Cloud platforms host customer databases, powering worldwide eCommerce empires. They allow workers in different countries to communicate, share files, and collaborate on complex projects. And they reduce hardware overheads, driving down costs.

Whatever role they play, cloud services need robust protection. This blog will look at how to secure assets on GCP. While Google’s tools offer some protection, there are plenty of things companies can do to supplement those tools. Let’s look in more detail and offer some best practices to boost your Google Cloud security.

What is GCP?

Google Cloud Platform is a collection of cloud-based services based on the powerful Google Compute Engine. GCP allows users to host apps, store data, implement machine learning processes, and manage app development. It also integrates with other Google services, including Gmail and Docs.

GCP can host a few SaaS apps or scale up to IaaS and PaaS implementations. It is a go-to platform for hosting Kubernetes cubes and cloud storage containers, with a strong record for resource availability. However, clients must implement their own security controls to protect resources hosted by GCP.

GCP security seeks to protect assets hosted on the Google Cloud Platform. The scope of security policies varies depending on each user’s cloud architecture. For example, if you use a single SaaS service, security mainly relates to access control to that individual app. But if you use a PaaS solution, security must apply across the infrastructure stack.

What challenges does Google Cloud Platform face?

GCP users face a range of security challenges. Here are some critical issues you will likely face when following GCP security best practices.

1. Ensuring visibility

The flexibility of GCP makes it popular with cloud architects. But flexibility comes with a price: confused and complex visibility. Cloud assets can come online and disappear within hours. Security teams may not know when app configurations change. Keeping track of cloud-based assets can become extremely difficult.

Tracking threats and applying security controls is impossible without strong visibility. You cannot secure apps that change constantly. Environments with poorly controlled user privileges can spiral out of control, creating huge surfaces for data thieves to exploit.

2. Managing privileges

Over-provisioned users pose a critical threat to cloud environments. If attackers gain the credentials of over-provisioned users, they can access confidential data, change app settings, and compromise cloud performance. Watertight access control is essential.

Security teams must create logical privileges for roles and individuals. Every GCP-hosted app requires a separate privileges policy. And admins must classify data, keeping sensitive information locked away from most users.

3. Application sprawl

Without clear policies on provisioning apps, GCP environments easily fall victim to application sprawl. It is extremely easy to spin up virtual machines or add new apps on the Google platform. The resource hierarchy can change in an instant.

Balancing flexibility and security is a central challenge. Companies need clear hierarchies that reflect their organizational needs. But users need the freedom to reshape cloud environments to fit different circumstances.

4. Identity management at the cloud edge

Managing access to on-premises networks is simple. Authentication occurs at a well-defined edge. But this isn’t the case with GCP. Users can access a cloud resource anywhere. They can use multiple devices and log on via insecure public networks. This makes robust IAM essential.

Security teams require ways to authenticate every connection request. This is particularly difficult in multi-cloud settings. As a result, companies often implement Single Sign On (SSO) to bring all cloud assets together.

5. Cloud misconfigurations

Poorly configured GCP apps present an open door for attackers. For instance, researchers have expressed concerns about attacks originating from misconfigured virtual machines.

Users can also misconfigure the internal IAM tools that Google provides. Administrators may fail to apply domain restricted sharing to GCP containers. Or they might fail to engage logging services to detect threats and weaknesses.

Another common issue is misconfigured VPC firewalls. These firewalls surround cloud data with additional protection. But admins can set overly broad IP address ranges, permitting too much access to sensitive data.

6. Uncontrolled outbound access

Users must secure access to networks. But they also need to manage data flows from cloud assets. Data Loss Prevention (DLP) tools can track files and data and block unauthorized exfiltration. But restrictions on outbound access are not always applied properly.

7. Unpatched GCP assets

Unpatched VMs present a constant security risk. Attackers can exploit privileged access to connected resources or launch horizontal attacks if cloud environments are improperly segmented.

GCP users are responsible for patch management. However, they are not always aware of their duties under the shared responsibility model. Legacy threat scanning tools can also miss unpatched cloud assets. Cloud-native, automated update management tools can fill the gap if security teams choose to use them.

Why is GCP security Important?

There are three core reasons to follow GCP security best practices:

• The GCP hosts vast amounts of confidential information. Data encryption, robust authorization and authentication processes are critical to prevent malicious access to this data.
• Assets on GCP are available 24/7 for companies to access. This maximizes uptime and availability. But it broadens the threat surface, requiring robust security counter-measures.
• Data security regulations apply to critical assets. Users of GCP must protect information covered by GDPR, HIPAA, or PCI-DSS.

These three issues demand a comprehensive security response. Companies must classify and secure data. They must manage access and apply encryption. And they need to apply regulatory frameworks through auditing and security planning.

