How do you handle cybersecurity for remote or hybrid teams?

[-]

PA-ITPro@reddit

u/Necessary-Glove6682 You may need to provide more context so that we can better understand your scenario. Most importantly, what types of applications do these BYOD / Home users access? \- If they are accessing all Web / SaaS applications, Island IO should work \- If they need access to Windows / Client-Server apps in your datacenter, consider Microsoft RDS with TruGrid SecureRDP

Reply

[-]

growthwellness@reddit

We’re mostly remote now and keeping it sane has been a mix of simple layers rather than one monster tool: Microsoft Defender for Endpoint on every company owned laptop, DNS filtering (we use Cloudflare Gateway) so sketchy links die early, plus MFA on everything that touches the corp data. For connections we ditched the old VPN and went with a lightweight ZTNA setup basically a cloud proxy that checks device health before it lets you into Intune managed resources. Personal machines only get email and Slack through the browser; anything heavier needs a managed device, which Workwize ships out and swaps when the hardware’s out of date so we’re not begging people to patch a six year old Lenovo. It’s not enterprise grade bells and whistles, but it keeps the auditors calm without turning employees into help desk frequent fliers.

Reply

[-]

ArchonTheta@reddit

Stop with the personal devices and get them to purchase proper hardware that is managed.

Reply

[-]

hashkent@reddit

My work just asked a remote employee to fly to the office and pick up their new MacBook Pro. The old one was just out of warranty- no real problems otherwise and still getting updates etc. Employee gets to keep the old machine too after removing from apple and remote wipe. No more shipping to remote people must be picked up in person.

Reply

[-]

PowerShellGenius@reddit

Why no shipping?

Reply

[-]

PowerShellGenius@reddit

>without going full enterprise? Just to clarify what "full enterprise" is - large companies spend millions just on cybersecurity. They have MDR (or EDR is sufficient only if they run their own 24/7 SOC). They have some sort of ZTNA or VPN solution that confirms the company devices aren't behind on updates before letting them connect to the network. They have full remote management on all their work-issued devices. They have professional pentests (where they hire "good guy" hackers to try to hack them, and reveal any security holes to fix) on a regular basis; these often cost six figures each time. Simple things like users working from work-owned devices where the user isn't an admin - are not going "full enterprise". They are a fundamental part of not being reckless at any size org.

Reply

[-]

unciemafmaf@reddit

They shouldn't be working on personal devices. If they have to, you would want them to have a separate business account through entra ID, download policies through intune and use encryption, like bitlocker. You would also want to employ a SASE solution to navigate personal and public wifi. If they simply connect to your environment on a personal device, no encryption, no management, no restriction, then you can't call them secure in any fashion

Reply

[-]

MrKingCrilla@reddit

Honor system and pinkie promises

Reply

[-]

Hollow3ddd@reddit

Yea, guy said he had bit locker on, so we all good!

Reply

[-]

Det_23324@reddit

Keeping things secure on personal devices will be super difficult. People can deny you putting anything on their device because it's not company provided. In the past though users did let us put AV's on their laptops.

Reply

[-]

raip@reddit

This is where I like the whole concept of "Enterprise Browsers" like Island. It's no longer "install our A/V/EDR/XDR/MDM" it's just simply install this browser or browser extension for access to our stuff and because you control Layers 7 > 4 at that point, you can effectively secure everything. The only thing that sucks is that it locks you into only SaaS or RemoteApp offerings.

Reply

[-]

HDClown@reddit

The problem with remote browser isolation and also RemoteApp/RDS/VDI from personal devices is they are susceptible to screen recording, keylogging, and RAT's. If any of those are on the device being used, you are at risk of data leakage. It's not the same as if a company let a personal device store/transmit company data directly via personal computer, but sensitive data can still be leaked if a threat actor can only log keystrokes or read a screen. A lot of company just accept this risk profile exists when deploying access via these methods to personal computers, but it should still be taken into consideration.

Reply

[-]

raip@reddit

Island blocks screen recording through software. There's not much you can do about someone busting out a camera and snapping a picture - but they offer watermarking and sensitive data obfuscation as well.

Reply

[-]

HDClown@reddit

Screen recording blocking still leaves malicious keyloggers and RAT's (someone live viewing the screen). Easy for that type of software to get on a careless person's personal device. Obfuscating sensitive data won't be very viable for someone whose job requires them to interact with sensitive data. There's always going to be a higher risk profile for someone using a personal computer to access company data.

Reply

[-]

raip@reddit

I don't disagree with your last point. It'll always be harder to protect devices that you don't control. The screen blocking feature also blocks live viewing. They also have something for key logging but I haven't tested it against our test suite yet. It fills the keystroke buffer with random characters, which in theory could be a pretty solid solution.

Reply

[-]

HDClown@reddit

Which browser product is this, I want to check it out?

Reply

[-]

raip@reddit

Island Enterprise Browser

Reply

[-]

baconbitswi@reddit

Island private access with a on prem connector works pretty wonderful for those non-cloud apps

Reply

[-]

raip@reddit

Sorry, I know I said SaaS but I really meant non-Web. My bad.

Reply

[-]

Bibblejw@reddit

This is pretty much it. You can’t control what you don’t own. If you own it, it’s your build, your policy, and you can lock it down as you like. If it’s not yours, then you have no capability to mandate anything.

