GET IN TOUCH

Speak to a pen test expert

Get in touch for a no obligation quote

1000 characters left
View our privacy policy

Overview

Identify and address remote working security risks with a specialist penetration test

If your organisation is embracing mass remote working for the first time, it’s important to ensure that it is doing so securely. Enabling workers to access the systems and data they need from home can create a wide range of cyber risks that attackers can be quick to exploit.

A remote working assessment from Redscan is a type of penetration test designed to identify and help comprehensively address security vulnerabilities that can result as a consequence of employees working outside of the office. This includes misconfigured infrastructure, devices, SaaS applications and security controls.

Challenges

Remote working security challenges

A vastly increased attack surface
Perimeter security no longer effective
Identity and access management
Reduced endpoint visibility
Employee-owned device usage
Managing cloud applications

Risks

Common home working security risks

Our CREST-certified security experts are experienced at helping organisations to identify and address a wide range of home working security risks, including:

VPN misconfigurations

Organisations commonly use Virtual Private Networks (VPNs) to enable remote workers to access corporate applications and data. We review your chosen VPN solution to ensure that it is hardened to prevent attackers from accessing your network and intercepting communications. This includes ensuring that VPN split-tunnelling, used to reduce impact on bandwidth, is implemented as securely as possible.

Cloud misconfigurations

Flaws in the way that cloud platforms and SaaS applications such as Office 365 and G Suite are set up could leave data and assets exposed. We thoroughly inspect your cloud and hybrid environments to identify risks and provide guidance to help ensure workloads are hardened in line with the latest security best practices, including benchmarks from the Center for Internet Security (CIS).

Improper access controls

To ensure that remote workers are able to access the systems they need outside the office, many organisations relax security settings such as IP address whitelisting. Use of access management technologies such as cloud access security broker (CASB) and zero-trust network access (ZTNA) can help to reduce risk, but these tools aren’t always configured optimally. We will review any access controls to ensure that they are implemented securely and configured with the latest threats in mind.

BYOD

Bring-your-own-device (BYOD) is the practice of allowing employees to use their own devices to access company networks. Some organisations use remote access technologies, application containers and application wrapping to mitigate the associated risks, but these need to be implemented securely. We review your organisation’s BYOD policy and controls to help identify improvements.

Firewall misconfigurations

Firewall misconfigurations could provide an opportunity for an attacker to obtain easy access to a network, install malware and conduct command and control (c2) activity. We assess your organisation’s firewall settings to identify open ports and review firewall policies to help ensure they adhere to the principle of least privilege.

RDP flaws

Remote Desktop Protocol (RDP) is used by remote employees to connect to and access servers and other devices. We check that RDP is configured securely and free of vulnerabilities which could allow cybercriminals to remotely take over unpatched devices.

FAQs

Remote working FAQs

What is a remote working security assessment?

A remote working security assessment is a type of penetration test designed to help organisations identify and address security risks that result as a consequence of employees working outside of the office. An assessment can uncover a range of security risks, such as misconfigured infrastructure, systems and applications. Unsafe remote working practices can also be identified.

What is a remote access penetration test?

A remote access penetration test is a type of penetration test that is specifically focused on identifying cyber security risks that result from the use of remote access solutions such as a virtual private network (VPN), a Remote Desktop Protocol Client (RDP) and Virtual Desktop. A remote access pen test can also be used to assess the implementation and use of cloud access security broker (CASB) and zero-trust network access (ZTNA) tools.

How long does a remote working security assessment take to conduct?

The time it takes a penetration tester to complete a remote working security assessment is dependent upon the scope of the engagement. A typical test to identify critical issues generally takes no more than a couple of days, but a more focused engagement to review policies such as firewall settings can extend the testing and reporting period. The duration of a test will also dependent upon the approach – whether it is a whitebox, blackbox or greybox engagement.

Can a remote working security assessment include a phishing test?

Yes, absolutely. Upon request, a remote working penetration test can include a custom email phishing exercise, designed to assess and help improve the security awareness of employees that work from home. Assessments can also target specific individuals to mirror spear phishing and business email compromise (BEC) attacks.

How has COVID-19 created additional home working security risks?

The COVID-19 pandemic has led to increased security risks for most companies, especially those that have been forced to embrace remote working for the first time. Many organisations prior to the pandemic were not set up properly to support remote working and have been forced to implement quick solutions to stay operational and provide employees with access to systems and data. In such instances, cyber security can be an afterthought.

