Managing security in a hybrid work environment

SINGAPORE may have given the green light for all employees to return to the workplace, but hybrid work models are here to stay – not least for robo platform Endowus and tech-focused management consultancy A Better Consultancy, two companies that were pushed to embrace new models of work in the last three years.

Since 2020, Endowus has made remote working an option for its employees, with its headcount having grown from 20 to over 120. Meanwhile, A Better Consultancy made a “conscious decision” to hire employees who would be comfortable with flexible working arrangements. Technology has been a key enabler in the establishment of new hybrid work environments. But such arrangements have created layers of complexities for firms, in the management of data and devices among employees working across locations – and security has become a key concern. 

Gregory Van, founding partner and chief executive officer of Endowus, notes the risk of security breaches and limited control over his employees’ actions, especially with his platform’s use of third-party software that can be installed onto any device. 

“We can wipe a device if it happens to be stolen. But what we really struggle with is the fact that you can download files onto that hardware and send them anywhere – whether it’s sending screenshots to friends on Whatsapp or Telegram, or leaking them to the press,” he said, at a panel discussion on hybrid work environments.

Van noted that while young companies may end up prioritising growth initiatives over internal security, they should weigh the implications and ensure the right protocols are in place.

In Singapore, one in four devices gets attacked once a week, noted Timothy Tan, head of Enterprise Business for Information Technology (IT) and Mobile at Samsung Electronics. Much more needs to be done to address the intersecting concerns of security, collaboration, and dissemination of information, he said. “Going mobile-first is not so simple as giving out a device to everybody…things like security, making sure your corporate data is in the correct position, making sure certain parties can access them are considerations to bear in mind,” said Tan. As not all companies can afford a full IT headcount on standby round the clock, they can consider engaging a managed services provider, Tan said. Samsung, for instance, offers end-to-end solutions for firms with distributed workforce arrangements: covering devices, security and support. 

GET BT IN YOUR INBOX DAILY

Start and end each day with the latest news stories and analyses delivered straight to your inbox.

Sign UpVIEW ALL

According to the Cyber Security Agency of Singapore, ransomware cases rose 154 per cent in 2020 compared with 2019, mostly affecting small and medium-sized enterprises (SMEs) across sectors such as manufacturing, retail and healthcare. 

While there is no single silver bullet, Samsung’s Tan noted the need for “defence in depth” and for systems to periodically authenticate users based on various conditions. 

“Simply put, make sure your only defences are not just your email address, or your fingerprint. Whether it’s the authentication of your email or authentication on your device, there must be a layer of security at every step you are at,” he said.

Samsung’s Galaxy S22 series for enterprises includes not just productivity features such as a handwriting-to-text function, but are also designed with security in mind. 

Tan also highlighted the importance of defence from the ground up – that is, organisations should look at security as a part of their design and entire workflow, as opposed to treating it like an “afterthought”. 

The trade-off between optimising user experience and maintaining a certain level of security is inevitable, said Van. Currently, Endowus has in place differentiated security measures for different functions used by customers. Two-factor authentication is implemented for all monetary transactions; more straightforward transactions that do not involve money, such as a simple name change, can go through without an extra layer.

Ramji Venkateswaran, founding partner of A Better Consultancy, observed that the level of inconvenience people are willing to accept would likely be proportional to what they deem as important to be protected. “When it comes to user experience, there’s a very different expectation of when something is worth protecting, as opposed to when something is convenient and needs to be done on a day-to-day basis,” he said.

Companies should note that what they consider important may differ from what their employees do, Tan said. They should bear in mind these differences when implementing the layers of security required to access certain data, he added. “We ask our clients to make use of a user experience they are already familiar with – for instance, making access to complex security requirements as simple as what you would expect on a mobile phone, to minimise that particular hurdle,” Tan said.

As more organisations make hybrid workplace arrangements a permanent fixture, it is critical that they select the right type of device for their employees’ work requirements. “If a lot of your work is going to be just approvals, then a phone is more than enough. If your workload is going to be a lot of content creation, you’re probably going to need a tablet,” said Tan.

Next, companies should ensure that the platforms on their devices can guarantee a minimum level of security, Tan said. It is possible to achieve the same level of security as a government organisation on a personal device, and companies can enlist the help of a managed services provider such as Samsung if necessary.

Lastly, companies should ensure they build up a robust network of support for employees, as flexible working arrangements mean that they may need to be serviced at any place and time, Tan added.

Brought to you by