Cloud-based security features in GCP

Google has included a wide range of security features in GCP. Best practices include leveraging these features where possible while supplementing them with external tools. Important internal security features include:

• Virtual Private Cloud (VPC) – Allows users to create segmented VMs or VM groups, with stateful firewalls and network security controls.
• Data encryption – All data in transit through the GCP is encrypted. Data at rest is also encrypted and unreadable to outsiders.
• Cloud Key Management – Centralized customer-managed keys tools allow administrators to distribute and change keys. This can integrate with hardware keys for secure remote access.
• Logging – Google provides access to continuous activity logs. Users can visualize security easily with real-time data.
• Data Loss Prevention (DLP) – Targets sensitive data and prevents outward transmission to unauthorized actors.
• Binary Authorization – Secures Kubernetes clusters by creating trusted workloads.
• Web App and API Protection (WAAP) – Monitors API activity for common cyberattacks. Allows users to assess integrations with GCP environments, making new app implementations safer.
• Identity and Access Management (IAM) – Enable users to control access to GCP environments. Provides a way to authorize actions within apps and groups. Unifies GCP workloads into one pane of glass.
• Cloud Asset Inventory – Allows admins to quickly inventory connected apps and track any changes as they occur.

External security systems work alongside these internal tools. For example, network penetration testing by third-party software can verify the effectiveness of GCP security. SSO and external IAM cover hybrid networks with multiple cloud deployments. VPNs encrypt data outside GCP, guarding user credentials.

Google Cloud Platform (GCP) security best practices

Companies need to create and implement a data security strategy for their GCP deployments.

This strategy should leverage the internal tools listed above while taking into account specific business needs. Best practices for GCP security include:

1. Implement Google Cloud IAM

Identity is the new battleground in cloud security. Attackers constantly seek high-value user credentials and access to confidential customer or corporate data. That’s why implementing Google’s native IAM systems should be a core priority.

Google IAM allows you to:

• Set privileges for GCP resources – The most important role of IAM. Admins can set permissions for roles or individuals and determine which apps or workloads are available to each cloud identity. Privileges can be extremely detailed to protect sensitive data. Or they can be more general for low-value assets.
• Enforce safe email policies. Only allow access to cloud platform services from corporate email accounts. Prevent access by personal accounts.
• Strengthen admin accounts with security key enforcement. Security keys are even more robust than MFA factors. They apply to high-privilege users such as senior developers or administrators.
• Prevent user access to service accounts used by VMs and automated processes. Reduce the number of user-managed service account keys to an absolute minimum.

A strong IAM system locks down user and service accounts. Insecure connections will be denied or limited. Access to resources will only be possible to authorized users based on need.

However, don’t stop with Google’s internal IAM. Some critical IAM cloud functions require outside assistance.

For example, when you use the GCP, you can allowlist IP addresses to block dangerous devices or networks. There is no realistic native way on Google Cloud to allowlist IP addresses. But you can use external allowlisting solutions like NordLayer to harden your overall cloud security setup.

2. Visualize your cloud environment

Google allows companies a lot of control over how they segment cloud environments. But to create a secure architecture, assets and data must be visible and well-understood.

Use GCP’s internal tools to discover connected apps and create a map of the assets you need to protect. Try to trace the connections between resources. If you understand data flows and user requirements, you can create efficient groups to apply security controls.

Connect roles to cloud assets and target privileges to guard resources. For example, accountants or sales teams may require access to cloud SQL instances, but other employees do not. Always map roles to assets to avoid over-privileging users.

3. Protect assets via Virtual Private Clouds (VPCs)

VPCs are guarded by internal firewalls but can communicate securely via VPC peering. IAM tools enable precise controls over VPC access, and you can create private clouds for projects or departments.

This segments the cloud environment, preventing horizontal movement for malicious actors. For instance, you can set robust barriers around cloud storage containers handling financial information – a valuable aspect of compliance strategies.

4. Use Customer Supplied Encryption Keys (CSEK)

Google Cloud Platform users can rely on keys supplied by Google. But they can also provide their own encryption keys. This is potentially a more secure option.

With CSEK, keys are only known to your employees. Nobody within Google can access them. You have total responsibility to manage and change them when needed.

By default, data handled by the Compute Engine is protected by 256-bit AES encryption. Customer-supplied keys supplement this protection. They also give you more control over assigning keys and managing access.

5. Enable MFA for Google Cloud resources

Multi-factor authentication adds an extra layer of identity protection when logging onto cloud assets.

MFA is not a default setting, so admins will need to remember to engage it via the IAM console. Google Cloud users can add third-party identity providers if required. This allows users to connect via external apps, making remote access more secure.

MFA options on GCP include various cloud identity factors. This includes one-time passwords, email codes, or secure links sent to user devices. You can use separate authentication hardware for high-security connections or rely on less secure SMS-based authentication for a smoother but less secure access process.

6. Centralize logging processes

Google Cloud’s best practices include achieving total awareness of user activity and app configurations. Google provides a suite of logging tools that collect and present information for security teams to monitor.

Users can implement Cloud Logging to collect data from Google Cloud projects. Each project has its own log bucket to contain data, and users can analyze this information via the Logs Explorer tool. You can also enable flow logs to gather information from Kubernetes clusters or VM groups.

If possible, integrate Cloud Logging with your enterprise-wide SIEM systems. Google lets you export log data to many popular SIEM solutions. This makes it easier to track network security via a single pane of glass. Specialist SIEM solutions also tend to provide more functionality than Google’s internal monitoring tools.

7. Use security foundations blueprints

Security managers do not need to work in the dark when implementing GCP best practices. Securing novel cloud settings such as GCP can be challenging without prior experience. That’s why Google offers a series of security foundation blueprints.

