The future of federal telework demands secure remote access

The Office of Personnel Management recently moved to increase telework flexibility throughout the federal government. The intent is to remain competitive in the pursuit of top talent and to decrease "agency-hopping" in search of telework options. The President's Management Agenda also strongly suggests that government telework flexibility will be critical to keeping the federal workforce competitive with the private sector. The urgent need to attract and retain strong talent is one of many factors indicating federal employee telework is here to stay. 

Digital transformation initiatives throughout government identify telework as a core aspect of modernization. The Biden administration's cybersecurity executive order discusses securing cloud, on-prem and hybrid networks. Additionally, the recently introduced Telework Metrics and Cost Savings Act could potentially codify federal telework flexibility. Several major surveys indicate remote government workers are more satisfied and productive than their counterparts.

It's now abundantly clear that the shift to remote work wasn't merely an outgrowth of the pandemic, but a significant and permanent change to how our federal government functions. As such, agencies must place a strong emphasis on mitigating the threats inherent in remote work.

Security in the telework era

Traditional remote access methods, such as remote desktop protocol (RDP), virtual private networks (VPNs), and legacy remote desktop tools lack granular access management controls. Malicious actors can easily exploit this lack of visibility via stolen credentials and session hijacking. 

Even junior staff, who may not regularly access sensitive information or citizen data, pose a significant threat vector because cybercriminals can compromise their accounts through phishing schemes and then move laterally within an agency's network. For instance, in the recent Uber breach, after a single employee forfeited their password, the hacker was able to compromise the entire network and gain access to highly privileged security accounts.

As such, privileged remote access solutions must be implemented at scale for all teleworkers in the federal government to ensure employees, third-party vendors and other insiders don't have free access to systems while accessing the network remotely.

Visibility is key for any advanced, secure remote access system, especially in the modern, perimeter-less workforce. If the privileged accounts within a network are unknown, it is unlikely proper action is being taken to defend them. However, visibility is useless if the information being reported is inaccurate, which is why multi-factor authentication (MFA) is also recommended. 

Privilege and identity matter

One thing is for certain, at the center of every breach, compromise or ransomware attack lies an identity, and with that identity is some degree of privileged access. Privilege and identity are the two factors abused in almost every attack. It's imperative that system operators can monitor who's accessing the network, what they're doing, and how long they're connected to the network.

After assuring visibility, a policy of least privilege must be enforced. This means giving users just the right level of access needed for their roles. For shared accounts, individual user accountability should be established. Furthermore, a comprehensive secure remote access solution should define what endpoints users can access, schedule when they can access them, and whitelist/blacklist applications. 

Another priority area should be mobile privileged access management, since systems administrators are also likely to increasingly work remotely or on-the-go. Moreover, since time is of the essence during a cyberattack, notifications should be enabled to alert an administrator when an identity has been misused. This is yet another reason why visibility is critical: without a baseline, abnormalities cannot be detected.

Even among agencies that don't have many or any teleworkers, it's almost certain some third-party or vendor is accessing their network. While codifying or expanding telework in the federal government would make secure remote access paramount, it's already imperative. 

When least privilege and audit controls are applied, agencies move closer to a zero-trust architecture by applying granular access controls. Organizations must be able to control, manage and audit privileged employees' remote access without overextending credentials.

Lock it down

Federal agencies should look to industry leading technologies to defend their invaluable data. By procuring technology through government mandated compliance initiatives, such as FedRAMP and CMMC 2.0, agencies can rest assured that the technology they procure is compliant with all necessary federal standards. Through public and private sector collaboration, the benefits of teleworking can be realized while minimizing the potential cybersecurity risks.

The recent flurry of executive orders, employee surveys, mandates and legislation indicate that remote work is how the federal government will work in the future. It's crucial that federal agencies, in partnership with private organizations, work in tandem to ensure government telework practices are as secure as possible.