It’s almost impossible to imagine, but just a few months ago we found it quite normal to work 5 days a week in the office. Due to the corona crisis, many organizations have raised teleworking to the new standard in no time. And now that they have discovered its benefits, it is expected that this way of working will remain popular after the crisis. But not without a risk. Teleworking provides cyber criminals with an additional attack surface to harm your organization. In this article we provide tips to make secure teleworking possible.
What’s going wrong?
Improper management or use of telecommuting facilities is often the cause of an unsafe situation. A number of things that often go wrong:
Working with outdated software or hardware
Applications or devices that enable teleworking are not up to date. Such outdated features often have well-known vulnerabilities that attackers could exploit.
Examples:
- A teleworker using telework software has not installed the latest security update for this.
- The office network contains an old model network router for which the supplier no longer releases security updates.
Insecure connection to the office network.
The IT department has not securely configured the telework connections to the office network.
Examples:
- Network traffic between teleworkstations and the office network is not encrypted.
- The office network is accessible from anywhere in the world.
Use of unsafe private equipment
An employee uses unsecured private equipment for work.
Examples:
- An employee uses a private laptop without a virus scanner.
- The easy-to-guess default home network password has never been changed.
Unsafe use and management of software
Employees are not sufficiently familiar with the teleworking software and do not make use of the security options that this software offers.
Examples:
- A video meeting is accessible to outsiders, because the organizer has not protected the meeting with a password.
- Access to data in the cloud is not encrypted because the system administrator has not configured the cloud application appropriately.
The impact
If cyber criminals become aware of such an unsafe situation, it can have negative consequences. They can exploit the situation and invade the corporate network. In addition, they can cause considerable damage by:
- stealing confidential business information (such as customer data);
- manipulation of data (such as financial transactions) or IT systems;
- Disrupt IT systems – and thus often the service provision.
Measures for safe teleworking
Fortunately, there are several measures you can take together with your IT department to prevent or timely identify unsafe situations:
Inventory of software and hardware
Create an up-to-date overview of all applications and equipment that your organisation use to facilitate teleworking. Pay extra attention to the version of the used software or hardware. Are there any known technical vulnerabilities in this release? Are there options to close these vulnerabilities? Or is it better to replace this software or hardware?
Inventory of data
Map out which data your organization has made available to teleworkers. Check whether this data is sufficiently protected. Is the data encrypted? Do users need to authenticate to gain access? Are backups made and are they sufficiently protected?
Configuration of network connections
Verify that the organisation network security is set up according to best practices. This article will not provide an exhaustive list of best practices, but a search on Google for “network security best practices” provides valuable information.
Working with trusted equipment
Preferably your teleworkers towork with laptops and telephones that have been set up in a secure manner by your IT department. If that is not possible, look at the following options for the safe use of private equipment:
- Using separate private and work accounts on the same device, with the work account centrally managed by your organization;
- Using a standard checklist that teleworkers must go through to set up their devices safely. This checklist describes the security settings and software to be installed by you (such as a virus scanner selected by your organization).
Monitoring the network
Monitor the organizational network for suspicious activity. Specialised network threat detection software will help. Create a protocol that describes what to do when suspicious activity is detected.
Inform teleworkers
Train your employees in secure remote working. Pay attention to:
- handling confidential business information;
- the correct use of applications and equipment;
- the management (installation, configuration and updates) of applications and equipment;
- responding to suspicious situations.
Curious how your organisation can facilitate secure remote working? INTERMEDIATE can help. With our substantive knowledge, we find the right professional who can guide and support your organization. Interested? Please contact us: intermediate.pro/contact
This blog was written by Teun Tonino