Blueprints provide guidance and recommended security practices. Subjects covered include critical tasks like key management, network segmentation, logging, and authentication. The information is presented in a general format but includes plenty of suggestions that will apply to most GCP implementations.

8. Automate security to boost efficiency

Administrators can automate many security functions on Google Cloud. Automation reduces the risk of human error and liberates time to spend on critical security tasks.

The Security Command Center collects threat intelligence and can automatically transfer alerts to third-party SIEM systems. Users can also create automated compliance policies to check that GCP assets are properly configured.

Admins can automate password security, demanding regular resets and enforcing strong passwords. And automated app updates help stay on top of virtual machine patches. Most tasks on Google Cloud have automation settings. Leverage them where possible as part of Cloud Security Posture Management (CSPM).

How NordLayer secures access to Google Cloud

Google Cloud Platform is an easy-to-use, flexible, and feature-rich cloud hosting platform. And many companies use Google Cloud as a location to store or exchange confidential data. This is efficient and cost-effective, but relying on GCP comes with security risks.

Following the GCP security best practices outlined above will help achieve data security. Users can encrypt information, set internal IAM policies for apps and containers, and create firewalls around virtual machines.

However, a robust GCP security posture requires a mix of Google’s internal security functions and external solutions. NordLayer provides the ideal solution when securing Google cloud deployments.

NordLayer allows admins to integrate GCP security into their general IAM setup. Users can ensure secure access to apps via MFA and use Single Sign On to access all cloud assets quickly. They can strengthen access control with IP address allowlisting, which admits authenticated users and blocks unknown or insecure IP addresses. NordLayer applies network segmentation to separate GCP assets and encrypts data in transit to hide it from outsiders.

Add another layer to your GCP security posture with NordLayer. Our tools allow you to combine external and internal security controls. The result will be a GCP security setup that covers every vulnerability. Contact the NordLayer team today to find out more.

Every company infrastructure setup is unique. Therefore, it may require a different approach to solving the same challenges — like how users can access office-based data, applications, or devices while not being present on that particular site.

The most common solution is to choose VPN for security purposes and enablement of distributed teams. However, the VPN selection depends on its type and existing company network arrangement.

If your target is to enable employees to securely connect to different offices and branches of the organization despite being elsewhere, Site-to-Site VPN is the option to explore.

Site-to-Site solution using NordLayer 

Site-to-Site allows users to reach office-bind resources on HQ, your assigned office, or another company branch while not actually being on-site. It is a type of VPN that establishes an encrypted connection to a requested resource on the company network.

NordLayer’s cloud-based feature elevates typical industry Site-to-Site capabilities by connecting not just different corporate sites and resources but by enabling both on-site present and remote users to connect to any company resource on the network.

Click to tweet

Therefore, connection to a single physical location via a virtual private gateway using VPN translates into user connection to all devices and resources assigned to a company router or firewall.

How does NordLayer’s Site-to-Site feature work?

The cloud-based feature can be enabled by connecting NordLayer’s virtual private gateway to the company’s router or firewall.

Moreover, cloud-based Site-to-Site makes it possible to configure a dedicated VPN server to connect to cloud service providers like Amazon AWS, Google Cloud, or Azure.

Users with VPN access – whether present in the branch office, HQ, or remote – can connect to the company network and access the added internal resources and the on-site devices connected to the router/firewall, even though they don’t support a VPN connection.

• Remote user connection:

• Connection from a company branch:
  

• Connection from HQ:
  

NordLayer’s Site-to-Site feature requires virtual private gateways and physical location configuration. Once it’s ready, a VPN connects users to the local company network and allows them to access company resources like applications, data, computers, or printers.

The same logic applies to users accessing the company’s cloud service provider resources. VPN established connection and router/firewall configuration to support IKEv2 Site-to-Site functionality with a static public IP address can provide access to resources for employees despite their location.

Shortly, suppose an employee for a job needs to access your organization’s customer information stored in a database located in HQ, the email server that stands in an office branch on another continent and needs to print it out while working from home. In that case, it’s all available via NordLayer’s Site-to-Site VPN functionality.

How NordLayer’s Site-to-Site is different?

Traditional WAN companies have an architecture based on an all-to-one setup when business units – remote locations and resources of the corporate – are connected to one main point.

Such organizations exploit extensive legacy Site-to-Site architectures that employees use to connect to the network’s main point, allowing them to access company-enclosed resources from different locations. This type of network architecture delivers interconnectivity yet lacks remote flexibility and has downsides affecting network performance, efficiency, and scalability.

As a solution to legacy Site-to-Site, NordLayer is developed to provide flexible and simple problem-solving to the general downsides of using legacy networking. When focusing on the feature functionality, the distinction between legacy setup and cloud-based remote network access solution comes from overcoming the limitations of traditional Site-to-Site solutions.

