You're struggling to bridge IT and HR for remote access security. How can you ensure seamless collaboration?

In the post-pandemic world, aligning IT and HR for remote access security is less about overcoming clashes and more about maintaining open communication. Most organizations already adopted secure remote work practices during the rapid digitization phase, with measures like encrypted drives, restricted VPN access, and adaptive MFA in place. The focus now is ensuring policies work both in and out of the office, guided by GDPR and security best practices. By keeping communication channels open, IT and HR can work together seamlessly toward more advanced goals like Zero Trust and SASE.

HR is often resistant to sharing data with security. I've found several keys to getting the data. 1. Executive sponsorship 2. Valid use cases (Terminated Employee in Network, Flight Risk User / posting resumes, High Risk User / negative reviews or HR issues...) 3. Minimal data requirements as an Export, not a pull/constant connection. HR systems are notoriously undersized, and have sensitive information. Setting up read only access to a view or export of only fields agreed on to a file or syslog with automated import and correlation in a SIEM tool can help overcome the issues. Key fields I look for - Hire/Fire Date, Employee Status, Employee Department/Manager, Title [Peer Comparisons], phone number, primary location

To encourage collaboration between IT & HR, begin by aligning their goals around remote access security. Both teams should recognize how Cybersecurity contributes to company’s broader objective. HR should be informed about risks of remote work, such as phishing, data breaches, while IT needs to understand importance of user experience, following employment laws. Organizing joint training sessions can help both departments stay aligned, ensuring they are aware of risks, their roles in maintaining security. Both should collaborate on regularly updating security protocols to reflect evolving threats, compliance requirements. Establishing clear communication channels, feedback loop between departments ensures that concerns are addressed quickly

First approach should be to establish a cross functional committee with IT and HR to develop a work-from-home policy that considers security and legal requirements. Schedule meetings that will facilitate the sharing of concepts in terms of their security measures and employees’ employment and dismissal plans. Establish a single source of communication to enhance the dissemination of information and reporting of incidences. Further, also organize the training for HR on security measures, and for ITs on the possible intricacies of the remote work. This approach enhances the integration between AR/VR solutions and the existing work processes as well as improves the security of the latter when utilizing remote access.

Working with HR to gain alignment should not be very difficult. However, both sides need to maintain an open mind and be willing to actively listen, to learn and understand the other side. From the security and technology mindset, it is important to explain the principles of Confidentiality, Integrity and Availability, non repudiation, least privilege and other relevant topics so that HR can understand your concerns. Then you need to hear their concerns and understand them Once you get through that aspect, gaining alignment should be a straightforward process. Once you have that, make sure to document everything and have the other team(s) involved review to ensure accuracy.

Every company needs solid security policies that protects for the needs we see in 2024. Annually, HR & IT must review the existing corporate policies and keep them relevant & active for ALL EMPLOYEES. In fact, annually each employee should affirm having read the latest security policies & acknowledge compliance. HR must be involved on the human side. There are innocent violations, along as those who march to the beat of a different drum (ignoring or even compromising). HR knows the best legal remedies. They can also help ensure everyone has taken any needed training courses (SANS or KNOWBE4) and signed off on annual policy review compliance.

Crafting clear remote access policies is a joint venture that benefits from both IT's technical expertise and HR's understanding of employee behavior and company culture. These policies should outline acceptable use, define access levels, and specify authentication processes. HR can effectively communicate these policies to employees, ensuring they are understood and followed, while IT provides the tools and infrastructure to enforce them. This collaboration ensures that remote access is both secure and aligned with the company's values and operational needs.

Effective access management is a cornerstone of remote access security that requires IT and HR collaboration. HR can identify which employees need access to specific data based on their roles, while IT implements these permissions through technical controls. Regular audits and reviews of access privileges, conducted jointly, ensure that access management remains up-to-date and secure. This partnership helps maintain a balance between operational efficiency and robust security, reducing the risk of unauthorized access while supporting business needs.

Work together to establish effective access management protocols, ensuring that employees have the appropriate level of access based on their roles. This includes setting up role-based access controls and regularly reviewing access permissions.

Develop joint training programs that educate employees on the importance of remote access security. Ensure that both technical aspects (handled by IT) and policy adherence (communicated by HR) are covered in the training.

Continuous awareness training is key to ensuring secure remote work. Regular training should be mandatory for all employees, including top management, who must lead by example. The training should cover practical risks like phishing and public Wi-Fi, and it needs to be updated regularly to keep up with evolving threats. Extra training can be targeted at high-risk groups, such as executives or employees handling sensitive data. By reinforcing security knowledge across the organization, you create a culture where everyone is equipped to maintain robust security practices, whether in-office or remote.

Engaging training programs are essential. By incorporating real-world simulations and interactive elements based on the types of threats employees might face, knowledge retention and application can be significantly improved.

Continuous education on cybersecurity best practices is essential for all employees. HR should lead in developing training programs that are engaging and relevant, with IT providing the technical content and context. These programs should be mandatory and regularly updated to reflect the latest threats and security protocols. By educating your workforce, you enhance security and empower each team member to be a vigilant defender against cyber threats. This collaborative approach ensures that everyone in the organization plays a role in maintaining a secure environment.

When a security incident occurs, a swift and coordinated response from both IT and HR is critical. IT should lead in containing and mitigating the threat, while HR manages communication with affected employees and addresses any personnel-related issues. A predefined incident response plan, created collaboratively, ensures that both departments understand their roles and can act quickly to minimize damage. This coordination not only helps resolve the incident efficiently but also supports the organization's overall resilience in the face of security challenges.

Feedback is important. Because improvement is required. Future measures must be discussed based on past reports, including forecasts, to better mitigate risk. The feedback is also important because it is important to understand whether there were any teamwork, problem-solving skills issues, or communication problems. Communication requires that information be conveyed accurately and promptly. Most mistakes are made due to communication problems.

Establishing a feedback loop between IT and HR is vital for continuous improvement of remote access security. Regular meetings to discuss new threats, employee feedback, and the effectiveness of current policies allow both departments to adapt and refine their strategies. Encouraging employees to report security concerns or suggestions also provides valuable insights, fostering better collaboration and stronger security measures. This ongoing dialogue ensures that both IT and HR remain aligned and responsive to evolving security needs.

In addition to joint training & goal alignment in Cybersecurity, IT & HR should collaborate on regularly updating security protocols to reflect evolving threats & compliance requirements. Establishing clear communication channels & a feedback loop between the departments ensures that concerns are addressed quickly. It’s essential to involve HR in discussions about user-friendly security tools & systems, ensuring a balance between security & accessibility for employees. This joint partnership ensures that remote access security is effective while keeping employee needs & legal compliance in mind. Implementing secure technology solutions, automating updates, providing continuous education helps both teams stay informed about emerging threats.