Data Governance – Part 4: Scalable Remote Access Infrastructure

Technical Committee has determined maintenance of an already existing CIO Strategy Council Publicly Available Specification, to convert to a National Standard of Canada. The world in which we live, and the way people work everyday has been certainly changed by the COVID-19 pandemic. Businesses, governments and CIOs everywhere are forced to explore new methods to effectively scale-up their remote access protocols, while at the same time manage costs and controls over the inherent security risks associated with remote connectivity into their information technology infrastructure assets. Remote workers typically use either a company-provided endpoint device (laptop) or a personal device connected from home networks via VPN to the corporate network. It’s this infrastructure that cannot scale at the speeds by which the work-from-home movement has shifted. It’s this remote connectivity model that has been directly attributed to network intrusions affecting large multi-national firms and many others as reported over the years. The standard would provide a framework and set of characteristics which, when adopted, enable the secure and rapid scale-up of the infrastructure needed to support the remote work requirements and directly addresses the weaknesses of the current security model which has directly led to these network intrusions. The access technology in place today is supported by physical remote access and VPN servers placing remote worker endpoint devices directly onto corporate networks. The access technology in place today is far less secure than many realize. This standard would present a set of requirements which, when followed, yield an operational IT environment which allows enterprises to rapidly scale up and down to meet the dynamic and unpredictable demands of employees needing to shift their work habits to a work-from-home (WFH) model, and continue to meet the enterprise security needs. This set of requirements is vendor-agnostic and does not prescribe specific tooling, rather general practices which once met, achieves the scalability and security requirements.