To protect endpoints, agencies must get their priorities straight
Connecting state and local government leaders
Agencies should first deploy endpoint protection for their most important assets, then work through a risk-based priority list.
Endpoint protection has always been difficult for federal agencies, but with COVID-19 and a sharp increase in work-from-home scenarios, the challenge has grown dramatically.
Just 57% of respondents to a recent SolarWinds survey rated their endpoint protection capabilities as “mature.” This survey was conducted before the pandemic forced most government professionals to work remotely. With staff undoubtedly using personal devices and cloud-based applications more than ever, the increasingly large list of endpoints could prove enticing to enterprising bad actors. Some of those devices and applications may be known to their organizations’ IT professionals, but many more may operate as shadow IT.
And yet, endpoint protection has been around for years. So why haven’t agencies gotten better at it? And what can be done to improve defenses?
Too many endpoints, too little time and control
Today, it’s not unusual for large agencies to have thousands of endpoints to manage. IT teams regularly add or swap out vendors and technologies to get the best services and prices, adding to the complexity and breadth of their enterprise landscape. Remote work compounds the challenge as users depend on more and different applications to do their jobs. Those thousands of endpoints can easily become tens of thousands, which can be time-consuming and costly to defend.
Then there are personal mobile devices. Even though the bring-your-own-device trend has been with us for a while, it’s still difficult for IT administrators to protect these devices, since they don’t have the appropriate permissions to enforce endpoint protection on employees’ iPhones, Androids and iPads.
While these are large-scale challenges, they’re not insurmountable. IT administrators can get a better handle on endpoint protection by prioritizing and protecting their most critical assets and educating workers on cybersecurity perils.
Prioritization is key to better endpoint protection
In a perfect world, administrators would be able to implement endpoint protection on every asset used by agency employees. But as COVID-19 has shown, we don’t live in a perfect world. The next best course of action is to prioritize what assets receive endpoint protection.
At the top of the list should be an agency’s most critical assets, such as physical and virtual servers. Additionally, administrators should establish user risk profiles based on rank, roles and responsibilities. People with access to particularly sensitive data should be considered greater potential risks, as they’re more likely to become targets of a hacker’s attentions. That means it’s even more important to focus on protecting the endpoints they use frequently.
Following the prioritization of critical assets, administrators can develop a strategy for addressing the remaining endpoints. These can likely be covered through endpoint detection and response technologies, which can be used to automatically defend against ransomware and other attacks. Administrators can then work to eliminate additional blind spots.
Engaging the workforce in the cybersecurity fight
Buoyed by workers’ fears and concerns, attackers have gotten creative with pandemic-related phishing, ransomware and other insidious tactics. While there are exceptional technologies to monitor, mitigate and repel these types of attacks, hackers are always looking for ways around these solutions. As such, there must be another layer of protection beyond asset prioritization: user education.
Like everyone else, government workers are currently under a significant stress, which could make them even more susceptible to an attack. For example, a user may receive a fake email promising a stimulus check, click on it and unwittingly provide a bad actor with entry into the agency’s network.
Now’s the time to remind staff how to spot something nefarious and how to report it if they do. Administrators can point out obvious tells that signify an email may not be legitimate -- burner email accounts that don’t appear to be coming from the agency’s domain or improperly worded phrases and content. Advise employees to send anything remotely suspicious to their IT administrator. Often, skepticism is the best endpoint protection.
One of the respondents to the same cybersecurity survey likened their situation to “waiting for a ticking time bomb to go off.” Administrators can defuse this bomb by taking one step at a time when it comes to endpoint security. They should prioritize the most important assets, work down from there, and ensure user education is solid. This combination can help agencies get a better handle on their growing cybersecurity challenges.
NEXT STORY: Free tech tools for election officials