Cloud-based NordLayer solution handles legacy infrastructure challenges of increasing remote connections with quick integration to the existing architecture. It reverts performance–efficiency–scalability limitations to company advantage:

• Decreased deployment time and expenses. NordLayer solution is fully hardware-free and compatible with hardware-based or hybrid existing infrastructures. Functionalities can be deployed within minutes and don’t require complex costs and long delivery times, focusing on time-to-value for the organization.
• Maintained security and productivity levels. NordLayer Site-to-Site distributes encrypted user traffic to company resources based on the request nature without affecting connection quality instead of bulk processing all users to a primary point of connection and allocating to requested resources afterward. 
• User traffic distribution. The feature decreases the heavy traffic load directing users to the internet resources, internal data centers, servers, or applications in a more streamlined manner. Therefore, the increased remote user traffic peaks don’t impact performance quality as with a traditional Site-to-Site setup. 
• Efficiency and scalability. Naturally, user traffic distribution significantly reduces on-site equipment use managing the ad-hoc demand to upgrade. On the contrary, cloud-based Site-to-Site functionality enables the company to scale on demand without resource-intensive planning.  

The feature brings another level to team performance in business operations using Site-to-Site. NordLayer’s cloud-based feature ‘helps cut hardware-ing and distance corners’, bringing efficiency to secure data sharing and authorized access of on-site devices within the organizations, even if physically impossible.

Benefits of Site-to-Site VPN 

Primarily, Site-to-Site VPN allows for establishing non-office-only based connections. The VPN enables secure data transfers and trusted user activity between the on-premise network and the public network established over the internet.

Implementing NordLayer on top of your existing infrastructure, Site-to-Site unlocks effective and robust cybersecurity measures for various organizational aspects.

Increased network security

Sensitive data and confidential information is the target of most cyber attacks. Thus, encrypted data transfers between organization members utilizing Site-to-Site, whether in the office or remote, help safeguard against data breaches.

Streamlined business operations

Team performance is heavily related to the availability and capacity of the company network. Therefore, Site-to-Site feature maintains a good speed and stable data traffic flow to provide users with quality connectivity and constant access to resources that influence business continuity.

Flexible and scalable protection

Hardware-free Site-to-Site configuration is a beneficial add-on to the existing company network, even the largely hardware-based ones. Thus, the reaction-to-action time to solve ad-hoc challenges is multiple times shorter and easier. It requires minimal resources and provides a solution based on business needs within minutes. 

Entering NordLayer’s Site-to-Site

NordLayer solution provides a modern approach-based Site-to-Site VPN. The feature allows present and remote employees to access data and devices in multiple corporate environments.

Using our remote network access solution to enable Site-to-Site VPN for the organization, IT admins have to follow simple actions to configure the feature. First, they need to create VPN gateways via the Control Panel as entry points into the network and assign teams or role-based employees to access the gateway so they can enter the company network. Site-to-Site has to be configured for every company unit for the seamless cooperation of teams.

With fewer systems to manage, unlimited scalability, flexibility, and easy setup, companies can ensure smooth and productive connections for their users and maintain high-security levels of the business.

The pandemic became a massive sandbox that proved people don’t necessarily need to be nurtured by the office culture to be productive.

Workers argue that flexibility is their right whether they prefer to work in the best countries for remote work, like Germany, Denmark, the US, or any other location of their choice if the job is completed as requested. Management counters with the importance of organizational environment and team bond effectiveness created only by the presence in the office.

Both sides have their points, so what’s next — will we return to an on-site-only setup or transition to fully remote? Will more companies compromise on hybrid work after all? Let’s see where the remote work projections are guiding us.

How new is the ‘new normal’ of remote work?

It would be incorrect to say that remote work didn’t exist before 2020. Freelancers were the pioneers of working online — an adventurous and free-spirited career path. Before the pandemic, 2,9% of ‘teleworkers’ globally were exclusively working remotely. For instance, in the US market, only 6% had never worked in any kind of remote work setup.

The scope of work from home mainly spiked because of a safety measure to prevent virus spread. Even though the alertness settled and life started returning to normal, in 2022, at least occasional remote workers reached 62% globally.

According to Gallup research results, only 2 out of 10 people returned to the old routine — entirely on-site jobs. Meanwhile, the rest of 8 out of 10 employees are split between remote and hybrid work arrangements in the US.

The discussion mainly circles whether employees want to work exclusively remotely (49%) or want to share their time between home and the office (46%). Yet the same research reveals that only 6% of employees see the ideal work environment exclusively on-site.

Remote work tendency: to increase or decrease?

The swing in the longevity of time spent at home before and after the pandemic compares drastically. Let’s fact-check.

According to Statista, remote work in the US before the 2020s was a relatively rare yet existing event, occurring 1-2 times per week. However, 3-4 and 5+ days of work from home per week in the post-pandemic period replaced the then-popular 1-2 days/week work from home.

Talking numbers, the remote workforce reached 53%, and the pool of employees that never worked from home decreased by 13% after COVID-19.

The data of the US-based respondents reflects the increasing trend of staying at home rather than working from the office.

2020 was the rush-hour year, so comparing the difference jump from 2019 to 2021, the number remains increasing as the amount of remote workers has tripled. If we take data from 2018-2021, the fully remote workforce grew four times bigger.

How has remote work escalated in Europe? The growing tendency of remote work in European countries is also significant.

Eurostat data from 2019-2021 illustrates the increasing number of employed people spending more and more time working from home. The average of EU Member States climbed from

• 14,6% WFH sometimes or usually* in 2019, 
• 20,9% WFH sometimes or usually in 2020 to
• 24,4% WFH sometimes or usually in 2021. 

