Extend the end-point, not your network - WFH

​Flawed thinking and expensive mistakes in Work-From-Home strategies
 
​Working with a wide range of South Africa’s largest companies provides Accelerate unique insights into the multiple strategies being employed in work-from-home. We all concede that the post COVID-19 world has changed business forever, and with this, our strategic thinking around how we secure our now remote users needs to be modernized.
While all strategies will work at some level, some strategies will simply work better than others in terms of efficiency, security, flexibility, user-experience, control and cost.
 
It’s generally accepted that most enterprise organisations are considering leaving a portion of their workforce at home, in some cases thousands of staff. We share our view on some of the positives and negatives of extending your business network to home users.
 
Extending the company network for WFH (Diagram 1.1)

Its logical to consider extending the trusted network to the home user. Security and some applications still sit in the company DC so routing the user through the DC seems to be the easiest solution. Here are the top challenges created in this design:

1. Forcing users back to the corporate network adding latency and cost when:
   1. Collaboration solutions like Teams and Zoom are Cloud based
   2. Companies have shifted email to 0365, 30%+ of traffic
   3. Many private applications sit in Cloud (AWS, Azure, Oracle)
2. Extending the network to home is complex and expensive due to the sheer number of users and potential devices required to deploy and manage to address access to the business network
3. Companies will need to manage the home user’s LAN
4. If the user wants to work from a coffee shop or when traveling, the company will still have to deploy a software VPN which drives up cost and complexity
5. If the user connects their workstation to their mobile hotspot, how does the company protect company information of the user when relying on security devices?
6. The company will have to add additional security on the end point to protect the user when they connect to the Internet using any form of public Internet
7. 5G will see the company network becoming the bottleneck for remote workers
8. How do you address contractors and 3rd party users?

Lessons learned from Zero Trust and Gartner SASE (Diagram 1.2)
 
Gartner SASE highlights something very important. Security and application access need to shift from the network to the end-point, and security needs to be delivered with a Cloud-native approach. Extending the company network is going in the wrong direction especially in a Cloud first world.

What Gartner SASE advocates:

1. If security and application access is initiated from the end-point, the user can access company assets from any location, using any network. Why tie them to their home?
2. It’s essential to go direct to Cloud for collaboration, email and cloud applications to optimise user performance and reduce support tickets
3. A well thought out intelligent solution retires multiple disparate solutions including additional VPN’s, 3rd party access
4. Home networks are simplified to a connection to the internet, removing unnecessary appliances
5. The company no longer takes responsibility for the user’s home network
6. All security processes can be delivered to the endpoint with inline Cloud-native security including DLP, NGFW etc. without having to backhaul traffic back to the corporate network.
7. Application access in Cloud, and general internet access performance improves with a direct approach
8. Companies can easily manage and control users, device, and application access policies through a single pane of glass
9. Users never connect to the corporate network, they only connect to authorized applications using Zero trust methodology
10. Deliver 3rd party and partner access to private applications based on policy

 
In our experience the cost difference between rolling out appliances to our users homes vs embracing the cloud is considerable, resulting in no less than a 50% differential when comparing to extending the corporate network. But equally if not more important is that companies have more control, less complexity and a better user performance with Cloud-native and zero trust application access.
​
Chat to us to understand why major financial institutions and organisations around the world are opting for a zero trust and cloud native approach to work-from-home.
 
Author: Stuart Hardy, stuart@an.co.za
 
About Accelerate Networks
Accelerate is a proud 10 year partner of Zscaler for sub-Saharan Africa and works with leading companies on the content to drive security transformation.
Contact Accelerate at info@an.co.za or go to www.an.co.za for more information