The 'hope and prayer' strategy for teleworking security

Federal agencies with sensitive missions have historically resisted investing in and expanding teleworking and mobile solutions, choosing instead to keep confidential information confined to office secure spaces. Ironically, the rapid shift to teleworking in response to COVID-19 has meant that mobile devices once banned from secure spaces are now often critical enablers of remote work. Agencies now have an opportunity to accept the reality that smartphones and tablets can -- with proper security mitigations -- become vital tools for mission success.

Let’s rewind back to the halcyon days of 2019.

At one particular office in the Pentagon charged with architecting and financing the backbone of a global communications network, employees and visitors alike had to lock up their smartphones at the door. Here, collaboration meant traveling to meet in person with colleagues and mission partners around the world. And here, only the director was provided a government-furnished smartphone -- and thus the ability to maintain productivity away from one specific desk. So not only could the rest of the staff not access government systems remotely, but they couldn’t even use a smartphone or tablet within the Pentagon to make decisions on the go or use as an additional work screen, creating a very real productivity and morale deficit. And of course, the staff all carried their own personal devices everywhere they could.

Decision-makers have been keenly aware of the security problems associated with smartphones and tablets, including the remote capture of confidential information via cameras and microphones and the invisible exfiltration of this data. But rather than empower the workforce through high-security mobility, there was instead a total ban on mobile devices in the office and a “hope and prayer” strategy for everywhere else – specifically, faith that any discussions outside the office involving confidential information, however vague, wouldn’t be captured through workers’ smartphones and tablets by a determined adversary looking to piece together critical information.

Fast forward to 2020 and the outbreak of the coronavirus. In a matter of weeks, agencies displayed tremendous resilience in the current operating environment by expanding teleworking options for those typically working within secure spaces. On the personnel side, agencies have been not only developing situational telework agreements with eligible workers but also to reassessing if workers not previously eligible for working remotely could now do so. On the systems side, organizations have implemented ad hoc solutions for providing access to confidential information – the Department of Defense’s Commercial Virtual Remote system, which enables cloud-based services like teleconferencing, chat and document collaboration from government-furnished and personal devices, is a prime example. On the device side, emergency funding provided by the CARES Act has given organizations the ability to purchase laptops and other devices at scale to meet the current demand for remote work. And on the process side, efforts have been made to revise workflows so that more can be accomplished at the confidential unclassified level, as is the case with the National Geospatial-Intelligence Agency.

The result of these efforts is that hundreds of thousands of defense and intelligence workers are able to work on confidential documents and have regular confidential meetings at home. In effect, these agencies have progressed from the 1980s’ desk-centric working style to the 2020s’ mobile-centric way of getting work done. This progress is long overdue. Not only was the old way a huge impediment to productivity, morale and recruiting, it wasn’t suitable for a world where information is open-source, commercial and in the cloud. And the pandemic drives home the need for resiliency in an ever-changing and globally connected world.

The one caveat to this progress is that the “hope and prayer” strategy for confidential information shared by workers in the presence of smartphones and tablets is now a full-time strategy, as many workers likely have their devices with them throughout the entire day, including in the presence of confidential documents and conversations. Compounding this risk, adversaries have been itching to take advantage of the security cracks made from this rapid work-from-home enablement and the increased attack surface that comes from having employees with sensitive missions work from a series of less secure home networks. It is virtually impossible for administrators to control hundreds of thousands of home internet and phone networks globally, rendering the old ways of protecting information with boundaries, walls and lockboxes – whether virtual or physical – gravely insufficient.

Rather than continue the “hope and prayer” strategy, federal agencies with sensitive missions should use this crisis as a critical use case for enabling remote workers while ensuring that confidential information and mission success aren’t compromised. In fact, there are already a variety of efforts underway to mitigate security and continuity risks, and agencies simply need to double down on the most promising efforts. These include:

• Widespread mobile enablement: An adaptive and responsive workforce that can continually maintain high productivity via government-furnished or employee-supplied (and administrator-managed) mobile capabilities is critical for federal agencies with sensitive missions. This is certainly true during a pandemic, but it’s also true when the operations manager works from home to nurse a broken ankle or when the budget director is running between off-site meetings all day.
• Mobile hardening: Mobile hardening involves physically hardening a smartphone or tablet so that its cameras and microphones can’t be used to capture meaningful audio or visual data. So whether individuals are working within a secure space, outside the office or in a home environment, their device can’t be used for spying.
• Enhanced identity verification through continuous multi-factor authentication: With remote access, being able to securely identify and verify credentials of authorized users is absolutely critical. A robust CMFA capability can leverage mobile device sensors to develop a real-time, continuously updated trust score for a user based on a variety of behavioral traits, biometrics and contextual data. Deploying CMFA solutions means that remote workers can use their mobile devices to safely log into government systems from anywhere.
• Device convergence: Rather than investing in a desktop computer, laptop and smartphone for every user, device convergence provides the opportunity to purchase a single device suitable for on-premise, on-the-go and off-site experiences. Importantly, a converged device can overcome many of the weaknesses preventing security-conscious organizations from trusting in mobile solutions.

Whether COVID-19 is a time-limited crisis or a harbinger of an increasingly erratic world, the message is clear: organizations that fail to embrace remote work now will be caught playing catch-up in the future. Instead of being boxed in by world events, federal agencies with sensitive missions can choose instead to become vanguards of high-security mobility, ready to safely and efficiently carry out missions no matter the situation.