COVID-19: Managing Cyber Security Risks of Remote Work

Teleworking, “remote working,” or simply “working from home,” is a centerpiece of those efforts. While remote working arrangements may be effective to slow the community spread of COVID-19 from person to person, they present cybersecurity challenges that can be different than on-premise work.

If your business is new to these remote work situations, it is crucial to evaluate and ensure your infrastructure, applications, and data are protected—starting with the policies your company already has in place for cybersecurity and business continuity.

Evaluate Current IT Policies

Review your current IT security and similar IT policies to determine if there are any established security guidelines for remote work, especially remote access to company information systems. Some organizations may have policies specifically geared for remote work, while others may provide for contingencies in disaster recovery plans, BYOD (bring your own device) policies, and other similar plans and policies.

It is important to identify where gaps in your security policies may be hiding and cover any vulnerabilities early.

Below is a list of considerations and tips to help guide your business through new cybersecurity challenges your business may be facing with a new remote workforce.

Remote Work Cybersecurity Tips

• Educating every company employee on security measures (pre-existing or new for remote work) is critical to the safeguard of access to information and mission-critical systems. This can often include confidential information, protected intellectual property, proprietary product information, customer information, employee files, and other personal data.
• Do not allow sharing of work computers and other devices. When employees bring work devices home, those devices should not be shared with or used by anyone else in the home. This reduces the risk of unauthorized or inadvertent access to protected company information.
• Company information should never be downloaded or saved to employees’ personal devices or cloud services, including employee computers, thumb drives, or cloud services such as their personal Google Drive or Dropbox accounts.
• Be sure all employees reboot their computers to ensure that all versions of software are up to date with all necessary patches.
• Be on the lookout for phishing attacks and other forms of social engineering involving remote devices and remote access to company information systems. There are an increasing number of Coronavirus-based phishing emails going around, preying on the health concerns of the public, with a variety of COVID-19-related topics such as general financial relief, airline carrier refunds, fake cures and vaccines, fake testing kits, and/or claiming to be related to government or charitable organization. With the approval of the economic stabilization package, you must be especially wary of any emails asking you to verify your personal information to receive funds from the government as well.
• Sensitive information, such as certain types of personal data (e.g., personnel records, medical records, financial records), that is stored on or sent to or from remote devices should be encrypted in transit and at rest on the device and on removable media used by the device.
• A key to cybersecurity when working remotely is through coordinated visibility of IT systems. Using tools and processes like log review, attack detection, incident response and recovery gives businesses a proactive stance when it comes to protecting data. For companies that don’t have these measures already in place before shifting to a remote workforce, engaging with cybersecurity partners to provide managed services can relieve internal teams already stretched thin from the pandemic. Ntirety’s Security Operations Center (SOC) provides this peace of mind through a trusted services to monitor and mitigate any issues that may arise.
• Implementing Multi-Factor Authentication (MFA), sometimes referred to as Two-Factor Authentication (2FA), adds multiple layers of access security by going beyond simply asking for a username and password. Users must provide additional credentials, such as a code from the user’s smartphone, the answer to a security question, a fingerprint, or even facial recognition. MFA is also often a requirement to meet compliance standards, which companies must continue to uphold through remote work situations.
• Virtual Private Networks (VPNs) ensure that internet traffic is encrypted, especially if connected to a public Wi-Fi network. If your organization already uses VPN, make sure it covers all departments and all employees. If your company does not use VPN, it is crucial to the security of your business IT to implement this remote work tool. Learn more about VPN and other IT solutions that make remote work more secure and streamlined here.
• Additional security measures, such as email filtering, Intrusion Detection System (IDS), Intrusion Prevention System (IPS), and User behavioral Analytics just to name a few, can bolster a cybersecurity team by automating some of the necessary monitoring and defense responses. Once up and running, these tools and processes can give time and focus back to internal IT teams to help their company manage the new remote workforce reality COVID-19 has brought upon us all.

Following Best Practices is the Best Defense

Whether working remote or in-office, following and integrating these cybersecurity tips into company-wide IT policies will help protect your business’s data while helping employees protect themselves from coronavirus through social distancing.

Above all–stay vigilant. Cybersecurity is not immune to the remote work risks from COVID-19.

Learn more about ways your business can boost your IT security for the remote workforce and beyond. Contact Ntirety’s IT experts to start building a stronger cybersecurity policy today.