India's plans for hybrid work models in the next 12-24 months are outpacing the speed of security in India. Find out where organizations need to place their focus to secure the new world of work.
The rapid deployment of new technologies to facilitate remote work heightened the level of risk for Indian businesses. Security and business leaders in India indicate their organizations have more exposure to risk today as a result of remote work (76%) and migrating business-critical functions to the cloud (73%).
The self-reported data is drawn from a commissioned study of more than 1,300 security leaders, business executives and remote employees worldwide, including 92 respondents in India. The study, Beyond Boundaries: The Future of Cybersecurity in the New World of Work, was conducted in April 2021 by Forrester Consulting on behalf of Tenable.
Remote work, previously the province of a select few road warriors and executives, became ubiquitous in response to the pandemic and the trend is here to stay in India for the foreseeable future. The vast majority of Indian organizations (80%) plan to have employees working from home at least once a week in the next 12-24 months, while 63% plan to make a permanent move to remote work over the next two years.
Even as these plans unfold, an alarming 53% of security and business leaders expressed concerns that their organizations are only somewhat or not at all prepared to secure their remote workforce. This is a sign that future plans for hybrid work models are outpacing the speed of security in India.
Adoption of new technologies continues to atomize the attack surface
To facilitate this new work order, Indian business and security leaders will continue to focus on enhancing existing digital platforms (63%), moving non-critical-business functions to the cloud (62%) and expanding software supply chains (49%) over the next 12-24 months. And while these changes are enabling organizations to pivot their business operations and improve the experience for employees, they're also setting the stage for increased risk as security leaders lack holistic visibility into an attack surface that's been atomized.
Specific challenges about supporting a remote workforce include the lack of employee awareness to secure home networks and personal devices (53%) and visibility into employee security practices (56%).
These concerns are justified when you look at the threat landscape of the past 12 months. A staggering 88% of Indian organizations experienced a business-impacting* cyberattack.
More than half of respondents (56%) said these attacks targeted remote workers, making them one of the biggest risks facing Indian organizations in the new world of work. Nearly three quarters of respondents (71%) suffered an attack that resulted from vulnerabilities in systems put in place in response to the pandemic, whilst 63% attributed recent attacks to a third-party software vendor compromise. These cyberattacks underscore the need for greater visibility into the atomized attack surface.
To prevent history from repeating itself, it's clear that organizations need to eliminate blindspots by shoring up their defenses to support the next phase of their workforce model.
Redefining what risk is
As organizations usher in this new world of work that comprises a mix of remote and hybrid work models, the corporate network perimeter has shattered into a myriad of devices across cloud and on-premises. Organizations, therefore, cannot rely on yesterday's tools to secure this new reality. This starts with adopting a never trust, always verify approach throughout the organization. It calls for viewing trust as a vulnerability instead and posits that any notion of trust be removed from digital systems entirely. Organizations also need a modern, comprehensive strategy to quickly and accurately identify vulnerabilities and misconfigurations in their dynamic infrastructures, one which delivers clear guidance and recommendations on how to prioritize and remediate any risks.
*A business-impacting cyberattack is one which results in one or more of the following outcomes: loss of customer, employee, or other confidential data; interruption of day-to-day operations; ransomware payout; financial loss or theft; and/or theft of intellectual property
