People love remote work … especially cyber-hackers

 

It is no secret that remote work is here to stay. In the past few years, a very large percentage of organizations have remote and hybrid workers. So, how do you keep your remote workers cyber-secure? How do you protect remote workers from cyber threats?

One big issue is that although remote work has many benefits, most people are unaware of the cyber-security threats they now face. And your company, like many, hasn’t been given clear guidelines on how to keep your remote workers safe.

To help bridge that knowledge gap with cyber security, we’ve pulled together some important insights and things you can do to keep you and your people secure.

 

Remote workers are the new target

 

According to a recent study, 43% of companies experienced a cyberattack in the past year, and 60% of those attacks were targeted at small businesses.

Remote employees are especially vulnerable to these security threats because they work outside the company’s secure infrastructure. Cybercriminals exploit this and can gain access to sensitive data or take control of remotely connected devices.

To protect a remote workforce, it is essential to provide them with proper training in cybersecurity best practices and enforce a culture of security throughout the company.

Let’s face it, working from home has its perks. Commute times and wasted hours in the car/train are eliminated, workers have flexible hours, and talented employees can be hired from anywhere on the planet!

But the rise in remote work has created new and challenging cybersecurity risks.

 

How to protect your remote employees

By following the security measures below, remote workers can keep an organization’s sensitive data safe and secure.

Remote working requires employees to accept responsibility for proper cybersecurity practices before they are allowed to work outside the company environment!

 

Develop a “security first” attitude

To prevent data breaches, it is essential to develop a security-first attitude. Employees must prioritize cybersecurity and implement best practices into their daily routines.

 

Security actions you can take:

• Creating strong passwords and using two-factor authentication
• Using a VPN (a virtual private network) when working remotely
• Never storing data locally, but instead utilizing the organization’s data management system
• Keeping software (operating systems, applications, antivirus software … ) and other security systems up to date

Be aware of the cyber-risks

Cybercriminals are having great success targeting remote workers to access confidential data on business networks. Because of this, they have doubled down on attacks targeting employees outside the office and outside the organization’s security foundations.

 

 

Some common attacks include: 

• Phishing Attacks are primarily delivered through email
• Vishing Attacks are mainly delivered through phone conversations
• Smishing Attacks are delivered through text messages (SMS)

Humans “suck” at cyber security

Phishing, vishing, and smishing are different forms of social engineering that exploit our “humanness” desire to trust.

From a young age, humans are taught to be terrible at security … and unfortunately, hackers know this.

• Humans are taught to trust others.
• Humans are taught to avoid conflict and get along with people.
• Humans are taught to help people.
• Humans look for quicker ways to get things done.
• Humans like shortcuts.
• Humans are “click happy.”

Cyber-criminals feed off of human weaknesses

Highly trained cybercriminals and hackers feed off all this humanness … and constantly develop and test new and clever methods to exploit them.

 

Remote workers frequently let their guard down

Individuals who work outside the office tend to let their guard down more than those immersed in the work environment. When people are amongst peers, managers, and IT folks, they are more careful because they do not want to be “caught.”

Remote workers must remind themselves of security risks to stay vigilant when accessing business data and resources from outside the office.

 

Critical cyber security habits when working remotely

• Never click on links or attachments from unknown senders
• Verifying the authenticity of emails and websites
• Using strong passwords
• Using two-factor (or multi-factor) authentication
• Backing up data to the organization’s storage locations and keeping data off of local workstations
• Only accessing company data from a secure, private network
• Keeping all software and security systems up to date
• Restricting access to confidential data

Report any suspicious activity to your IT department or service provider immediately

If something seems “funny or strange” or if you suspect that you or your company has been a victim of a cyberattack, you must report it to your IT service provider or your internal IT people immediately. Quick action can greatly reduce the severity of data breaches and can help the organization mitigate disruption and damage.

Some signs that you may have been attacked include:

• The computer running slowly or acting strangely
• Inability to access files or documents
• Strange or unexpected charges on your credit card statement
• Unusual requests from co-workers or your management team
• Strange pop-ups from antivirus software
• Weird “personal” emails from co-workers or clients
• Unique error messages that appear while doing work

Do not hesitate if things look weird or unusual

If you experience any of these symptoms, contact your IT department or IT service desk immediately … DO NOT HESITATE! They will be able to help you quickly determine if you need to take steps to protect yourself and/or the company’s data or network.

If they feel there is reason to believe that you have been compromised, they might isolate your workstation from the rest of the network until it can be “cleaned” and confirmed safe.

Monitor your accounts for unusual activity

It is important to monitor your accounts for unusual activity. These include:

• Bank accounts
• Investment accounts
• Online shopping accounts
• All credit cards

Occasionally checking on mortgage accounts and balances and other items that may have long-term leases or payment programs is also a good idea.

Utilize SSO for remote working

Single sign-on (SSO) is an authentication service that permits users to log in using one set of credentials (name and password) to access multiple applications. SSO is important because it can be used by organizations to fend off unauthorized users and ease the management of logging into different applications with multiple usernames and passwords.

Users, especially remote users, often look for shortcuts when they access applications and data. The tendency to “cut corners” in a remote work environment occurs more frequently when users are forced to log in separately to multiple applications multiple times a day.

SSO makes life easier for a remote user

SSO is a convenience to users, but it does present some risks to an organization’s security. For example, an attacker who gains control over one user’s credentials may have access to many different applications that the user has access to, thus increasing the potential damage that a cybercriminal could do.

To avoid malicious access, it is essential that every security aspect of SSO be implemented and should definitely be coupled with identity governance like two-factor authentication (see below).

