People

'The new normal': Cisco security leader on WFH, MFA and the value of Band-Aids

A conversation with Wendy Nather on what companies, and their employees, should be thinking during the coronavirus crisis to protect their newly remote workplaces.

Wendy Nather, head of advisory CISOs at Duo Security, a division of Cisco

People who work from home need to cover their laptop cameras when they aren't using them, says Wendy Nather, who heads head of advisory CISOs at Duo Security, a division of Cisco. "I have used an Angry Birds Band-Aid as a webcam cover on a personal laptop for like three years," she says.

Photo: Courtesy of Cisco

Multitudes of people are telecommuting because of the coronavirus pandemic, with everyone from Facebook, Google and Apple to JPMorgan Chase to the federal government sending employees out of the office and into workstations — often hastily assembled — at their own homes.

Cisco, the computer networking giant and maker of Webex videoconferencing software, says more than 30% of its biggest global enterprise customers have asked the company to help them ramp up remote work, either by increasing access to Webex or bumping up the number of actual meetings. The San Jose company is seeing "unprecedented increases" in time spent in Webex meetings in Japan, Singapore, China and South Korea.


Get what matters in tech, in your inbox every morning. Sign up for Source Code.


But the profound shift comes with challenges, and a critical one is security. Protocol spoke with Wendy Nather, head of advisory CISOs at Duo Security, a division of Cisco, asking what companies should be thinking about to make sure their employees are protecting themselves and their employers. She talked about new normals and MFAs — and a great application for an Angry Birds Band-Aid.

This conversation has been edited for length and clarity.

People are using Webex for meetings. What other ways are they using videoconferencing?

I've seen it used for keeping communication channels open between people who are either in different parts of the same building or in different buildings. During the day they need to be able to exchange a couple of words like, "Oh, do you see that?" They're kind of virtually sitting together working on something, but it's not a short-term meeting with a beginning and an end. It's co-working by telepresence. And then there are a lot of people who are using telepresence to work on something together, like building a diagram or working on a document.

What do you recommend companies watch for with so many employees working from home, especially if the employees have never done this — or if it's been sort of a once-in-a-blue-moon kind of thing?

One of the most important things is a lot of enterprises will think of this as an aberration — you know, a temporary condition and everything will go back to normal afterward. This will just be a couple of weeks, or maybe a month, then everybody will go back into the office. They may be tempted to take shortcuts in setting up remote access for their users and thinking, "Well, we're just going to throw this up there, and it'll be OK because it's only for a month."

For example, going without multifactor authentication. Setting up something like a remote desktop protocol and just relying on usernames and passwords is very dangerous because attackers are always scanning the networks for these types of programs. A username and password is not going to keep them out. And so MFA is very, very important.

The other thing is we have to be realistic in that a lot of users may get used to working this way. Or the pandemic may last longer than we think it will. It may become a cyclical thing. And so it's better for enterprises to plan as though this is going to be the new normal. They should start thinking about wanting to support this long term.

What should employees who are working from home be watching out for?

The first thing they absolutely need, if they are going to be using videoconferencing and they haven't really done this before, is a webcam cover. It can be one of these little plastic covers that vendors give out as swag. Or I will tell you that a Band-Aid works perfectly well. I have used an Angry Birds Band-Aid as a webcam cover on a personal laptop for like three years. It doesn't have to be an expensive solution. The camera can turn on when you don't expect it. Or you may have left the camera cover open from your last meeting. You could have family members walking around behind you in their pajamas. So get a webcam cover and use it all the time.

Another thing — and employees should check with their enterprises — is that working from home, especially in the case of this pandemic, means working from home. It does not mean going to Starbucks and hanging around people who might transmit the virus. And if it is all right for employees to be working from another location, they should make sure not to do sensitive operations from unsecured Wi-Fi.

Once they have their work equipment at home, employees get tempted to start using it for all sorts of personal purposes. I'm sure employers will want me to say you should not be surfing inappropriate sites. Or going to any kind of clickbait sites that you wouldn't be going to from work. That's how you can end up downloading malware.

What about phishing risks?

Phishing risks are going to be very similar to what they would have seen in the office. Of course, if somebody calls them at home and claims to be from the help desk, they should hang up and call the help desk back. In other words, you know, the rules should be that, no matter what's going on and where you are, don't give sensitive information to anyone who calls you first.