What COVID-19 security risks should homeworkers be aware of?

Homeworkers should be alert to a wide range of remote working security risks during the COVID-19 pandemic. Users should be particularly aware of coronavirus themed phishing attacks, designed to trick recipients into disclosing sensitive information and/or installing malware.

Employees also need to exercise caution when using third party applications such as video conferencing software, which could introduce security vulnerabilities and create privacy and compliance issues.

Interested to learn more?

Get in touch

Types of penetration test

Network infrastructure testing

Network infrastructure testing

Redscan rigorously investigates your network to identify and exploit a wide range of security vulnerabilities. This enables us to establish if assets such as data can be compromised, classify the risks posed to your overall cyber security, prioritise vulnerabilities to be addressed, and recommend actions to mitigate risks identified.

Wireless testing

Wireless testing

Unsecured wireless networks can enable attackers to enter your network and steal valuable data. Wireless penetration testing identifies vulnerabilities, quantifies the damage these could cause and determines how they should be remediated.

Application and API security review

Application and API security review

Vulnerabilities contained within software are commonly exploited by cybercriminals and are easily introduced by under-pressure programmers. Redscan’s ethical hackers conduct automated and manual penetration tests to assess backend application logic and software and API source code.

Remote working assessment

Remote working assessment

If your organisation is embracing mass remote working for the first time, it’s important to ensure that it is doing so securely. Ensure your networks, applications and devices are protected and fully secured with a custom remote working security assessment.

Web application security testing

Web application security testing

Web applications play a vital role in business success and are an attractive target for cybercriminals. Redscan’s ethical hacking services include website and web app penetration testing to identify vulnerabilities including SQL injection and cross-site scripting problems plus flaws in application logic and session management flows.

Social engineering

Social engineering

People continue to be one of the weakest links in an organisation’s cyber security. Redscan’s social engineering pen test service includes a range of email phishing engagements designed to assess the ability of your systems and personnel to detect and respond to a simulated attack exercise.

Mobile security testing

Mobile security testing

Mobile app usage is on the rise, with more and more companies enabling customers to conveniently access their services via tablets and smartphones. Redscan carries out in-depth mobile application assessments based on the latest development frameworks and security testing tools.

Firewall configuration review

Firewall configuration review

Firewall rule sets can quickly become outdated. Redscan’s penetration testers can detect unsafe configurations and recommend changes to optimise security and throughput.

Expertise

Our security qualifications

Meet some of our team

Faisal
“Our remit is to think creatively to find solutions that will help keep your organisation more secure. We’re continually improving our knowledge of how adversaries think so that we can better identify security weaknesses and enhance detection of new and emerging threats.”
Faisal
Security Consultant
Philip Veness
“We aim to make sure that your organisation gets the best possible value from a pen test. We'll talk you through the assessment at every stage and answer any questions you might have along the way.”  

 

Philip
Security Consultant
Teiss Awards 2020 Winner

Get a Pen Test quote now

Keep your business safe by protecting your networks, systems and apps with our penetration testing services.

  • One of the highest accredited UK pentesting companies
  • A deep understanding of how hackers operate
  • In-depth threat analysis and advice you can trust
  • Complete post-test care for effective risk remediation
  • Multi award-winning offensive security services
  • Avg. >9/10 customer satisfaction, 95% retention rate

1000 characters left
View our privacy policy

Resources

Discover our latest content and resources

From the blog
From the blog Case studies Latest news
25th March 2024
UK government finds 75% of UK businesses experienced a cyber incident in 2023
According to new figures published by the UK government, no less than three-quarters of UK businesses and 79% of charities experienced a cybersecurity incident in the past 12 months, with only limited improvements in organisations’ cybersecurity posture between 2022 and 2023.
18th March 2024
Prioritise the security of perimeter products, says NCSC
Securing perimeter products must be a priority for organisations as threat actors are increasingly targeting insecure self-hosted products at the corporate network perimeter, according to the UK's National Cyber Security Centre (NCSC).
4th March 2024
Insider threats an increasing concern for UK companies
More than half of UK business decision-makers surveyed for a new study stated that they were concerned about the likelihood of their employees being approached by cybercriminals, leading to a rise in insider threats.    
26th February 2024
78% of organisations hit by repeat ransomware attacks after paying
A new report shows that almost four in five organisations that paid a ransom demand were hit by a second ransomware attack, often by the same threat actor. Almost two-thirds (63%) of those organizations were asked to pay more the second time.