Data protection in flex spaces: essential practices

The flexible workspace industry is only set to grow. According to recent reports, flexible office occupancy is seeing a 71% year-over-year increase, reaching an average of 90% at the end of last year.

While that’s a promising sign for the future of flexible workspaces, it also means that you have more reason than ever to match growing tenant expectations. Data privacy and security chief among them.

WeWork India recently hit headlines for a data breach that saw tens of thousands of people’s personal information getting leaked. According to reports, there weren’t any controls in place to block access to this information, which included email addresses, phone numbers, and photos. What’s more, none of this data was encrypted.

It’s hard to predict the extent of the damage that can be caused by a data breach until it happens… but it’s not an outcome you want to risk. The inevitable fallout it can bring will include you:

Losing your competitive edge
Damaging your brand reputation
Potential fines and penalties for non-compliance

Here, we will explore the essential strategies you need to take to ensure that your flexible workspace is data-secure and how an enterprise network solution can help.

Provide secure WiFi access controls

WiFi access plays a key role in maintaining data security. When tenants and visitors connect to your network, the access controls should ideally be secure and robust, mitigating the risk of any unauthorised access or data breach.

A unique Virtual Local Area Network (VLAN) for your tenants is one way to ensure secure access. For example, essensys Platform implements this feature with 802.1x based authentication and RADIUS protocol, providing benefits such as:

Easy disabling: When users leave or cease to be employed, revoking their access to the network can be done by simply disabling their individual account.
Enhanced security: Unique login credentials for each tenant and segregated VLANs to ensure that every user’s information and activity is protected.
Effective network access control (NAC): Pre-approved users or devices are the only ones able to gain access to network services, reducing the risk of unauthorised access.

For guests, time-limited access via a guest portal ensures that they are added to a shared VLAN, isolated from each other, and have no access to tenant VLAN traffic.

Data protection & encryption measures

Secure data transfer and encryption controls are fundamental to ensuring the protection of sensitive or critical information. Employing cryptographic controls, digital signature certificates or message authentication codes can authenticate the integrity of stored or transmitted data.

Filter mechanisms, like firewalls, prevent connections to or from unauthorised systems. Furthermore, in compliance with data protection regulations, data should be deleted once a contract is terminated or at a tenant’s request.

Physical and logical access controls should be implemented to provide authorised and recorded user access. Here are some more specific access controls you should keep in mind:

Physical access: Restrict access to data processing systems to named personnel only, use video surveillance at entrances/exits, and employ security gates to access secure server rooms.
Access to devices and systems: Device / Systems Access Control: Allocate personal User IDs, enforce the use of secure complex passwords, require multi-factor authorisation, and administer centralised user management.
Control via separation: Back up customer data on logically and physically separate systems, and maintain a separate logical network for office visitors.

Ensure security and privacy compliance

Compliance with relevant security and privacy standards gives your tenants confidence that your flexible workspace is following internationally recognised protocols. ISO/SOC2 certifications signify that you are operating to these standards and that your workspace is prepared to host corporations with strict compliance regulations. Larger, enterprise clients in particular will be attracted to workspaces that can assure their compliance.

Plus, different organisations are going to have different compliance requirements. For example:

PCI-DSS is relevant to any company that processes, transmits, or stores payment data, such as retail or eCommerce stores.
HIPAA applies to companies that handle personal medical data, including private practices and mental health therapists.
ISO 9001 is applicable to organisations that want to improve their operational resilience, quality, and efficiency.
ISO 27001 is relevant to any company that needs to manage sensitive information in a secure manner.
SOC 2 applies to businesses that store customer data in the cloud. This compliance standard ensures that an organisation’s information security measures are in line with today’s cloud requirements.
The GDPR is fundamental for companies of all sizes and industries that both work within the EU and have customers outside of the EU.

You want your flexible workspace to be capable of addressing any tenants’ requirements, regardless of the industry they’re operating in.

Invest in regular backups and a disaster recovery plan

Accidents and disasters can strike at any time, often without warning. To safeguard personal data against these incidents, a well-structured disaster recovery plan and regular backups should be part of your standard operating procedures.

Here’s how you can implement these measures effectively:

Availability control: Ensure that your systems have built-in redundancy. This means duplicating critical components or functions of a system with the intention of increasing reliability. For example, you could maintain multiple servers, so if one fails, others are available to take over its functions.

Backup and recovery procedures: Create and strictly adhere to procedures for backing up all critical systems, particularly when considering deployment options for a flexible workspace platform. This could mean daily backups of your data to a secure cloud storage, periodically saving copies of data to an off-site location, and having a backup circuit to keep systems online if one fails.

Routine monitoring: This doesn’t just include monitoring the relevant devices in your workspace e.g. networks, servers, and applications. This also applies to you regularly reviewing and testing your disaster recovery plans.

DDoS protection and bandwidth monitoring: Activating DDoS protection and constantly monitoring your bandwidth can help maintain your system integrity. This can involve using a dedicated security solution or service that provides real-time threat detection and automatic mitigation of common DDoS attacks.

Uninterruptible Power Supplies (UPS): Install UPS systems to prevent data loss during power outages. These systems provide emergency power to your critical devices, giving you enough time to properly shut down equipment or switch to a secondary power source.
Forming a disaster recovery plan: Develop a detailed disaster recovery and business continuity plan to ensure that operations can continue in the event of a major incident or disaster. This plan should be reviewed, updated, and tested at least once a year to ensure it’s effective and up-to-date.

Offer a centralised data entry system

The management of multiple systems and tools can be a major security hurdle in a flexible workspace setup. This could expose sensitive data to unnecessary risks and cause inefficiencies in your operations. To counteract this, a centralised system that serves as a single repository for data, processes, and customer management can be a game-changer.

This kind of uniformity in managing access and permission controls reduces the need to navigate different systems for adding or removing a user or making further adjustments.

Here, the use of a flexible workspace platform that streamlines the above tasks for you can be very beneficial. Aim for a platform that offers enhanced access and identity management capabilities by acting as a central system of intelligence for user access and permissions to your various:

Spaces
Services
Sites

Pro tip: On top of the above features, your platform should be capable of being expanded through integrations with your existing key systems.

Bring greater data security for your tenants with essensys

While all the above best practices are critical to bringing security to your tenants’ data, they’re easier said than done to implement on your own. Investing in a trusted flexible workspace partner can help you bridge the gap between seeing these strategies through and at an efficient scale.

That’s why we developed essensys Platform and essensys Cloud — both capable of ensuring end-to-end security and privacy for any tenants you bring into your workspace:

Secure WiFi access: We provide advanced WiFi access for tenants and visitors alike. All users are protected with our unique VLAN, enabling easy decommissioning of users and direction to the correct VLAN, every time.
Security & compliance: We hold crucial accreditations, including ISO9001, ISO27001, and SOC2, for quality management, information security, and cybersecurity controls across a variety of industries.
A centralised cloud solution: essensys Platform and essensys Cloud can be fully integrated with one another for maximum efficiency. See the benefits of an easy-to-use interface that can address management of network infrastructures, private networks, and bandwidth allocation — from a single location.
24/7 monitoring: We offer our clients routine support and management, from 24/7 device health monitoring to regular audits.

For more on how we can specifically help you see greater data security and privacy in your flexible workspace, just get in touch.