Remote Work Security Emergency... Startups Lock Down with Ironclad Security Measures

Speed of Security Enhancement Measures Implementation

The startup industry has raised a red flag over ‘remote work security.’ Due to the industry’s emphasis on creativity and innovation, remote work through non-face-to-face methods has become widespread, but there are concerns that this could lead to security vulnerabilities and the leakage of important information or technology. Recently, even in large corporations with strict security measures, incidents have occurred where employees working from home attempted to leak technology, heightening the sense of crisis. Especially in growth-stage startups, the leakage of core information such as business models or technology can directly threaten the survival of the company, prompting each firm to accelerate efforts to establish countermeasures.

According to a survey by Shiftee, an integrated workforce management solution company, the rate of remote work applications increased by an average of seven times per month over the past two years compared to January 2020. This represents a significant rise in the transition to a non-face-to-face work environment compared to just before the spread of COVID-19. Shiftee explained that startups have also rapidly increased the implementation of remote work or flexible working hours systems since the outbreak of COVID-19.

The problem is that, unlike large corporations, startups may be more negligent about security. In fact, personal information leakage incidents occurred in startups related to fashion and edutech before and after the spread of COVID-19. Although these incidents did not become major scandals, security-related accidents in startups are known to be not uncommon. A security industry official pointed out, "Startups in Korea prioritize growth first and tend to address security afterward." Remote work, which involves accessing the internal network from outside, can further exacerbate the security vulnerabilities of startups that already have many weak points.

Accordingly, efforts to strengthen remote work security are accelerating, especially among major startups. In the case of a startup that has grown into a unicorn, additional authentication methods have been applied to prevent access to internal systems even if IDs and passwords that can access the company’s internal system are leaked. Furthermore, access rights to the company’s internal network are granted minimally only to necessary personnel as a principle. This is explained as a primary prevention measure against the leakage of important information. In particular, direct access to the company’s critical internal systems is blocked, and access is controlled only through a separate relay system. The use of this relay system is monitored through access history to detect any misuse of privileges.

A travel tech startup that implements permanent remote work allows system access only through remote work devices with security measures applied. When connecting remotely, user authentication and compliance with device safety standards are verified before access is granted. Post-management is also conducted through monitoring connection records. Another startup has configured its intranet pages, where key data can be viewed, to be accessible only within the company and operates menu usage permissions in 3 to 4 levels.

Within the industry, since security issues start with people, it is believed that practical education and activities to raise security awareness, such as security training and campaigns, should be conducted alongside security through systems or solutions. An industry official said, "First, employees’ awareness of information protection must be raised," adding, "Recently, the number of startups conducting regular training and campaigns to enhance and encourage employee awareness of information protection is increasing."