From Telework back to Regular Work: Keeping Your Company Cyber-Safe
Cybersecurity
Many businesses across the globe with the ability to do so have opted to switch to an online, telecommuting approach to operations strategy for the past few months due to the COVID-19 pandemic. As many states gradually begin the reopening process, some companies are deciding to gradually transition back to "normal" work as well. This transitional period will not only require continued COVID protections such as social distancing and wearing masks while in groups, but business owners, managers, and employees alike will need to ensure they keep cybersecurity at front of mind. We'll take a look at some of the considerations your company should be aware of in order to prevent being exposed to vulnerabilities brought on by the process switching back to regular work from telework.
1. Company devices used at employee homes are coming back on-site -- Many companies made the wise decision to provide employees with company-owned laptops or computers to utilize while working from home during the pandemic; this is considered to be the safer way of operating than requiring employees to do company work on their personal laptops as the use of personal devices for official work presents far greater risks due to the nature of content which might be accessed during a person's free time.
Though the utilization of company-provided devices helps to ensure the work being completed off-site is more secure than through other means, bringing those devices back into the office presents great threats to the company networks. The best way to ensure all devices are secure and without cyber risks such as malware is to have employees give over their work devices immediately for review, before ever reconnecting them to company networks and data bases. Once the device has been reviewed and cleared as being secure, it can be returned to the employee if they still need it during normal operations. If not, the laptop, cell phone, or any other device can be locked away and secured, with the peace of mind that it definitively does not present a risk. While this may make the transition a little bit slower than one might prefer, it is an essential step in ensuring these devices do not bring off-site threats into the office.
2. Scan devices and networks for vulnerabilities -- Not only should the devices used off-site be reviewed for any potential threats, but the machines left on the job site, left stagnant for months, need to be surveyed to ensure their fidelity and security. These machines may likely have been less monitored than normal due to the shift in operations and they could pose a risk to the company network if not checked out by the IT department. On top of this, a risk assessment of the company network as a whole is essential now more than ever to ensure that things like the office Wi-Fi and Internet are not going to put the reconnected devices connecting to them at risk.
3. Educate Employees on the risks -- Employee education on cybersecurity should be regular part of your business' operations as cyber risks are always present and employees can either be a company's greatest asset or its weakest link. However, now more than ever, educating employees on being cyber-safe is crucial to the success of transitioning back to on-site work. As mentioned in the first tip, the transition back to normal work will have to take some time in order to be successful - though this might feel a bit tedious, it does provide companies with an advantage as they have more time to talk with employees and let them know of the importance of cybersecurity best practices.
While a number of COVID-19 themed phishing schemes were seen for employees while working remotely, cybercriminals are realizing the state of the world is shifting to normal again and they are creating phishing attacks which target employees who are returning on-site masquerading as emails with helpful tips on being safe from Coronavirus while coming back on-site -- these are the sorts of things which need to be reviewed with your employees as they return to work.
4. Beware of Insider Threats presented by the remote work time period -- Though education of employees can help to prevent carelessness when it comes to cybersecurity, insider threats are on the rise in recent months due to the use of remote work by many companies. Some of this is due in fact to negligence on the part of employees who were not aware of cyber risks as they should have been; unlike the transition back to work, the transition to teleworking had to be swift by nature because shutdowns and government declarations were happening very quickly. However, not only are there insider threats both during quarantine and post-quarantine due to lack of awareness, but there have also been increases in malicious employees acting remotely.
Joseph Carson, Thycotic's Chief Security Scientist and Advisory Chief Information Security Officer told interviewers, "The [work from home] trend due to the COVID-19 pandemic has significantly increased insider threats from employees taking risks with company assets, such as stealing sensitive data for personal use or gain as employers have less visibility to what employees are doing or accessing."
Educating employees of cyber threats and how to be cyber-safe can help protect against negligent insider threat; in addition to this, the creation of strong data protection policies and constant monitoring of odd or malicious insider activity can help to prevent further insider threats.
5. Monitor operations closely and carefully for the first few months after returning to work -- Constant cybersecurity monitoring measures should be taken in order to protect your company from attack. Though this is always the case, the first few months following the return to "normal" operations should be met with vigilant monitoring of networks and databases in order to ensure no holes in your cyber defenses were able to slip through the cracks. No only were upstanding folks working from home, but so were the cybercriminals and they will no doubt have been working on new threats in order to take advantage of potential vulnerabilities. Monitoring systems closely during this time will hopefully catch any oddities that try and corrupt your data.
What about those companies continuing their Work From Home operations?
While many companies have their employees headed back to their offices, others are still hesitant to return to pre-quarantine setups. Though they do not yet need to be quite so concerned with the issues facing those companies under an operational transition now, the companies continuing telework will need to be sure to focus on proper cybersecurity approaches.
As mentioned earlier in the article, the use of personal devices for professional work presents great risks to a company and not all businesses are providing their employees with company-owned devices; in fact, 50% of remote workers reported that they were using their personal laptops to access sensitive information such as personally identifiable customer information (PII). Not only this, but 61% of people using personal devices said that their employers provided them with no way to secure their computers which were used to access sensitive data.
If possible, try and provide your employees with their own work-provided devices which are dedicated to solely performing work functions. If this is not possible, require extra security steps for employees to log in such as a dedicated VPN and the use of multi-factor verification in order to access company information.
