrypted servers and not publish 100GB of stolen data. 

However, this was a tiny fraction of the cost of halting its entire $8 billion pipeline operation – responsible for delivering 45% of fuel to the East Coast of the United States – for several days, and the enormous security response from external consultants needed to re-secure the whole system. 

It disrupted flight schedules as airports ran low on fuel and prompted President Biden to declare a State of Emergency to allow more fuel than usual to be carried by road freight. 

Closer to home, several Australian health networks have been subject to ransomware attacks as well, causing cancellation of elective surgery services and crippling throughput through hospitals as staff reverted to fully manual patient record keeping.

A plant operator at a water utility in Florida who noticed his mouse cursor moving on his screen wasn’t initially alarmed when he saw what he thought was  his boss using Teamviewer remote control software to fix things on his computer. 

Luckily, he noticed the mouse cursor adjusting the levels of sodium hydroxide from 100 parts per million to 11,100 parts per million in the water plant. At those levels, the water would have damaged human tissue and flowed out of thousands of neighbourhood taps within 24-36 hours. It turned out his Teamviewer login credentials had been compromised and it was an intruder making the adjustments. 

Securing frontline workers

Solutions now exist to make securing the frontline easier. Here are four key recommendations from Google: 

#1 Train, drill and train again

Frontline workers aren’t always in constant contact with other workers, so they don’t necessarily have the benefit of hearing about new types of security attacks that the company is seeing. So, proactive cyber security awareness training of frontline workers is the first thing every organisation should be doing. Training should also include regular drill activities to put workers through simulated phishing exercises, for example, to see which staff need to be targeted with more training. 

#2 Give everyone an identity

It’s a false economy to think it’s cheaper for frontline workers to share network identities. If they don’t have a unique identity, they can’t have email which means they will be using their own personal email platforms. These won’t be protected by sophisticated systems guarding against social engineering attacks. It only takes one phishing attack to work, tricking an employee into typing one of the shared network credentials into a fake login page. The company will then have an intruder in the network, using a shared credential that many other workers are using, making it harder to detect and see what has happened. 

#3 Provision devices correctly

Many frontline workers will be using their own consumer devices. If they are conducting work activities on that device without a management system that’s a huge risk of data loss, both through insecure applications and through device loss. You need to have a device management system in place that can secure the work information even within an employee’s personal device. If the device is lost, you’ll be able to wipe the work information without affecting the employee’s family photo library. 

#4 Use second factor authentication

Companies have started using SMS-based second factor authentication, and that is better than nothing. However, attackers are sophisticated and becoming accustomed to getting access to SMS based codes. This can either be through social engineering (“Hi, it’s IT… I’m about to send you a code to verify this call before I discuss the matter with you…”) or through porting a mobile service to a different SIM card. What’s really needed is hardware based 2FA – a security key that can plug into a laptop or phone, or even just be held near it and detected through NFC. These solutions are now inexpensive, easy to deploy, and importantly, even if an attacker gets a username and password, they won’t be able to log in because there’s no way to emulate the hardware token. 

How Google can help

Google has decades of experience in detecting and blocking attacks on its own infrastructure, automated through sophisticated machine learning and artificial intelligence. That experience can help your organisation too.

Gmail – now part of Google Workspace – automatically blocks 99.99% of inbound spam and phishing attacks (100 million phishing attacks daily). Google hasn’t been made aware of a single customer participating in Google’s Advanced Protection Program  that has been successfully phished. Google’s phishing protection can detect new URLs being used for phishing attacks before they’ve been manually reported by anyone, due to Google’s ability to parse websites and determine intent.

Google BeyondCorp allows employees to work safely from anywhere, without first connecting to a VPN, using a hardware key for robust authentication that is highly resistant to any known forms of emulation or practical attack.

Google Cloud Identity allows users to be provisioned with network identities quickly and easily, with automatic provisioning of the Google Workspace suite of services, along with other important ecosystem apps like Slack, Docusign and many others. 

Google Endpoint Management allows Google Pixel devices to be seamlessly integrated with Google Cloud Identity to sandbox work apps and information so they can be managed by the company, without affecting a user’s personal apps and information. It also manages other Windows 10, Android devices and iPhones/iPads.

Google’s new Work Safer initiative brings together the Google Workspace suite of applications, the BeyondCorp, Cloud Identity, Data Loss Prevention and Endpoint Management, helping take the guesswork out of purchasing a comprehensive security solution, even for organisations without in-house expertise. 

It also includes Recaptcha to protect your company website from bots and malicious users and Google Chrome Enterprise to provide consistent browser security across the enterprise, no matter what type of device is being used. 

