This blog was produced in conjunction with Bob’s Business, a leading provider of cyber security awareness training and Partner of Data2vault.
With the recent COVID-19 outbreak, cyber security has never been as important to organisations of all sizes as it is right now. IT departments across the country have been put under unprecedented pressure and many organisations are relying on staff working from home in order to continue operating as usual. From a business continuity perspective, there are a number of preparations and precautions organisations need to consider to ensure a safe and secure home working environment. Protecting remote workers from the increased cyber security threat is paramount. Below are some hints and tips to think about and help you do just that.
Set up Virtual Private Networks
A VPN (Virtual Private Network) is a secure way of transporting private data across insecure networks, like the Internet. In essence, you can use a VPN to disguise your IP address and location when using the internet. This is a great security measure, especially if you are working with confidential or sensitive information that could make your organisation a target to cybercriminals.
It is essential to make sure your VPN is always setup between two known points (your remote device and your company’s network), and this is in-line with your company’s information security policy. Beware of using consumer VPN’s, as they often harvest data. You should always liaise with your IT department about how to set one up safely. Consider a corporate VPN; your company network at one end a VPN client on remote devices.
Add Mobile Device Management
If your organisation makes use of Microsoft Office 365, or G-Suite, make sure that you’ve set up advanced mobile device management, and remote devices are set to segment personal and corporate data. This will give you more control over your organisation’s data, it will require you to set stronger passwords on your staff’s devices and the ability to wipe devices remotely.
You must also remember that data breaches aren’t always caused by suspicious individuals. For example, if you leave your device unlocked when children are running around unsupervised, they could click something they shouldn’t. Be extra cautious and lock away your devices when they’re not in use. Consider Mobile Device Management and force password changes.
Configure multi-factor authentication
Change your remote devices passwords regularly and enable multi-factor authentication. This is particularly important when you access Public Cloud services like Office365 and GSuite. Poor password habits are behind a shockingly large number of breaches, so don’t get caught out. Have unique passwords for every service you use, so that if one service gets compromised, hackers won’t have access to multiple services you use. Also consider enabling two-factors authentication on every service which supports it. It’ll make logging in a little longer, but your accounts will be extremely difficult to compromise. Consider Multi-factor authentication on all your applications that support it.
Re-route your calls
You need to be able to perform your role to the same standard at home as you do in the office. This includes redirecting calls that would usually come to your work phone, to your mobile. Also think about professional instant messaging platforms such as Slack, or Teams. Conferencing services and the ability to access CRM, Accounting and Service Desk applications to do your job to the best of your ability, but make sure you adopt secure practices. Consider the information security of each application you need to access.
Automate security updates
You’re probably no stranger to pop-up windows telling you if software updates are available for your computer, laptop, tablet or mobile. Make sure your software is fully up to date to ensure any bugs are fixed and security flaws are patched. Consider an automated software patching service, or always accept software and system updates.
Secure your microphones and webcams
Webcams can be easily hacked, meaning that private client conversations could be listened to by malicious individuals. Malware can often be used to access your webcam and mic so make sure you’re running the latest version of your antivirus software, and use a cam cover when it’s not in use. Consider covering or disabling your webcams and mic when not is use.
Are IoT devices your weakest link?
Most homes now have a number of IoT devices from Alexa to Hive, to light bulbs, toasters and smart TV’s connected onto the home network. With remote working please aware that these IoT devices have little, or no security and their default passwords must be changed. Hackers are well-versed in accessing the most vulnerable device on a network, usually IoT, and then hopping onto the computing devices that they want to compromise. Don’t let IoT devices be your weakest link when protecting remote workers. Secure your home network, play attention to all IoT devices.
Train your staff about phishing
Working remotely can be lonely, and there are many distractions. It is very easy for concentration to drop off during the day, and hackers using email sophisticated techniques know this. With 90% of breach starting with a phish, hackers are bombarding company’s with millions of phishing email every day. While many of these suspicious messages get blocked, some get through. Ethical phishing and cyber based e-learning is a great way to raise and maintain awareness for your remote workers. Consider a regular program of ethical phishing and cyber e-learning courses.
How are you backing up laptops?
Users will be creating business data on remote devices, and they may store the data locally. In which case a backup of the data should be running daily, and the backup data should be under the control of the organisation’s IT team. Consider laptop backup for remote workers
Prevent ransomware infections
Remote workers may store their data on network servers, so they can share information and collaborate with their colleagues. Remote workers are more vulnerable to phishing attacks, they are more likely to click through an email carrying malware and ransomware than if they were in the office. If their data gets infected with evolved ransomware, the type that does not detonate immediately, it is hidden in their files and can traverse networks infecting other files once it is stored in a network server. At some point in the future it detonates. Endpoint malware scanning tools do a good job of protecting files on remote devices, but detecting hidden malware and ransomware stored in network server data requires a different approach. We would recommend Attack Loop protection that scans Windows files stored on network servers during backup and restore, detecting zero-day exploits to identify and alert against hidden ransomware code. Consider scanning Windows files, created by remote workers, and stored on network servers, in order to prevent Attack Loops of ransomware infection.
backup your Office 365 data
We see a significant uptake in Office365 email for remote devices, as its quick and simple to set up. Logistically it may be impractical to provision high volumes of client VPN’s for remote users to on-premises email servers. It’s important to note, Microsoft do not backup user data in O365 in any of their service offerings from E1 to E7 and Business to Business Premium. OneDrive SLA’s specifically excludes backup files from being stored in the service, and Microsoft state that “versioning does not provide protection against ransomware”. User data in O365, whether in email, OneDrive, SharePoint or Shared Folders must be backed up, and the backup data should be under the control of the organisation’s IT team. Consider backup for O365 for remote workers to protect user data in email, SharePoint, OneDrive and Shared Folders
For more information about these services, and if you any need help to ensure you are protecting remote workers and the data they use, we work with a number of cyber security partners that can help you. Give us a call on 0333 344 2380 or click here and we will call you.