In 2021, the usually only working individuals made just a little less than sometimes or usually in 2019 — 13% in contrast to 14,6%. Note that ’usually’ refers to at least half of the work days spent working from home in a reference period of 4 weeks.

The shift is evident in both the US and Europe — remotes were quick to adapt to the circumstances and increasingly function between the office and home, identifying as remote workers.

Let’s not forget that the covid-era introduced a new work-life cultural concept, ‘workation,’ that combines working and vacationing simultaneously. Therefore, it’s challenging to believe that trend swing will take the working world back to the close-to-none remote setup.

Remote work perspective

It’s worth defining the happy medium for understanding remote work. There are different opinions — for some, it’s home-only; for others — home-never. A hybrid work setup seems acceptable for most organizations and employees that can apply non-site work arrangements.

The perspective of hybrid model growth should double from 42% in 2021 to 81% in 2024, according to AT&T findings. The forecast predicts almost one in four Americans will work remotely by 2025.

The prediction is supported by the forecast of conferencing software (like Teams, Zoom, or Google Meet) market growth — in 2021, it reached $14.6 billion worth, and in 2026 is expected to reach as high as $27.3 billion worth. The growing demand shows the need to communicate remotely in the future.

Hybrid work influencing factors

What are the influencing factors for hybrid work escalations — is it just the peer pressure of employees? 83% of professionals say they would decline a job offer without offering flexible work options, according to International Working Group.

Expectations are high as almost everyone (97%) expects organizations to be flexible regarding the work environment. FlexJob indicates that more than half (57%) of organization members would change jobs if they weren’t allowed to work hybrid. After all, 77% of employees see flexibility as the second most important factor after salary in their employment.

The reasoning behind it can be based on preference to save time on commuting, make Mondays less anxious without knowing you must show up in the office at 8 AM, or work from a different city or country.  

Productivity and engagement in remote work

Hybrid or remote work help achieve a better work-life balance that resolves into a positive chain reaction. Employees and organizations notice that staff is exposed to less stress, leading to workers being more present and engaged despite online environments.

It proves that hybrid work isn’t entirely a one-way road. At first, being unavailable to observe employees’ activity on-site might have needed convincing the management of the hybrid work benefits.

According to Zippia’s Remote Work Statistics report, 32.2% of managers agree that productivity has increased after the 2020 remote work shift. Generally, 68% of organizations say there’s been an improvement in employee productivity since the remote work arrangements. 

Return or not to return?

The determination to work remotely is clear for most of the employees. Besides the long list of benefits the workers learned by heart, 20% of the workforce who vouch for flexibility would agree to give up vacation time over office-defined work.

The worth of remote work can be calculated more precisely — a typical organization saves an average of $11,000 per employee yearly if the employee spends half of the working time outside the office.

Saving funds and time open more personal, team, and company opportunities. Organizations have a better chance to scale globally. It brings us to a solution to a raging issue of limited talent pool companies struggle with significantly.

Talent and remote work

Knowledge workers are in high demand to cover the growing need for professionals in all industries. According to Uplers’ research, 69% of companies face a shortage of skilled talent, and geographic limitations are one of the leading factors reserving the reach of the potential talent pool.

According to the Upwork study, companies with remote or hybrid work policies appear to be less negatively impacted by talent shortage — only every third of such organizations see a limited talent pool as a challenge. Half of the knowledge workers who provide computer programing, IT, marketing, and business consulting services to companies are freelancers.

Regarding company size, large companies tend to have a higher demand for talent that turns over with more noticeable talent shortages compared to small or medium-sized companies.

According to Manpower data, 64% of small companies (10-49 employees) struggle to find the right profile workers, while 72% of medium-sized companies (50-249 employees) and 74% of large enterprises (250+ employees) are impacted by a deficiency of skilled professionals.

Remote work by industry

Technological advancements and flexibility allow companies of various industries to adopt hybrid work for its benefit. It’s noticeable that consulting-type services are quicker to move to telecommute. The trend can be justified by the opportunities to unlock markets worldwide, streamline the workload, and better prepare for modern technological setups.

Taking hybrid work through the industry axis, IT is the leading industry to adopt remote work. Finance, customer service, healthcare, marketing, education, and sales industries are primary areas to explore and utilize the benefits of the remote workforce.

Remote work and security

The massive migration to remote work during the pandemic was kick-started for safety reasons. However, home offices opened gaps for cybersecurity vulnerabilities that many companies weren’t exposed to before.

According to Statista, cyberattacks are one of the major risks concerning organizations. Cyber threats increased exponentially with the growing number of unprotected home networks and distributed teams.

The other top risks on the list include human error, cloud computing vulnerabilities, mobile device security, and loss of corporate data and information, as the concerns of organizations in Europe and the US.

Securing hybrid environments

Many organizations proved flexible in times of change — growing cyberattacks and risks were repulsed with security and hybrid work-adapted business solutions. Transitioning to cloud environments allow companies not only to enable remote workers but implement hybrid infrastructure models to support new ways of working.

Circumstances determined businesses’ push to improve network security even though upgrading existing legacy architectures wasn’t in the strategy.

During the later years, evolved Zero Trust security models now define modern remote access and cybersecurity standard. A combination of cloud application security, endpoint protection, and identity management solutions helps protect company assets and users effectively from potential vulnerabilities imposed by remote and hybrid work.

