What to keep in mind when you ask your employees to work from home.

Due to the COVID-19 outbreak, many companies are asking their employees to do their work at home, including those that have never considered it. That is, they do not have teleworking policies and, therefore, it is unlikely that they take into account the greater cybersecurity risks of teleworking. We are going to try to put an end to this situation and explain how to minimize cybersecurity risks.

At first glance, the only change office workers experience is not being able to be in physical contact with colleagues. But there is much more. For example, we must take into account the communication channels, established routines, collaboration tools, equipment and access to this equipment, which extend the surface of cyber-attacks.

Communication channels

When your employees work in the office on the local network, your total security solutions manage all the data that is exchanged in the processes. But when your employees work from home, a new variable comes into the equation: Internet Service Providers (ISPs). You don't know anything about their cybersecurity measures, nor can you control them. In some cases, home Internet connections are accessible not only to your employee, but also to a potential cybercriminal. In summary, it is advisable not to share corporate secrets through these communication channels due to the risk of data theft or leakage.

Solution: If your employees have to connect to corporate resources remotely, make sure they are configured with a trusted VPN to establish a secure channel between the workstation and your infrastructure and protect corporate data from potential outside interference. They should have an internet security software installed in their device that will keep them safe on internet. In turn, it prohibits connections to corporate resources from external networks without a VPN in place.

Established routines

Teleworkers cannot approach a colleague to discuss a work issue, so it is to be expected that correspondence will increase, including new participants (people with whom communication used to be merely verbal). In short, not being able to have all colleagues on hand as in the office, disrupts the routine of employees. In theory, this gives the cyber attacker more room to maneuver and, in particular, to use BEC attacks. Among all this wave of corporate correspondence, it would be difficult to detect phishing emails. That is, a fake message requesting data would not be perceived as unusual or suspicious as it might appear under normal circumstances. Furthermore, the more relaxing the home environment, the less alert the worker will be.

Solution: First of all, even if they are at home, all employees should exclusively use corporate mail. This would make it easier to detect cybercriminals' attempts to impersonate a worker if they use an account on another domain. Second, make sure that your email servers are protected with total security technologies capable of detecting those manipulations that try to change the sender of the message. Our solutions for both email servers and Microsoft Office offer these technologies. And third, before you send employees home, give them a crash course on cyber threats.

Collaboration tools

After losing face-to-face contact, employees may turn to other collaboration methods, some not very reliable, and these must be set up correctly. For example, a Google Docs file with improperly configured access permissions can be indexed by a search engine and become a source of corporate data leakage. The same cybersecurity risk exists for data stored in the cloud.

Solution: Obviously, it is up to you to choose a collaboration environment that is suitable in terms of internet security and functionality. Ideally, the registry would ask for a corporate email address. Also, it is worthwhile to designate an administrator who will issue and revoke access rights, as needed. But the most important thing is that before allowing employees to telecommute, a cybersecurity awareness session is held (it can be remote) in which the exclusive use of the collaboration system implemented in your company (or approved by you) is insisted. It can also help to reiterate that they are responsible for keeping corporate secrets safe.

Team

In general, not all employees have access to corporate laptops. And mobile phones are not useful for all tasks. Therefore, employees are likely to start using home computers. For companies without a BYOD policy, the use of personal devices is a cybersecurity risk.

Solution: First, if employees have to work from home, make corporate laptops and phones available whenever possible. It goes without saying that devices must be protected with appropriate security solutions. In addition, these solutions must offer the possibility of carrying out the following actions remotely: deleting corporate information, separating personal data from corporate data and placing restrictions on the installation of applications. Set them up so that they can automatically check for the latest critical operating system and software updates.

If for any reason employees have to use their personal devices, it is time to introduce a BYOD policy to manage corporate data on these devices; for example, you can create separate divisions for personal and business data. Also, try to get all employees to install home total security software, even if it's a free security solution. Ideally, you should allow these devices to connect to your corporate networks after they have ensured that a security solution has been installed and that the operating system is up to date.