The original post: /r/cybersecurity by /u/TheGreatGlim on 2024-04-12 06:32:53.
Hey all, I have a quetsion for you, it’s something hat has kind of sparked a debate at work, and I wanted the input of other professionals.
We have a H&S policy at work that states if we need to work from home for safety reasons due to stuff happening on site, we can, unless the staff are ESSENTIAL staff which need to be on site.
We have a C-level who hates wfh, and he’s a tyrant about it. He’s made our entire team ignore the information provided by the business and come in as he is claiming that CySec is “essential” on site staff.
I’m arguing that while we are essential, our work doesn’t require us to be on site for multiple reasons:
-
if an attack happens that can cut external staff off from our services, they would either have to hit our ISPs or have access to our firewalls to block our incoming traffic, and if they are THAT embedded, us being in the office wouldn’t have made a blind bit of difference.
-
Essential does not equal “having to be on site” as global conglomerates operate a fully remote SOC.
-
Like many companies, our SOC and SIEM are accessible remotely, so we don’t need to be on site to see what’s happening in our environment.
What do you all think, is it essential for CySec staff to be on site, and why?
Trying to turn a negative into a positive learning experience, as I vehemently disagree with his approach, and i feel he is putting his hatred for WFH above our safety, but I’m trying to turn it into a positive learning experience