To support business projects and a large customer base, Hostinger has several departments to maintain all the projects and services up and running. Therefore, originally based in Kaunas, Lithuania, the company now has an extensive team of over 1000 employees in 51 countries across the globe. Yet a large team brings its challenges in times of change. Egidijus Navardauskas, Head of Cybersecurity at Hostinger, gives his insider experience on their journey of implementing remote work in extreme situations.

The Challenge

Rapid organization onboarding to remote work during lockdown

Hostinger as most of the companies in the pre-pandemic time, lived a daily office-based life. However, it changed during Covid as all teams started working remotely and adjusting to the new way of living.

“Before the pandemic, we used to work from the office full time —  there was no need for most of the teams to use an internal VPN solution except for a part of the IT staff.”

Click to tweet

Once the lockdown period came into effect and workforce borders started expanding, the existing VPN solution limitations were revealed. It wasn’t initially built to scale sufficiently and provide a reliable VPN connection to handle the fast growth of remote employees in different countries.

The employee distribution and work from personal networks required the company to grant them a swift connection to internal resources. However, operational continuity was at high risk, and the current setup lacked role-based network access controls for maintaining security levels. 

The Solution

Replace the existing VPN with a more agile solution

The employees used to work from the office all the time, and only a part of the IT staff was using an internal VPN solution as there was no need for most of the teams to access internal resources after working hours. 

“As Hostinger had to move to a remote working model due to the pandemic and fast growth of remote employees in different counties, the existing VPN solution was not scalable enough to handle many users.”

Click to tweet

Transitioning from an on-site environment to remote work quickly can be challenging for any business. Especially in the case of Hostinger, which experienced a sudden necessity to change its work and infrastructure approach.

Ad-hoc tasks are difficult to squeeze into tight schedules even in extreme circumstances, so time management and efficient distribution of resources are crucial — choosing the right solution from the first shoot is critical.

“Time shortage and lack of human resources, as all IT teams were very busy with their quarterly goals, were the additional factors that impacted the remote work situation.”

Click to tweet

Therefore, the journey from identifying the issue, selecting a solution, and making the delivery had to be well-organized and smooth.

Why choose NordLayer?

NordLayer provided an optimal solution to change the existing company VPN and seamlessly integrate it into the current infrastructure.

Even though the requirements for a new VPN were extended to establish remote connections of the worldwide-distributed high number of employees to organizational resources and provide secure identity management measures to the IT administrators. 

“NordLayer topped the shortlisted solutions by Hostinger by being the most cost-effective and easiest-to-manage option — this is how we chose the solution.”

Click to tweet

When selecting a cybersecurity solution, Hostinger usually uses a risk-driven approach, and of course, the solution has to fulfill requirements that are suitable for our company’s needs. Following the practice ensures the organization’s main security goals, which are confidentiality, integrity, and availability of resources and data. 

5 steps to onboard a global remote team overnight: decision-making process and proceeding with NordLayer

Clear steps and objectives helped Hostinger to optimize and streamline its process of problem-solving from understanding the current solution limitations — cannot scale with a growing team,  what are the desired results — provide network access controls, meet compliance and security requirements, and provide backup servers, to overviewing the plan and implementing to the whole organization.

The Outcome

Fast adaptation to a crisis with extended security outcome

The company achieved a remote work setup on time, so business and team productivity weren’t affected. It all happened while facing a global lockdown with time and human resources limitations.

Today, all Hostinger employees use the solution daily as the team works in a hybrid model. We utilize ten private virtual gateways for our company needs — all this just having NordLayer and a 5-people cybersecurity team.

Most importantly, Hostinger employees can connect securely to internal resources no matter where they are. Moreover, the IT staff can focus more on other projects rather than maintaining internal VPN infrastructure — the service provider is responsible for the maintenance of the servers, so it saves a lot of valuable time. 

Pro cybersecurity tips 

The pandemic may start feeling like old news at some point the more time passes by, yet it was an unusual situation that had effects on businesses that reflect up to this day and will stay relevant in the future, like teaching to react to extreme situations to keep businesses running. Even though not everything can be foreseen, thus it’s beneficial to have a strategy and a sound plan in place to be well-prepared.

It’s good to start even from small things — Head of Cybersecurity of Hostinger Egidijus Navardauskas shares his tips for business security:

Have you considered how your organization would hold if stress-tested? What would be the main impediments to securing business continuity? Even expected challenges can bring to light lacking security and adoption of implemented infrastructure. Therefore, it’s always worth exploring the possibilities and performing crisis drills even on paper — be ready to ensure teams and organization perforation despite the work setup, and reach out to learn more about a remote access network solution for modern companies.

Securing data and protecting assets is critically important when using Office 365. This blog will discuss the major threats faced by users and we will suggest some security best practices. Office 365 is a safe place to run business operations. But you need awareness and policies to make that safety a reality.

How secure is Office 365?

Office 365 is a suite of cloud-based business tools. Like all cloud applications and platforms, Office is vulnerable to external attackers. Cyber-attackers can breach user defenses. They can access sensitive data, disrupt operations, and cause plenty of damage before they are stopped.