Are most companies requiring that people working from home be logged in to VPNs?

I don't know, but we certainly know that enterprises are using VPNs and secure non-VPN solutions based on need. For example, if you're a privileged user or if you're a system administrator working from home, you may need to use the VPN to get access to all sorts of systems. You can't necessarily predict ahead of time because you might have to fix anything. But if you were a third-party partner or you're an employee who only needs access to one internal application, then it's entirely possible that the enterprise will want to lock it down.

With Duo, we make that possible without a VPN. So the enterprise needs to decide what kind of access they want each employee to have. Not that everybody comes in on a free-for-all on VPN and can get free rein everywhere. That's where breaches can happen. If companies are following the zero-trust model, they're checking even when people are inside the building and on the corporate network.

Related:


Can you explain the zero-trust model?

The idea has been around for a really long time, at least 20 years. It's no longer safe to assume things are secure inside a firewall. Assume enterprise assets are unprotected and you need to protect them appropriately as if they were in the Wild West. Check it early and often. It's not just checking to see IP address, it's checking the user, and it's where MFA comes in. Check security of a device to see if it's been compromised. Use practices like least privilege — don't give anybody access to anything they don't need. Or segmentation: Just because two things are on a network doesn't mean they need to talk with each other. Duo and Cisco's suite of products will help you achieve that. There are lots of vendors out there addressing different parts. Zero trust is a way of thinking, not a single product.

Should employees expect their employers to keep closer tabs on them online when they work from home?

Fundamentally that is a business question, not a security question. When I was a CISO [in finance and in education], I would have to have those discussions with businesses and say, "Look, you know, you're in charge of making sure that the employees are working however you want them to work." We're protecting the enterprise against attacks. So those are very different things.

I understand. Interesting that you put it that way.

The security group is not the good-taste police, either. If HR wants to monitor what users are doing, that's fine and that's their thing, but that is not something the security team generally has time to do or even wants to do, because they don't want to be the arbiters of good taste.

Fintech

Gavin Newsom shows crypto some California love

“A more flexible approach is needed,” Gov. Newsom said in rejecting a bill that would require crypto companies to get a state license.

Strong bipartisan support wasn’t enough to convince Newsom that requiring crypto companies to register with the state’s Department of Financial Protection and Innovation is the smart path for California.

Photo: Jerod Harris/Getty Images for Vox Media

The Digital Financial Assets Law seemed like a legislative slam dunk in California for critics of the crypto industry.

But strong bipartisan support — it passed 71-0 in the state assembly and 31-6 in the Senate — wasn’t enough to convince Gov. Gavin Newsom that requiring crypto companies to register with the state’s Department of Financial Protection and Innovation is the smart path for California.

Keep Reading Show less
Benjamin Pimentel

Benjamin Pimentel ( @benpimentel) covers crypto and fintech from San Francisco. He has reported on many of the biggest tech stories over the past 20 years for the San Francisco Chronicle, Dow Jones MarketWatch and Business Insider, from the dot-com crash, the rise of cloud computing, social networking and AI to the impact of the Great Recession and the COVID crisis on Silicon Valley and beyond. He can be reached at bpimentel@protocol.com or via Google Voice at (925) 307-9342.

Sponsored Content

Great products are built on strong patents

Experts say robust intellectual property protection is essential to ensure the long-term R&D required to innovate and maintain America's technology leadership.

Every great tech product that you rely on each day, from the smartphone in your pocket to your music streaming service and navigational system in the car, shares one important thing: part of its innovative design is protected by intellectual property (IP) laws.

From 5G to artificial intelligence, IP protection offers a powerful incentive for researchers to create ground-breaking products, and governmental leaders say its protection is an essential part of maintaining US technology leadership. To quote Secretary of Commerce Gina Raimondo: "intellectual property protection is vital for American innovation and entrepreneurship.”

Keep Reading Show less
James Daly
James Daly has a deep knowledge of creating brand voice identity, including understanding various audiences and targeting messaging accordingly. He enjoys commissioning, editing, writing, and business development, particularly in launching new ventures and building passionate audiences. Daly has led teams large and small to multiple awards and quantifiable success through a strategy built on teamwork, passion, fact-checking, intelligence, analytics, and audience growth while meeting budget goals and production deadlines in fast-paced environments. Daly is the Editorial Director of 2030 Media and a contributor at Wired.
Workplace

Slack’s rallying cry at Dreamforce: No more meetings

It’s not all cartoon bears and therapy pigs — work conferences are a good place to talk about the future of work.

