Nederlands
The target of hackers: remote workers
Do your employees work remotely, in full or in part? Hybrid work is here to stay and offers advantages for both the organization and its employees. At the same time, the remote workplace has become an attractive route into your company network for attackers: through ransomware, phishing and abuse of poorly secured remote access. How do you ensure the digital security of your remote work solution is demonstrably in order?
With a remote work security assessment, DongIT tests your external company network for security risks and vulnerabilities and examines the design and security of your remote work solutions. Our security experts establish to what extent your organization has set up a secure remote working environment, minimizing the attack surface as much as possible. If your organization falls under NIS2, the security of remote access must moreover be demonstrably arranged.
"DongIT has examined our external infrastructure. DongIT carried this out expertly. In addition to the reporting of the risks, the complete report also included possible solutions that were immediately applied by the municipality of Meierijstad.. read more"
Company network security crucial for secure remote work
With hybrid work, work moves to environments outside your direct control. Private networks are generally poorly secured, while employees do log in to your company systems from there. Beyond creating security awareness among remote workers, an employer has limited influence on this and must assume that the IT security of a home situation is in principle insufficient.
The security of a remote work environment therefore stands or falls with the set-up by the organization itself. The VPN configuration, multi-factor authentication and conditional access, firewall settings, integrations and open services of the cloud solution and the set-up and management of laptops and workstations together determine how resilient your organization is. In practice, these components are not always implemented securely, which means attackers can gain access to the company network.
DongIT is specialized in testing the access to the company network and the set-up of remote work solutions. A remote work security assessment consists of two testing components, namely a company network pentest focused on remote working situations and a security assessment of the specific remote access set-up.
Both components can be requested as two separate tests or as a combination test. See the section below for more details on the tests. Related: our network and cloud pentest for a broader assessment of your infrastructure.
Company network pentest for remote work situations
- Research into possible attack vectors in the company network and among connected employees who work remotely.
- Identification and exploration of remote work and other company systems, open services and applications.
- Identifying all related domains and IP addresses belonging to the organization.
- Testing relevant systems and applications: in what ways can these be approached and is this secure?
- Open source research into online information about, among other things, the organization, employees and software packages used that could be useful for an attack.
- Insight into which information is easily available to a potential attacker.
- Insight into the weakest links in the external company network.
Security assessment of remote work solutions
- Research into the design of remote work solutions and substantiation of choices made, for example a VPN solution, hosted cloud or custom remote access set-up.
- Testing the design and restrictive measures regarding company laptops and workstations handed out to employees.
- Checking the configuration of company laptops, such as administrator rights, protocols for updating OS and software, virus scanner, disk encryption, firewall, browser plugins, DNS content filtering and pre-installed apps.
- Assessing the configuration of multi-factor authentication, single sign-on and access policies for remote employees.
- Inventory of cloud services in use and checks for known vulnerabilities, such as those that regularly surface in VPN and remote access solutions.
- Insight into which IT systems and services for remote workers are also accessible to attackers.
- Insight into the security of the connection between remote workers and the web applications they use.
- Security of access to the remote work solution, for example allowed mobile and private devices.