Security concerns are real. Up to 85% of organizations using Office 365 suffered an email data loss in 2021. 15% of organizations using the platform suffered more than 500 breaches in the same year. Just 4% of organizations not using Office 365 reported the same data breach frequency.

Microsoft has toughened Office security features in the past few years. However, Office 365 users still need to control their security posture. If you can find a secure configuration that meets your needs, you can use the platform safely. The first step in doing so is mastering the security features supplied by Microsoft.

Security features in Office 365

Users can access most Office 365 security features via the Security and Compliance Center on Microsoft Accounts. This cloud-based portal allows users to choose several critical security functions. These functions include:

1. Identity and Access Management (IAM)

Microsoft’s IAM solution lets you set up digital identities for all Office users.

Every user has a digital identity containing their authentication details and authorization information. This lets administrators add adaptive multi-factor authentication for all log-ins. Admins can manage passwords efficiently, onboard and remove users as needed.

IAM also allows you to manage authorization options for all users. Admins can set privileges based on roles or individual requirements. This limits app access to users with appropriate permissions. Unauthorized outsiders won’t be able to intrude.

2. Information security

With Microsoft Information Protection (MIP), users can manage data as it travels across Office cloud resources and even on remote work devices.

Users can classify data to ensure it only reaches authorized devices. Set different sensitivity levels to make data available or defend it as required.

Classification works alongside Data Loss Prevention (DLP) and Microsoft Information Governance (MIG) tools. Create robust security controls for confidential data, and set lifecycle controls to delete data when it is not needed.

3. Threat defenses

Microsoft offers Office-native Security Information and Event Management (SIEM) and Extended Detection and Response (XDR) features. Together, they neutralize cyber threats and track traffic to assess security weaknesses.

Azure Sentinel is a SIEM system that uses Artificial Intelligence to monitor the Office environment. Sentinel can track every active Office application and device. Security teams benefit from real-time visibility across the threat surface.

Azure Defender and Office 365 Defender are XDR tools. They extend threat detection to all endpoints, including email accounts and cloud applications.

4. Risk management

Office 365 includes a suite of tools to manage risks and ensure compliance. These tools identify and classify risks, focusing on data protection across an Office 365 environment.

Risk management tools allow security teams to assess insider threats, manage the risk of insecure communications, and fine-tune privileges for admin accounts. Audit tools let you drill down into compliance issues until every data security weakness is covered.

What are the most important Office 365 security concerns?

The security tools above are comprehensive and flexible. But they are generally voluntary. Users need to create their own security setup and choose measures that fit their Office implementation.

Office 365 leaves plenty of room for misconfigurations. And these gaps are the ideal space for attackers to work. Here are some critical threats for security managers to assess:

1. Credential theft and unauthorized access

Cyber attackers may gain access to your entire Office 365 environment if they steal user credentials. Users can leak credentials in many ways. For instance, employees could:

• Share information insecurely via Office collaboration apps
• Click on attachments that extract personal data
• Follow unsafe links in social engineering email messages
• Install malware onto a connected device

Credential theft is a constant security concern for Office 365 managers. Office does include multi-factor authentication, but MFA is not enabled as a default. Many companies forget to apply extra authentication and suffer as a result.

2. Unsafe privileges

According to Zero Trust principles, Office 365 users should have access to the resources they need and nothing more. Limiting access to sensitive data makes data extraction and loss less likely. Hackers cannot freely access data. Employees won’t be able to leak data during their tasks accidentally.

However, privileges creep can lead to too many people having access to too much data. By default, every Global Administrator Account has extensive privileges. Security teams need to restrict admin accounts manually. This potentially leaves scope to abuse access and steal data.

3. Data loss

Data breaches are a nightmare scenario for Office 365 managers, but they are possible without adequate security controls.

The major problem here is sharing. Office is built to enable information exchange. Workers share documents, conversations, databases, and much more. This is great at an operational level. But the flow of data is a security problem.

Data can leak via many storage locations or sharing tools. Employees may not know about data sharing risks or how to store data securely. And data can pass to unauthorized third parties without the knowledge of security teams.

4. Complacency

Many companies move from on-premises Office implementations to cloud-based 365 environments. While the applications are familiar, the security context of these two setups is very different.

Security managers may lack visibility of all cloud endpoints and in-use applications. They may lose sight of data containers or fail to turn on necessary security features. Sharing tools like SharePoint present new risks, such as allowing access for third-party guests. But these new risks aren’t always detected during cloud transitions.

Office 365 security best practices for business

What can businesses do about the security threats listed above? The answer lies in applying Office 365 security best practices. By following these security practices, you can enjoy the benefits of information sharing and keeping data safe.

1. Enable IAM

Access management is the top priority when securing Office 365 environments. Companies must create a secure perimeter and restrict access for unauthenticated users. Users should have the privileges they need to carry out work, but no more access than they require.

Office 365 has built-in IAM tools to control authentication and authorization centrally. Set conditional access policies for every role and back up password access with MFA technologies. Bring all Office 365 apps together via Single Sign On (SSO). This makes it easier for employees to manage passwords. It also simplifies access management for security professionals.

It is advisable to create separate user accounts for admins with elevated privileges. Every admin account requires maximum protection. Users should only use administrative accounts for specialist tasks, and rely on other accounts for everyday work.

