As part of CDW’s cybersecurity team, I often have the opportunity to visit with our customers and help them identify gaps in their security programs. CDW offers a variety of security assessments that help organizations shore up their cybersecurity weaknesses.

I’ve performed dozens of these assessments, which provides me with a unique vantage point on the state of cybersecurity across different industries and organizations of various sizes. With that perspective, I’ve seen four common threats that continue to pose significant risk to cybersecurity programs.

Recently, I had the opportunity to help a CDW client in the legal industry assess the current state of its cybersecurity program. The firm had a good grasp on cybersecurity issues and, in fact, had many effective cybersecurity controls in place. I’d definitely consider the firm far along the cybersecurity maturity model.

Like many organizations with mature cybersecurity programs, the firm wanted to get an outside assessment of its controls to uncover any gaps its security personnel might have overlooked internally. We spent a few days conducting a penetration test to provide the firm with an attacker’s view of its network.

Over the past six months, the world has seen an unprecedented shift toward telecommuting and other forms of remote work. That shift not only changed the locations where people work, it also forced a rapid change in some of the tools they use to make things work in new, unplanned environments. This unexpected hurry left organizations and individuals making quick decisions about the adoption of cloud tools, sometimes without the careful thought and planning that goes into other IT decisions.

Unfortunately, cybercriminals haven’t changed their approach. They’re still seeking to undermine the confidentiality, integrity and availability of systems and data. If anything, they’re harder at work, seizing upon this disruption as an opportunity to take advantage of lax security controls. In order to defend our organizations in this new world, we need to get back to basics and increase the visibility we have into what is going on within our on-premises and cloud environments.

Recent events turned our working lives upside down. With very little notice, millions of people around the world were sent home from their offices to suddenly adopt a remote work lifestyle. Four months into this adventure, most knowledge workers have adapted to working styles that replace conference rooms with video meetings and coffee chats with virtual happy hours.

I believe that we’ve arrived at a new normal where remote work will become a standard arrangement for knowledge workers. Both companies and employees will benefit from this approach. While employees can better balance their lives, companies will be able to reduce overhead expenses by consolidating and eliminating expensive physical offices. This work style comes with new cybersecurity considerations, and I urge organizations to adopt six key practices to adapt to our new working patterns.

The global pandemic and social distancing measures have redefined the office for many people. Industries that never would have considered allowing their office employees to work from home were forced to rethink decades of business as usual.

This change has also brought new technology needs. Since these businesses had built technology infrastructures that relied on traditional network and application architecture, a shift had to occur. Suddenly, IT departments were dealing with overloaded VPNs or having to deploy a VPN that they never had to maintain before. Compound that with the fact that users are now accessing company resources from networks or assets that corporate IT has no control over, that most home routers are still vulnerable to exploitation and that, in many cases, the network gates were flung open in the name of productivity ― it’s enough to give any CISO an ulcer.

So how can companies mitigate these risks? Now that everyone is settling into a routine and we’re adjusting to this “new normal,” it’s an ideal time to reach out to your users and talk about security.

When I heard human factors was going to be the focus of the RSA 2020 conference, I was pretty excited. Finally, we are talking about the one part of the equation that does not change: the user, the employee, the owner, society, the world. To top it off, I actually got the opportunity to present on that very topic at RSA; I was thrilled.