Organisations can also choose to manage their own encryption keys for their Google Workspace, which means Google can’t access these organisations’ documents or see the contents of any data moving between our facilities. It’s an important feature for healthcare, for example, which has to meet very high standards of privacy and security around patient data. 

Google Drive has fine-grained control for administrators to set which users, or groups of users, can share data with external parties, while Google Workspace as a whole has advanced Data Loss Prevention which can automatically stop files with sensitive data in them from being shared (where there are customers’ Medicare numbers or bank account details, for example).

Learn more about securing your frontline workers with Google.

* Rise of the Deskless Workforce, 2018, http://desklessworkforce2018.com/


Read More from This Article: Securing the front-line
Source: News

Category: NewsDecember 28, 2021
Tags: art

Post navigation

PreviousPrevious post:The tech behind the future of workNextNext post:Solving the technology gap at the front line

Related posts

휴먼컨설팅그룹, HR 솔루션 ‘휴넬’ 업그레이드 발표
May 9, 2025
Epicor expands AI offerings, launches new green initiative
May 9, 2025
MS도 합류··· 구글의 A2A 프로토콜, AI 에이전트 분야의 공용어 될까?
May 9, 2025
오픈AI, 아시아 4국에 데이터 레지던시 도입··· 한국 기업 데이터는 한국 서버에 저장
May 9, 2025
SAS supercharges Viya platform with AI agents, copilots, and synthetic data tools
May 8, 2025
IBM aims to set industry standard for enterprise AI with ITBench SaaS launch
May 8, 2025
Recent Posts
  • 휴먼컨설팅그룹, HR 솔루션 ‘휴넬’ 업그레이드 발표
  • Epicor expands AI offerings, launches new green initiative
  • MS도 합류··· 구글의 A2A 프로토콜, AI 에이전트 분야의 공용어 될까?
  • 오픈AI, 아시아 4국에 데이터 레지던시 도입··· 한국 기업 데이터는 한국 서버에 저장
  • SAS supercharges Viya platform with AI agents, copilots, and synthetic data tools
Recent Comments
    Archives
    • May 2025
    • April 2025
    • March 2025
    • February 2025
    • January 2025
    • December 2024
    • November 2024
    • October 2024
    • September 2024
    • August 2024
    • July 2024
    • June 2024
    • May 2024
    • April 2024
    • March 2024
    • February 2024
    • January 2024
    • December 2023
    • November 2023
    • October 2023
    • September 2023
    • August 2023
    • July 2023
    • June 2023
    • May 2023
    • April 2023
    • March 2023
    • February 2023
    • January 2023
    • December 2022
    • November 2022
    • October 2022
    • September 2022
    • August 2022
    • July 2022
    • June 2022
    • May 2022
    • April 2022
    • March 2022
    • February 2022
    • January 2022
    • December 2021
    • November 2021
    • October 2021
    • September 2021
    • August 2021
    • July 2021
    • June 2021
    • May 2021
    • April 2021
    • March 2021
    • February 2021
    • January 2021
    • December 2020
    • November 2020
    • October 2020
    • September 2020
    • August 2020
    • July 2020
    • June 2020
    • May 2020
    • April 2020
    • January 2020
    • December 2019
    • November 2019
    • October 2019
    • September 2019
    • August 2019
    • July 2019
    • June 2019
    • May 2019
    • April 2019
    • March 2019
    • February 2019
    • January 2019
    • December 2018
    • November 2018
    • October 2018
    • September 2018
    • August 2018
    • July 2018
    • June 2018
    • May 2018
    • April 2018
    • March 2018
    • February 2018
    • January 2018
    • December 2017
    • November 2017
    • October 2017
    • September 2017
    • August 2017
    • July 2017
    • June 2017
    • May 2017
    • April 2017
    • March 2017
    • February 2017
    • January 2017
    Categories
    • News
    Meta
    • Log in
    • Entries feed
    • Comments feed
    • WordPress.org
    Tiatra LLC.

    Tiatra, LLC, based in the Washington, DC metropolitan area, proudly serves federal government agencies, organizations that work with the government and other commercial businesses and organizations. Tiatra specializes in a broad range of information technology (IT) development and management services incorporating solid engineering, attention to client needs, and meeting or exceeding any security parameters required. Our small yet innovative company is structured with a full complement of the necessary technical experts, working with hands-on management, to provide a high level of service and competitive pricing for your systems and engineering requirements.

    Find us on:

    FacebookTwitterLinkedin

    Submitclear

    Tiatra, LLC
    Copyright 2016. All rights reserved.