A consideration on a BleepingComputer post on security and remote work

https://www.bleepingcomputer.com/news/security/remote-work-a-ticking-time-bomb-waiting-to-be-exploited/

by kkfx • 2 years ago

1 1 2 years ago

kkfx• 2 years ago

Well... It's a sponsored article but it's still relevant seen the BC typical audience AND post authors mental model of "remote work".

First: from the article remote and hybrid work are synonym, a very cloying idea, many in the management/PR keep trying pushing around and some even believe, especially those who have never really worked from home.

Second: they clearly imaging people working with wifi, a thing logic if your work consist of running around a facility with a laptop doing physical things that also demand a connected computer, obviously NOT LOGIC at all otherwise and still it's the common C-suite and PR mental model who keep imaging it's normal working on 12-14" craptops anywhere at home or in a bar and alike. A scenario many in the large public believe it's very normal.

Third: they clearly imaging PERSONAL equipment at home also used to work. Well, I mean not a personal desk, chair, keyboard [1], screen(s), I mean a damn desktop with a personally managed OS, since of course most imaging working IN REMOTE DESKTOP with their own one as a client.

Ok, again, it's an article by someone who sell solutions for this scenarios, BUT the main point I post this here is that such scenarios are considered NORMAL by most, administrative who decide how to work in primis. And that's the biggest damn real threat.

To properly work from home there is nothing wrong in accepting a remote worker existent setup, of standard devices dumb enough to not represent a threat for the company IT but WFH means having a damn dedicated home office with a damn closed door, FDE desktop send ready from the company ops, with relevant smart card allowing decryption sent separately and a pin sent also separately and by other means. We have no protection let's say with physical hw in the middle to scan keyboard and mouse input, duplicate monitor output and record and so on, but essentially that's they same threat we have in every office, because no one really have some trusted PFY running around every day looking for small devices added by someone where others are distracted here and there. But to properly have WFH witch is damn needed as a mere evolution, not only for adaption to climate change, well-being etc we MUST all clearly state:

- WFH mean working on a physical desktop, NOT A LAPTOP, and that's one of the reasons why hybrid works is crazy, demanding docked craptops or double desk setup;

- WFH mean no remote desktop for the worker but a desktop managed by company IT, with the relative workers help (from merely plugging cables to supporting workers personal hw for some skilled workers who want something better with hotplug storage if needed), so no workers own device on own software not managed by company IT.

[1] with some very cautionary notes about modern keyboards with programmable fw who can do many things, keylogging as well...

A consideration on a BleepingComputer post on security and remote work

Related Stories