Reply

[-]

chesser45@reddit

VDI? Or managed browser like Chrome or others? But without full ownership you can only protect so much.

Reply

[-]

PowerShellGenius@reddit

Are you trying to make it "secure" for them to use personal devices to work remotely? Or, are you trying to secure your systems by ensuring they are using their work-provided device and can't log in from a personal device?

Reply

[-]

awnawkareninah@reddit

We don't let people use personal devices. Honestly it's that or set up VDEs or something

Reply

[-]

DrSteppo@reddit

Agentless VDI access (browser-based) with MFA. InTune or Workspace ONE with data egress disabled.

Reply

[-]

gregory92024@reddit

There are a few good ways to do this, depending on what they are accessing. Zero trust works for some, VPN works for others, virtual desktop works in some cases. Happy to talk, DM me.

Reply

[-]

Unlikely_Zucchini574@reddit

> What’s a realistic setup to keep things secure without going full enterprise? MFA is the bare minimum. You're asking for trouble though if you're letting personal devices access VPN,Windows file shares, AD, etc. Regardless of security, supporting personal devices is a nightmare. You have no standardization, you likely have no solid remote access, and anything you do that breaks their Candy Crush will now be your fault.

Reply

[-]

Zerowig@reddit

Citrix apps or a cloud desktop are about the only thing not too enterprise you could do for personal devices.

Reply

[-]

NoradIV@reddit

I would perhaps consider a RDS or something of the like. With BYOD, I don't see any other realistic options.

Reply

[-]

Barrerayy@reddit

You can't really, the best option is to just provide them a laptop or have them remote into a company owned desktop / vm etc for work

Reply

[-]

bjc1960@reddit

If personal phones, you can use MAM and force them into the MS apps with Defender for iOS. That is a realistic setup. You can force min iOS versions, a lot of settings such as preventing copy/paste

Reply

[-]

zombieblackbird@reddit

Everything went to the cloud years ago. All of my office wifi is public and treated as such. Zscaler handles all of the dirty work. Regardless of where the user is, the experience and security is the same. No manual VPN, no enterprise network drama. It worked out well.

Reply

[-]

BornToReboot@reddit

RDP or VPN + MFA + EDR

Reply

[-]

tuxedo_jack@reddit

They better be using AVD / Cloud PC / AWS VMs, then. If they want to use MSRDC / MSRDCW to connect in, that's fine and okay, but personal devices... ew.

Reply

[-]

_DoogieLion@reddit

Using personal devices? Unless you’re using some Remote Desktop mechanism good luck. More or less a non-starter as you will have such limited control of those devices and any malware, keyloggers etc that may be on them.

Reply

[-]

vane1978@reddit

If you can’t provide company laptops to your users then your next step is to have them use Security Keys when connecting to VPN and SaaS websites (or anything that’s work related).

Reply

[-]

idrinkpastawater@reddit

Its going to be very difficult to handle anything security related if they are using personal devices. Your best bet is to just procure company equipment for them. Then, use Microsoft 365 to manage and lock them down.

Reply

[-]

hybrid0404@reddit

2FA for everything is the standard. Beyond that, securing personal devices is basically doomed from the start. This is why places have VDI. You still have some concerns with the machine they're typing from being compromised if you're using password but there should be minimal data on their personal device as it should be all controlled on your corporate assets.

Reply

[-]

Shoddy_Pound_3221@reddit

Intune and Defender

Reply

[-]

Helpjuice@reddit

Why are they using their personal device? This is problem number 1 as companies should be providing all of the equipment their employees need to work. Fix this so you can deploy enterprise grade cybersecurity, which cannot and should never do on someone's personal device which they should never be using to do their day to day work.

Reply

[-]

Resident-Artichoke85@reddit

Some sort of security posture assessment before allowing authentication to complete (e.g. w/VPN). A security posture assessment should require the OS to be patched within the last 30 days, some sort of anti-virus/anti-malware to be installed, operational, and updated within the past 5 days, etc. If they fail this, it gives them generic instructions as to what has to be done before they can connect. Everything remote should also always be required to use MFA for the first auth of the day.

Reply

[-]

evopb@reddit

It's already hard enough to keep this secure in an enterprise setting. Depending on the data your users will have, it might not even be compliant standards or even laws.

Reply

[-]

karmak0smik@reddit

Corporate security on personal devices relies on what are they are connecting to and not from. ZTNA is the best approach to tackle this.

Reply

[-]

dude_named_will@reddit

VPN with MFA should eliminate most of your concerns. Of course I have to remind remote users to connect their printers via USB or else they can't print when they are connected to the VPN. Aside from that, I've really enjoyed turning my domain on-prem environment into a hybrid one with Microsoft Entra. For remote employees, I log them in with their Microsoft account instead of domain and it works wonderfully. You'll need the Entra license for them to do this. For on-site employees, I still set them up the old fashioned way. I also use the built-in tool Quick Assist for any troubleshooting.

Reply

[-]

New-Rip3329@reddit

Good luck

Reply

[-]

brunozp@reddit

The answer is it depends... What do you need to secure? Documents, navigation, data leak, company's network...

Reply

Reply to Post

45 Comments