VIDEO — 23 Nov 2020

Remote work in the pandemic: lessons learned and the security minimum for every company

A Head In The Clouds conversation: moving a healthcare company to remote work, lessons from lockdown and the security minimum every business needs.

Published in

Head In The Clouds

Role

Guest

Watch on YouTube

In 2020, while I was CISO at Kaia Health in Munich, I was a guest on Head In The Clouds, a video series hosted by Citrus Global. We talked about the sudden switch to remote work, keeping highly sensitive healthcare data safe and what the lockdown taught us. I also shared the security minimum I recommend for remote work, and what I expect from a modern talent partner.

The sudden switch to remote work

The switch to a different way of working was very sudden and surprised all of us. Some like to call it the new normal, although I like to call it temporary. Remote work caught a lot of people off guard, and while some adapted very quickly and others adapted well, some did not adapt at all.

I have no issues with remote work, and I was already using that option before all this. Still, I can’t wait to get back to the office myself, because what I missed most was the office chatter and those informal conversations with colleagues over coffee.

Keeping the pace, and keeping the data safe

When Jack asked me about the biggest security challenges of going remote, I told him that we had to quickly set up the environment, the right business tools and the processes that go with them. That way our colleagues could keep working at a high pace without compromising the roadmaps we had set before the pandemic or our commitments to future releases and product updates. Sometimes the setup took a bit of digital transformation, and at other times the right tools and processes in teams were enough.

Doing all of that securely was a big challenge, because in healthcare especially the data you handle every day is highly sensitive: health information, patient data and other business-critical information. Even so, I think we managed to do it right.

What the lockdown taught us

I was very surprised that productivity actually went up, because everybody would expect it to drop drastically. The lesson I took from this is that when you remove certain parts of everyday business, people simply have fewer distractions at home and do more work. That was true only during the lockdown, because once it lifted and people could go out again, productivity went back to about the same rate as before.

The other lesson I learned is that change can be implemented very swiftly under pressure. That is why I think there is no longer any justification for postponing digital transformation, which 2020 made clearer than any year before.

Preparing processes and culture for remote work

When Jack asked whether I would have done anything differently, I said there is always room for improvement, and that in our case I would have focused more on setting up processes than on technology. Getting Zoom licences is a matter of minutes, but video calls also need to become part of the company’s culture, and people need tips on how to stay productive and on topic, how to present online and how to keep attendees’ attention.

In the first period we noticed that meetings degraded quickly, and after an hour nothing we said stuck any more and everyone was losing focus. That is why you should prepare your whole organisation and train people for both office and remote life, and I would have spent more time before the pandemic testing these processes.

All-day online classes and conferences

I can’t imagine children having online classes all day, and I have already heard a lot of complaints that their focus drops and students aren’t paying as much attention. Classes have to be delivered in shorter bursts, with breaks and in different ways, because one constant format won’t work, and the same applies to meetings.

I think the biggest fail in the business world was the all-day virtual conferences, where you log in to a portal and follow all the talks. I really tried and gave it my best, and the material was really interesting, but after sitting in a room for so long, focused on more or less similar topics, I found it really hard to concentrate.

Remote work should stay as an option

What I really hope will stay is remote work policies in companies that didn’t have them before, because I believe this benefit is critical. Every company should absolutely offer remote work to employees as an option, even though going fully remote wouldn’t make sense.

Whether they wanted to or not, companies have now tested it, so this is a great time to upgrade your culture, processes and documents and offer this benefit in whatever format you like, which can be one remote day a week, two days, any day or even permanent remote work. There is a wide range of options, but at least the minimum should be there in every organisation.

The security minimum for remote work

For every business adopting remote work, my advice is to keep security highly prioritised, because remote work opens up a lot of risks and potential for compromising company data.

The minimum I recommend

—High standards of user authentication should definitely be implemented, from single sign-on to two-factor authentication for absolutely all systems, and especially for business-critical ones.
—Devices that employees take home, above all laptops, should have a minimum set of security and endpoint protection measures, like disk encryption and an antivirus solution.
—I highly advise using VPN services to connect to any company resources from remote locations.

I see this as the minimum set of measures even for small and medium-sized businesses, because it keeps the security posture high with very little investment.

What I expect from a modern talent partner

In my field there is a very big shortage of security talent, so from a modern talent partner I expect a good network of security professionals at hand. It is a huge market and a great opportunity for such a partner, and if you can get us more security talent, we will greatly appreciate it.

At the end of the conversation I gave the recommendation I always give to everybody, which is to keep your security and privacy awareness at a high level when you work remotely.

More conversations & talks