“We want people to be able to work in whatever way works for them with flexible schedules, in meetings and out of meetings,” Slack chief product officer Tamar Yehoshua told Protocol at Dreamforce 2022.

Photo: Marlena Sloss/Bloomberg via Getty Images

Dreamforce is primarily Salesforce’s show. But Slack wasn’t to be left out, especially as the primary connector between Salesforce and the mainstream working world.

The average knowledge worker spends more time using a communication tool like Slack than a CRM like Salesforce, positioning it as the best Salesforce product to concern itself with the future of work. In between meeting a therapy pig and meditating by the Dreamforce waterfall, Protocol sat down with several Slack execs and conference-goers to chat about the shifting future.

Keep Reading Show less
Lizzy Lawrence

Lizzy Lawrence ( @LizzyLaw_) is a reporter at Protocol, covering tools and productivity in the workplace. She's a recent graduate of the University of Michigan, where she studied sociology and international studies. She served as editor in chief of The Michigan Daily, her school's independent newspaper. She's based in D.C., and can be reached at llawrence@protocol.com.

LA is a growing tech hub. But not everyone may fit.

LA has a housing crisis similar to Silicon Valley’s. And single-family-zoning laws are mostly to blame.

As the number of tech companies in the region grows, so does the number of tech workers, whose high salaries put them at an advantage in both LA's renting and buying markets.

Photo: Nat Rubio-Licht/Protocol

LA’s tech scene is on the rise. The number of unicorn companies in Los Angeles is growing, and the city has become the third-largest startup ecosystem nationally behind the Bay Area and New York with more than 4,000 VC-backed startups in industries ranging from aerospace to creators. As the number of tech companies in the region grows, so does the number of tech workers. The city is quickly becoming more and more like Silicon Valley — a new startup and a dozen tech workers on every corner and companies like Google, Netflix, and Twitter setting up offices there.

But with growth comes growing pains. Los Angeles, especially the burgeoning Silicon Beach area — which includes Santa Monica, Venice, and Marina del Rey — shares something in common with its namesake Silicon Valley: a severe lack of housing.

Keep Reading Show less
Nat Rubio-Licht

Nat Rubio-Licht is a Los Angeles-based news writer at Protocol. They graduated from Syracuse University with a degree in newspaper and online journalism in May 2020. Prior to joining the team, they worked at the Los Angeles Business Journal as a technology and aerospace reporter.

Policy

SFPD can now surveil a private camera network funded by Ripple chair

The San Francisco Board of Supervisors approved a policy that the ACLU and EFF argue will further criminalize marginalized groups.

SFPD will be able to temporarily tap into private surveillance networks in certain circumstances.

Photo: Justin Sullivan/Getty Images

Ripple chairman and co-founder Chris Larsen has been funding a network of security cameras throughout San Francisco for a decade. Now, the city has given its police department the green light to monitor the feeds from those cameras — and any other private surveillance devices in the city — in real time, whether or not a crime has been committed.

This week, San Francisco’s Board of Supervisors approved a controversial plan to allow SFPD to temporarily tap into private surveillance networks during life-threatening emergencies, large events, and in the course of criminal investigations, including investigations of misdemeanors. The decision came despite fervent opposition from groups, including the ACLU of Northern California and the Electronic Frontier Foundation, which say the police department’s new authority will be misused against protesters and marginalized groups in a city that has been a bastion for both.

Keep Reading Show less
Issie Lapowsky

Issie Lapowsky ( @issielapowsky) is Protocol's chief correspondent, covering the intersection of technology, politics, and national affairs. She also oversees Protocol's fellowship program. Previously, she was a senior writer at Wired, where she covered the 2016 election and the Facebook beat in its aftermath. Prior to that, Issie worked as a staff writer for Inc. magazine, writing about small business and entrepreneurship. She has also worked as an on-air contributor for CBS News and taught a graduate-level course at New York University's Center for Publishing on how tech giants have affected publishing.

Latest Stories
Bulletins