4 ms·
How does corporate security handle permanent work-from-home? It seems that there would be vastly more risks added. E.g. When Joe Employee walks into the offic
by testfoobar 6y ago
How does corporate security handle permanent work-from-home? It seems that there would be vastly more risks added.
E.g. When Joe Employee walks into the office, we know it is him and what he does and where he works. At home, Joe Employee might have a friend who looks over his shoulder at the project launch document he is completing, at the financials that are being submitted to the CFO.
- brainzap 6y agowith training
- iso1631 6y agoWhen Joe Employee works on the train on the way into the office he has strangers looking over his shoulder
- SpicyLemonZest 6y agoThe security risks aren't any different in permanent work from home vs "once in a while when I have to watch the kids" work from home, and most companies have long since allowed the latter. You just don't give sensitive documents to people who can't be trusted to protect them.
- kwanbix 6y agoWell, many Joe Employees take work home, so how is that different? And also, Joe Employee can be decide to take interesting docs/info for his own use, I don't see much of a difference.
- deleted 6y ago[deleted]
- MattGaiser 6y ago> How does corporate security handle permanent work-from-home? It seems that there would be vastly more risks added. Do they handle it? A heck of a lot of companies are using nothing more than remote desktop from personal machines right now.
- TheGeminon 6y agodisclaimer: I work for Shopify as a lead on our "corporate security engineering" team (not real name of it). Shopify follows the the zero trust networking/Beyondcorp model, and we never had the physical office spaces as part of our threat model. Not much can be done for shoulder-surfing (aside from privacy screens, and our security training), however we have built out robust systems that build trust modeling out of identity and device security.
- martinald 6y agoNearly all companies allow you to access documents remotely, so you could do the same thing over a lunch, in the evenings, whatever. Or he could memorise the key points and tell him/her on a call! Bad actors will always be able to get round these controls imo.
- kirktrue 6y agoFor some of the large clients I have, they require (and pay for) an independent company to come and audit my home office to make sure it meets their standards. The auditing company was provided with a litany of requirements from our shared client. The first time it was a little odd, but it's routine for those companies who have sensitive IP.
- pmiller2 6y agoThat's interesting. What are the requirements like?