2. Educate users to understand Office 365 security

Employees must know how to avoid phishing attacks. Build anti-phishing training into all onboarding processes and refresh this knowledge regularly. Workers should always be aware of dangerous email attachments and how to spot malicious links.

Users also require training in how to share information securely. Educate staff on how to use SharePoint and Teams without compromising security.

3. Collaborate securely

Education combines with robust collaboration app security to protect data in-transit. Install DLP systems to track sensitive files and ensure they stay within the network perimeter. DLP will alert managers if employees share critical data, and block any illegitimate transfers.

Set up Message Encryption on Teams and other communication tools. This protects the content of messages. Only authorized users will be able to read messages or open files.

Use Safe Attachments to scan all email attachments and shared files. Extend attachment protection to Teams, SharePoint and OneDrive so that all potential endpoints enjoy security coverage.

4. Put in place anti-phishing protections

Office 365 includes specialist tools to handle phishing attacks. These advanced threat protection tools go beyond trusting employees not to open malicious links. They actively inspect emails to detect malicious content.

For example, users can sandbox attachments automatically with Application Guard. This creates a protected environment to open pdfs or spreadsheets. Application Guard scans files to detect unsafe sources. This matters because Office files are common attack vectors. Sandboxing makes it much less likely that an innocent document will spark a security alert.

Safe Links is another useful anti-phishing tool that scans URLs to detect security concerns. And you can set “external” email tagging for inbound messages. This alerts users to be careful when opening external communications.

These measures do not remove all phishing risks. Zero-day threats are still an issue. But together, Application Guard, email tagging and Safe Links provide plenty of defense against social engineering attacks.

5. Use anti-malware solutions

When anti-phishing measures fail, malware protection tools enter the picture. Office 365 users should take advantage of Microsoft’s anti-malware tools wherever possible.

Implement SIEM protection via Azure Sentinel, and use XDR to scan all endpoints. These two tools work together to detect malware infections and quarantine affected files. This should neutralize ransomware attacks before they take down network infrastructure.

6. Strengthen your password policies

User access is the major Office 365 security weak point. And credential theft is the most common attack vector. Make it harder to mount credential stuffing attacks by enforcing strong password policies across all users.

Make sure Office users avoid real names and familiar words. Include multiple symbols and numbers, in combinations that are impossible to anticipate. Use password manager tools to store and update passwords. This reduces the risk of human error.

Generally, make sure users do not reuse passwords from other network assets. Every Office 365 user requires unique credentials, with no exceptions.

7. Strengthen data security controls

Employ MIP to lock down sensitive information and allow access to less important data. Office 365 lets you label sensitive information such as personally identifiable information (PII) and financial records. These labels enforce tools to keep sensitive data secure, such as encryption or watermarking.

DLP also allows you to track data movements and prevent data leaving organizational boundaries. This makes it easier to work remotely without creating additional data loss risks.

8. Check compliance and security scores

Data security measures aim to meet strict compliance goals. For instance, you may need to protect financial records to comply with PCI-DSS, or meet HIPAA rules when handling patient details. Microsoft has created tools to make the compliance task easier, so use them when available.

The Office 365 compliance portal provides guidance for meeting important regulations. It also includes a compliance score that charts your progress. Updated in real-time, the compliance score suggests required actions. It provides a useful road map to compliance across all Office 365 services.

Office also provides an overall Secure Score. This can be found in the Security Center, which records a percentage based on an organization’s security posture. Adding extra security measures boosts the score, and the system delivers recommendations based on your Office 365 setup.

9. Optimize mobile device security

Employees may use mobile devices to access Microsoft’s SaaS applications. This particularly applies to companies with large communities of remote workers or BYOD setups. In any case, it is advisable to implement Mobile Device Management (MDM) security solutions,

Office 365’s MDM tools encrypt confidential data on mobile devices. They can wipe data from devices in the event of theft. And they prevent network access for stolen or compromised devices.

10. Put in place rock-solid Office auditing

Be sure to enable the Unified Audit Log via the Office 365 Security Center. The UAL lets you track user activity across all accounts. You can see who is sharing information and how that information spreads across your cloud environment.

By default, audit logs provide 90 days of historical information, which isn’t that much. However, you can extend the scope of audit logging to as long as ten years if desired. Longer periods provide a better evidence base for compliance management, but you will need measures to efficiently store and search audit data.

Ensure secure access to Office 365 with NordLayer

Collaborate, strategize, and store data safely with our office 365 security best practices. On-board security tools and solid staff education let you use Microsoft’s business environment without creating unnecessary risks.

However, just relying on Office 365 controls is a risky move. That’s especially true for companies with hybrid cloud environments who manage multiple platforms and require secure access to SaaS apps. In those cases, it makes sense to apply enterprise-wide security solutions like NordLayer.

NordLayer’s IP allowlisting tools supplement Office 365 security controls. Admins can define a list of authorized addresses. These IP addresses are then permitted access to Office resources. Unlisted devices are excluded or require additional verification.

NordLayer encrypts traffic passing between employee devices and Office 365, countering man-in-the-middle style attacks. Threatblock also blocks malicious websites, reducing the risks posed by phishing attacks. Use Microsoft’s internal features to secure Office 365. But go further, integrating Office into your wider cybersecurity setup. To find out more, contact the NordLayer team today.