Implement two-factor authentication (2FA)

2FA is absolutely a necessity in today’s world. Newer versions of 2FA are much less cumbersome than older versions and methods. Two-factor essentially means something you know (like your username and password) tied together with something you have (like a cell phone or a key fob).

If a cyber-criminal gains access to your username and password, it would be very unlikely that they would also have access to the 2^nd factor … your cell phone. Furthermore, even if they did have access to your username and password, they would be unable to access your organization’s network without the authentication code on your phone or company-issued key fob.

Adopt a strong password policy

Cybercriminals now have access to wildly powerful computing power. This has completely changed the way that organizations implement passwords. The password’s length, not the password’s complexity, makes it less likely to be discovered. Therefore, pass Phrases should be used (see below) rather than complex passwords.

• This password is weak: tMe$2*n3! … and it is very difficult to remember or type!
• This passphrase is strong: The$unisYellow## … Adding just a few special characters to this phrase, “the sun is yellow,” makes this a strong password that is easy to remember and fairly easy to type.

Here are a few additional guidelines when creating a strong password (passphrase)

• The password (passphrase) should be at least 14 characters long
• Use a combination of letters, numbers, and symbols
• Avoid using personal information
• Avoid common words or phrases
• Change your password every quarter
• Use different passwords for different applications
• Create new passwords rather than re-using old, expired passwords

Use a Passphrase rather than a cumbersome Password

A passphrase is a series of words that can be used to authenticate a user. Passphrases are typically longer than passwords, making them harder to guess or mathematically crack with supercomputers. Additionally, they are easier to remember and easier to type than a string of random characters.

When creating a passphrase, choose a phrase that is easy for you to remember but would be difficult for someone else to guess. Avoid using easily accessible information like your birth date or mother’s maiden name. You should also avoid using common words or phrases such as “password” or “1234”.

Use Password Management Software to help create and manage (complex) passwords

The best solution to the password problem is to use a password manager. Unfortunately, many applications ask if you want to use very long and complex passwords generated by a password manager. By design, these passwords are impossible to remember or type because they are kept by a password management tool that automatically inserts the correct passwords for the appropriate applications.

A password manager is a software application that helps you generate and store strong passwords. Password managers can also help you keep track of your login information for different websites and applications.

There are many different password managers available, so choosing one that best meets your needs is important. Some password managers are free, while others require a subscription. Be sure to research different options before making a decision.

 

 

Remote workers need to keep their software updated 

Hackers constantly find security flaws in software applications … and manufacturers always provide users with patches to update their software to keep them secure. Most organizations manage this process of patching software by rolling out patches to workstations overnight when there is no disruption for the employees.

Unfortunately, workstations outside the organization’s network do not get updated through the company’s software patching process. This means that the remote employee will need to update (patch) all the locally installed applications on the workstation that is used from home or their remote office.

Unpatched devices present some of the most vulnerable areas in an organization’s cyber security profile, so keeping software up-to-date is imperative for remote workers.

Encrypt the data (hard drive) on your remote device(s)

Businesses have greater physical security systems than most homes do. Because of this, there is a risk that the device used by a remote worker might be stolen. Either from the house, their car, a coffee shop, or any other place where the device might be used.

Encrypting the hard drive on the computer keeps the data safe in the event of a theft. Data stored locally on the laptop and authentication information is inaccessible to the thief when the device’s hard drive is encrypted.

An important thing to note: The user MUST keep the encryption key safe and accessible. In most cases, if the user forgets the encryption key, all the machine data will be lost, as the hard drive will need to be completely erased/reformatted to be usable again!

Store all data in the organization’s centrally managed data management system

Many remote users store documents locally on their hard drives or desktops because this is “easier,”, especially for frequently used documents. Unfortunately, these documents fall outside the organization’s processes for backing up the data. If this locally stored data is accidentally deleted or corrupted, there is no backup of the data, and it is lost forever.

The data would also be 100% gone if the remote worker’s device was lost, stolen, or damaged for some reason.

Remote users need to get into the habit of storing ALL DATA within the company’s data management system to ensure that the data will be safe and available if the local workstation is compromised.

Using public WiFi

In short, “Just Say NO!” Remote users should not use public wi-fi. Please don’t use it in coffee shops, airports, hotels, or anywhere.

It is very easy for hackers to set up a fake wi-fi environment that simulates a public wireless network. Remote users can unknowingly log onto the hacker’s phony wi-fi network. They can allow the hacker to take over the compromised machine or install code that would allow them to track the keystrokes on the device… thus compromising usernames, passwords, financial information, and other sensitive data.

Just Say NO to logging on to any public wi-fi!

 

 

Don’t allow family members to use your business workstation

In many cases, the laptop being used by the remote worker is much more powerful than the home PC. This makes it tempting for gamers in the family to want to “borrow” the laptop for epic gaming battles … epic shopping adventures … or epic movie viewing.

Unfortunately, most family members do not have the same cyber security training as remote employees and are much less careful when browsing websites or downloading games or applications. The best policy is to restrict the use of company equipment to the company employees only … no family use … sorry.

In Conclusion

Keeping your remote workers cyber-secure is critical because they are the front line when it comes to keeping your company secure.

Unfortunately, employees are the number one cause of breaches to small to midsized organizations. And social engineering, which is a manipulation technique that exploits human emotions to gain access to private and company info, is how hackers get inside your company.

As more and more of your workers work at home or remotely, they become much more vulnerable to these cyber security threats and attacks.

It is important that you have a clear plan to protect your remote workers. And your current IT provider has the cyber security experience to protect our organization.

Next Steps

If you would like to learn more insights into how to protect your organization, go to our cyber security learning center.

Cyber-security Learning Center

If you have more urgent needs and are concerned about your organization’s security, let’s talk!

Start A Conversation