Cybersecurity & Remote Work: Protocols That Ensure Efficiency and Security

Awareness is Key

From simple spyware that monitors your network transactions to a full-fledged ransomware attack that holds all your critical data for ransom, there are multiple ways in which your IT network could be affected.

• • Phishing scams – In our previous Insight, The Cyber Threat Cycle and Your Security Strategy, we discussed how email, including phishing attacks, continues to be a leading threat to many businesses across the globe. These emails often communicate a sense of urgency, persuading your employees to click on malware links that could steal sensitive data or install malicious viruses inside a computer.
  • Ransomware – Ransomware attacks hold an organization’s critical data for a ransom. Millions of dollars are paid to hackers yearly as corporations do not want to risk losing their sensitive data. However, there is no guarantee that your data will be secure even after you pay the ransom.
  • Cloud jacking – With the cloud becoming a more common way of storing data, incidents of cloud jacking have become a serious threat. Hackers can execute this attack by injecting malicious code into third-party cloud libraries or directly to the cloud platforms. Simply put, a public cloud vendor is responsible for providing the infrastructure, but most of the responsibility concerning data security is with the users. This means that your organization is primarily responsible for your data security even when it is on the cloud.
  • Man-in-the-middle attack – Hackers can insert themselves into a two-party transaction if it takes place on a public network. Once they get access, they can filter and then steal your data. If your remote working employees use public networks (such as the local coffee shop) to carry out their official tasks, they are vulnerable to these attacks.
  • Distributed denial-of-service (DDoS) attack – Hackers can manipulate your normal web traffic to flood the system with resources and traffic that exhaust the bandwidth. As a result, users won’t be able to perform their legitimate tasks. Furthermore, once the network is clogged, the attacker can send various botnets to manipulate the network.

So, what can you do?

Securing Your Remote Workers

As discussed in our June Insight, to protect your company against cyberattacks and data breaches, you must constantly evolve and grow to stay one step ahead of cybercriminals. If most of your employees work remotely, it may not take much to breach your defenses. In fact, all it could take is a password shared publicly on a team chat app, an accidental click on a phishing link, or confidential company information accessed through a public Wi-Fi connection.

Your existing protocols and training programs were likely created and implemented in a pre-pandemic world. Failure to update company security protocols and training programs increases risk and could lead to many consequences.

Your updated IT Policy should directly address the following areas:

• • Personal device security – If your company allows employees to use their personal devices for official tasks, you must ensure they are of a minimum standard.
    • • Clearly define what is permissible and what is not—e.g., approved type of devices, operating systems, applications, and websites.
      • Provide your employees with a list of all security, remote access, VPN, and other tools they need to install before starting any remote work.
      • Your employees should know the level of access/control the business has over their devices, the type of technical support you can provide, and the company’s right to wipe or alter the devices.
  • Network security – Public Wi-Fi and home Wi-Fi networks are nowhere near as secure as the LAN connection in your office. That’s why you must enforce minimum security standards to ensure employees don’t put company data at risk.
    • • Define everything from Wi-Fi encryption standards, Wi-Fi password difficulty, network security software, router safety guidelines, and the types of devices approved to connect to the same network.
      • The use of public Wi-Fi must be actively discouraged.
      • If an employee has no other alternative, give them a list of essential safety guidelines they must follow—e.g., secure connection, WPA3 compliance, websites to avoid, etc.
  • Cybersecurity training programs – The rapid migration to a remote work setup has stretched IT teams in most organizations beyond their limits. They must take care of support requests while ensuring data and digital assets remain safe and secure. Adequate cybersecurity training for your employees is critical to ensure they can deal with everyday and emerging cyberthreats. The training program should include the following and much more:
    • • Password management and multifactor authentication
      • Email usage and identifying phishing and ransomware attacks
      • Guarding personal devices against cyberattacks
      • Operating/updating security software
      • Configuring Wi-Fi and setting up VPNs
      • Reporting/responding to cyberattacks