Guest Editorial by Eddie Segal
The number of remote workers grew substantially since the World Health Organization officially declared Covid-19 a pandemic on March 11.
Within a few weeks, an estimated 16 million workers in the U.S. have switched to remote work to prevent a health crisis.
This is nearly a quarter of all knowledge workers in the U.S.
Remote work implementations increase further, as more states encourage citizens to work from home.
However, despite apparent benefits of remote work, there are some security risks that come with this work culture shift.
This article reviews common remote work risks and offers seven possible solutions.
What Is Remote Work?
Organizations looking to efficiently shift some or all of their employees towards remote work have to provide tools and IT infrastructure to support their activities.
This includes planning for increased loads on cloud platforms and servers.
Technologies every company with remote workers should consider include:
-
Mobile hardware tools
-
Remote workers still need access to physical equipment like phones, printers, and computers.
-
Organizations need to provide smartphones, laptops, and other hardware equipment.
-
-
Reliable Internet connection
-
Companies need to make sure that remote workers have the fastest subscription plan available.
-
However, the plan has to fall within your company’s budget.
-
-
Communication and collaboration tools
-
The latest technologies include Slack for text chats, Zoom for video conferencing, and Google Drive for file sharing.
-
-
Project management tools
-
Inline project management tools help teams set their tasks, monitor progress, and verify completed work.
-
Examples include Asana, Trello, and Monday.com.
-
How to Prevent Remote Work Vulnerabilities
Companies must establish a process to prevent vulnerabilities like free WiFi connections, deceptive emails, and authentication issues.
You can do this by remediating known vulnerabilities or by instituting patch management programs.
Below, you’ll find an overview of seven remote work vulnerabilities, and tips you can use to prevent them.
Prevent Phishing Vulnerabilities
Phishing is a cyber attack that uses deceptive emails with malicious links and attachments as a weapon.
The objective is to trick the email recipient into clicking the malicious link.
Once the recipient clicks on this malicious link, a hacker can gain access to the employer’s machine.
In coronavirus-related phishing attacks, hackers send a massive amount of emails posing as legitimate health organizations.
The recipients review the email, and infect their systems by clicking on the attachment.
The malicious link inside the email can also take them to legitimate looking websites asking for their credentials.
To prevent phishing attacks, organizations need to remind employees that legitimate emails do not request personal information.
Each employee should verify any hyperlink before clicking on it.
Other signs of phishing include unfamiliar senders, generic greetings, or messages with bad spelling and grammar.
(Introducing the 2019 ‘ASTORS’ Award Winning for Best Hardware Authentication Solution – YubiKey 5Ci. Industry-Leading, Multi-Protocol, Hardware Authenticator Solution. Supports FIDO2 to Defend Against Phishing and Replaces Weak Password-Based Authentication. Courtesy of Yubico and YouTube.)
Use Encryption Software
Remote workers can lose company devices, or worse, a company device can be stolen.
As a result, the sensitive information on that device can find its way into the wrong hands and expose the organization to vulnerabilities and data breaches.
Encryption tools can protect corporate and sensitive data by blocking access from any unauthorized user.
In addition, companies need to make sure that email systems, messaging apps, and file sharing systems are also encrypted.
Tools like Adobe Acrobat and Microsoft Office offer file encryption options for your documents.
Remote Workers Must Use Secure Networks
IT managers control the security of all corporate networks in office environments.
Home networks, however, usually have weaker security protocols like Wired Equivalent Privacy (WEP) instead of Wi-Fi Protected Access (WPA-2).
Weaker security protocols enable attackers to easily access the network.
Cafes, libraries, or similar public places that offer free WiFi can cause serious security issues.
Traffic in free WiFi networks is usually not encrypted.
Hackers can target such environments, and activate cyber attacks when a free Interest user connects to the corporate network.
Companies need to limit remote access only to necessary network sections.
Each employer should have access to data with different levels of sensitivity and value.
Make sure to prevent access to your most valuable corporate data.
If some employees still need access, you have to limit the access to the extent and time necessary to complete the assigned task.
(Introducing the 2019 ‘ASTORS’ Award Winning for Best Privileged Access Security Solution – the BeyondTrust Privileged Access Management Platform. The BeyondTrust Privileged Access Management Platform is a modular, integrated solution that provides visibility and control over all privileged accounts and users. By uniting capabilities that many alternative providers offer as disjointed tools, the platform simplifies deployments, reduces costs, improves system security, and reduces privilege risks. Courtesy of BeyondTrust and YouTube.)
Make Remote Work Easy
Making remote work easy appears to contradict the principle of limiting access to data.
But if you make access too cumbersome, employees can develop workarounds.
One common workaround is to download material locally.
Local downloads present an opportunity for attackers, since individual devices often have weaker defenses than a corporate network.
The U.S. Securities and Exchange Commission (SEC) fined a major broker for an arrangement where an analyst created a personal “shadow network” to enable him to meet his deadlines.
The shadow network was breached, triggering a SEC audit.
Monitor for Potential Security Risks
Network monitoring enables you to review, analyze, and manage network traffic for any abnormality.
Network traffic monitoring uses different tools and techniques to analyze computer network-based traffic.
Medium-sized businesses and enterprises usually use a Virtual Desktop Infrastructure (VDI) or a Virtual Private Network (VPN) for working remotely.
To prevent VPN tunnel exploitation, you should monitor VPN session and tunnel count, as well as data sent and received.
Unusual behavior can be easily identified from tunnel traffic data and addressed to avoid attacks.
(Introducing SolarWinds® Network Performance Monitor (NPM), created by network engineers for network engineers, is a complete monitoring solution designed to provide you with the tools you need to work smarter, improve visibility, and prevent downtime. See why SolarWinds is a worldwide leader in network monitoring. Courtesy of SolarWinds and YouTube.)
Authentication
Working from home can be a stressful situation for IT.
However, you can address some authentication issues with the right tools in place.
Tools like Managed File Transfer (MFT) provide Single-Sign-On (SSO) functionality, multi-factor authentication, tamper-evident, automation, and logging.
As a result, IT can establish compliant data security practices while enabling employees to collaborate efficiently.
Compliance Implications
Organizations do not have full control over the devices and networks of their remote workers.
As a result, companies find themselves at a greater risk of not complying with security regulations.
Essentially, remote workers lose the security provided to brick and mortar work areas.
Another compliance issue is related to change.
For instance, an organization may be certified for SOC2 compliance, but those controls do not apply to remote workers.
Therefore, a massive remote workforce can unintentionally lead to noncompliance issues.
Conclusion
Disruptions caused by COVID-19 is inevitable.
In addition to work culture changes brought by the shift to remote work, hackers are leveraging people’s fear and uncertainty to launch a wide range of attacks on remote workers.
Organizations need to make sure they are capable of preventing potential attacks and data breaches by monitoring for potential security risks, and enforcing granular access control, advanced authentication, and data encryption.
About the Author
