security

INDUSTRY INSIGHT

To protect endpoints, agencies must get their priorities straight

Endpoint protection has always been difficult for federal agencies, but with COVID-19 and a sharp increase in work-from-home scenarios, the challenge has grown dramatically.

Just 57% of respondents to a recent SolarWinds survey rated their endpoint protection capabilities as “mature.” This survey was conducted before the pandemic forced most government professionals to work remotely. With staff  undoubtedly using personal devices and cloud-based applications more than ever, the increasingly large list of endpoints could prove enticing to enterprising bad actors. Some of those devices and applications may be known to their organizations’ IT professionals, but many more may operate as shadow IT.

And yet, endpoint protection has been around for years. So why haven’t agencies gotten better at it? And what can be done to improve defenses?

Too many endpoints, too little time and control

Today, it’s not unusual for large agencies to have thousands of endpoints to manage. IT teams regularly add or swap out vendors and technologies to get the best services and prices, adding to the complexity and breadth of their enterprise landscape. Remote work compounds the challenge as users depend on more and different applications to do their jobs. Those thousands of endpoints can easily become tens of thousands, which can be time-consuming and costly to defend.

Then there are personal mobile devices. Even though the bring-your-own-device trend has been with us for a while, it’s still difficult for IT administrators to protect these devices, since they don’t have the appropriate permissions to enforce endpoint protection on employees’ iPhones, Androids and iPads.

While these are large-scale challenges, they’re not insurmountable. IT administrators can get a better handle on endpoint protection by prioritizing and protecting their most critical assets and educating workers on cybersecurity perils.

Prioritization is key to better endpoint protection

In a perfect world, administrators would be able to implement endpoint protection on every asset used by agency employees. But as COVID-19 has shown, we don’t live in a perfect world. The next best course of action is to prioritize what assets receive endpoint protection.

At the top of the list should be an agency’s most critical assets, such as physical and virtual servers. Additionally, administrators should establish user risk profiles based on rank, roles and responsibilities. People with access to particularly sensitive data should be considered greater potential risks, as they’re more likely to become targets of a hacker’s attentions. That means it’s even more important to focus on protecting the endpoints they use frequently.

Following the prioritization of critical assets, administrators can develop a strategy for addressing the remaining endpoints. These can likely be covered through endpoint detection and response technologies, which can be used to automatically defend against ransomware and other attacks. Administrators can then work to eliminate additional blind spots.

Engaging the workforce in the cybersecurity fight

Buoyed by workers’ fears and concerns, attackers have gotten creative with pandemic-related phishing, ransomware and other insidious tactics. While there are exceptional technologies to monitor, mitigate and repel these types of attacks, hackers are always looking for ways around these solutions. As such, there must be another layer of protection beyond asset prioritization: user education.

Like everyone else, government workers are currently under a significant stress, which could make them even more susceptible to an attack. For example, a user may receive a fake email promising a stimulus check, click on it and unwittingly provide a bad actor with entry into the agency’s network.

Now’s the time to remind staff how to spot something nefarious and how to report it if they do. Administrators can point out obvious tells that signify an email may not be legitimate -- burner email accounts that don’t appear to be coming from the agency’s domain or improperly worded phrases and content. Advise employees to send anything remotely suspicious to their IT administrator. Often, skepticism is the best endpoint protection.

One of the respondents to the same cybersecurity survey likened their situation to “waiting for a ticking time bomb to go off.” Administrators can defuse this bomb by taking one step at a time when it comes to endpoint security. They should prioritize the most important assets, work down from there, and ensure user education is solid. This combination can help agencies get a better handle on their growing cybersecurity challenges.

About the Author

Brandon Shopp is the vice president of product strategy at SolarWinds.

Featured

  • automated processes (Nikolay Klimenko/Shutterstock.com)

    How the Army’s DORA bot cuts manual work for contracting professionals

    Thanks to robotic process automation, the time it takes Army contracting professionals to determine whether prospective vendors should receive a contract has been cut from an hour to just five minutes.

  • Russia prying into state, local networks

    A Russian state-sponsored advanced persistent threat actor targeting state, local, territorial and tribal government networks exfiltrated data from at least two victims.

Stay Connected