How to keep your business secure with remote workers
In the wake of the unprecedented pandemic, many companies are mandating social distancing through remote work and are striving to ensure business as usual across their operations to minimise impact on their employees and customers. This new way of working highlights the importance of implementing procedures to avoid cybersecurity risks and business interruptions.
As employees continue to migrate from in-office to remote locations, the shift in the working environment will pose new challenges. This is where guidelines and best practices are needed to ensure remote employees are working securely.
Improve security with VPN
While companies may have taken in-house precautions such as firewalls, Domain Name System (DNS) and Intrusion Detection Systems/Intrusion Prevention Systems (IDS/IPS), these may not provide the level of security a business needs as the workforce becomes more distributed. In fact, due to the increasing number of remote workers, the Cybersecurity and Infrastructure Security Agency (CISA) is encouraging organisations to adopt a heightened state of cybersecurity – and this includes establishing a virtual private network (VPN) to enable remote workers to securely connect to the company’s network.
VPN guidance by the CISA includes:
● Update VPNs, network infrastructure devices, and devices being used to remote into work environments with the latest software patches and security configurations.
● Alert employees to an expected increase in phishing attempts.
● Ensure IT security personnel are prepared to ramp up the following remote access cybersecurity tasks: log review, attack detection, and incident response and recovery.
● Implement multi-factor authentication (MFA) on all VPN connections to increase security. If MFA is not implemented, require teleworkers to use strong passwords.
● Ensure IT security personnel test VPN limitations to prepare for mass usage and, if possible, implement modifications – such as rate limit – to prioritise users that will require higher bandwidths
Use best practices to stay secure while working remotely
Adjusting to working remotely is more than just finding a suitable office location within the home. Remote workers need to take into consideration the possibility of cyber-attacks and take the necessary precautions. The following list of best practices will help remote workers protect their new work environment, as well as the business.
● Stay connected to the company’s VPN: The additional security protection provided by the VPN is critical to prevent malicious attacks.
● Use a secure Wi-Fi network: Business work should always take place on the employee’s secure, private home network and not public network access points. When data is sent via an unsecured Wi-Fi connection, the user loses their privacy, making it possible for cybercriminals to intercept data. Not only is personal information at risk, but business data can also be compromised.
● Secure home workstations: Employees need to make sure that they have fully patched and updated antivirus and antimalware software. In addition, their in-home Wi-Fi should be secured with Wi-Fi Protected Access (WPA2 or WPA3). They also need to disable insecure features such as Universal Plug and Play (UPnP), as well as change Internet of Things (IoT) default logins.
● Follow in-office best practices: Remote workers need to continue to follow the same best practices they did in the office such as avoiding non-reputable websites or links, and promptly report any suspicious activity or concerns to their internal IT or Managed Service Provider (MSP).
● Work with cloud applications: When possible, teleworkers should have access to cloud applications to ensure data is being backed up.
● Remain vigilant: With the increasing number of attacks using COVID-19-based content as a delivery mechanism for malware, remote workers need to be especially alert when reading emails, messages and web browsing.
● Disconnect unknown devices: Devices such as USB sticks and peripherals should not be connected to the company’s hardware.
● Use strong passwords: This may sound basic, but it is important in reducing cyber-attack opportunities.
● Limit the family’s bandwidth usage: As everyone knows, the more devices in use such as phones, tablets, game consoles, etc., the slower the connection, which can hinder the employee’s ability to effectively work remotely.
While it’s highly recommended that remote employees are provided with company hardware, this may not always be possible. If this is the case, the installation of a reputable antivirus and firewall should be installed on the devices being used remotely for work. These tend to be provided at no charge through the employee’s internet service provider (ISP).
In addition to the applicable best practices listed above, employees using their own devices should:
● Ensure that the latest operating system and web browser updates are installed.
● Avoid the use of file sharing (P2P) and other high-risk applications.
● Use the business email only to conduct company business.
Although these security measures will help to promote a secure work environment while an increasing number of employees begin to work from home, there are other considerations.
Human resource policies and practices should be reviewed to ensure that they are consistent with the Centers for Disease Control and Prevention (CDC). The CDC has put in place recommended strategies for employers, which include exploring flexible worksites such as telework or staggering shifts to increase the physical distance among employees.
As the COVID-19 situation continues to escalate, putting best practices in place now will help to ensure a seamless and secure migration of in-office workers to remote workers.
Ryan Weeks is CISO at Datto
In the wake of the unprecedented pandemic, many companies are mandating social distancing through remote work and are striving to ensure business as usual across their operations to minimise impact on their employees and customers. This new way of working highlights the importance of implementing procedures to avoid cybersecurity risks…
