Even with the pandemic in the rearview mirror, many organizations have settled into a steady state of supporting remote or hybrid work, as allowing employees to work from home at least some of the time provides numerous benefits to both them and the organization.
However, it can also introduce security risks and challenges. Remote workers are more exposed to certain types of cyber threats, and the probability of accidental data disclosure and other security incidents is higher than with an on-prem workforce. Also, remote workers are more likely to participate in bring-your-own-device (BYOD) programs that allow them to work from personally-owned devices that are outside of the organization’s control.
A remote workforce security program is an essential component of a remote and hybrid work program. In this article, we explore the most significant security risks of remote work and offer some best practices that organizations and employees can implement to help manage and mitigate these risks. For example, requiring endpoint security solutions — as explored in this Gartner analysis — on remote devices can reduce the risk of malware infections and data breaches.
Security Issues with Working Remotely
While remote work has benefits for employees and the organization, a clear understanding of the security risks of remote work is essential to a secure and sustainable telework program. Some important cybersecurity threats that employees face when working remotely include the following:
Phishing
Phishing is one of the most common cyber threats. Remote workers are uniquely exposed to this threat due to various factors, including the use of personal email and the fact that they may not be protected by corporate email scanning solutions. Business email should always be routed through corporate email scanning solutions to be inspected for potentially malicious content.
Weak Passwords
Password security is a common remote working security risk that organizations face as employees use weak passwords or repeat the same ones for multiple accounts. If a remote worker uses a weak password for company accounts, an attacker may be able to gain access to their account and use it to remotely gain access to corporate resources.
Zero Day Attacks
Remote devices may not have the same level of endpoint protection as other systems that are deployed on-site. As a result, these employees may be more exposed to advanced cyberattacks, including zero-day malware campaigns.
Data Theft
With remote work, sensitive corporate data may be accessed from and stored on remote users’ devices. This increases the risk that the data may be stolen if those devices are compromised, the employee leaves the organization, or the device is lost or stolen. Corporate data should be stored in a way that allows it to be remotely monitored and wiped from devices by IT personnel if needed.
Unsecured Personal Devices
Remote workers may be permitted to work from personal devices under a BYOD or
BYOPC policy. This can create risks around cybersecurity and data security for remote workers if these devices are not updated and secured in compliance with corporate policy. For example, a personal device may not be running an approved, up-to-date antivirus or may be missing a vital security update.
Weak Backup & Recovery Systems
Data stored on remote workers’ devices may not be covered by the corporate backup and recovery solution. As a result, a ransomware attack or other incident that impacts a remote worker’s device may result in data loss and interruption to business operations.
Remote Work Security Best Practices for Employers
Employers can take various steps to manage the risks associated with their remote and hybrid work programs, including the following.
Carry Out Regular Risk Assessments
Companies face an ever-evolving risk landscape. As companies introduce new IT solutions and cybercriminals develop new attacks, new vulnerabilities and attack vectors can place an organization and its assets at risk.
For this reason, companies should carry out regular risk assessments to quantify their current risk exposure and develop strategies for managing it. These assessments should include a clear look at the risks associated with remote and hybrid work, BYOD policies, cloud infrastructure, and other new and evolving technologies.
Use Cloud Applications Built with Security Measures
Cloud solutions and infrastructure bring new security challenges to the company. These solutions are publicly accessible, and the cloud-shared responsibility model means that companies lack full visibility and access to their infrastructure. Also, cloud vendors often offer a range of settings and configuration options that, if set incorrectly, can pose a significant risk to the organization.
For this reason, it’s important to consider security when evaluating and selecting cloud solutions. Cloud applications that offer the security controls that companies need to protect themselves and maintain compliance will be easier to manage and operate securely.
Use VPNs When Connecting to Untrusted Wireless Networks
Remote workers may connect to corporate infrastructure via public or untrusted Wi-Fi networks. These networks carry security risks, such as eavesdropping and an increased risk of malware infections.
Virtual private networks (VPNs) can help to secure these devices when using untrusted wireless networks. Traffic is encrypted en route from the user’s device to the VPN endpoint, making it impossible for an attacker to eavesdrop.
Require Multi-Factor Authentication
Account security is a major concern for remote workers and is a vital component of a zero-trust security program. If employees use weak or repeated passwords for corporate applications, an attacker may be able to gain access to these accounts and use them to remotely access company data, systems, or applications.
Multi-factor authentication (MFA) reduces the risk of these account takeover attacks. By requiring a second factor to authenticate, MFA makes increases the difficulty for attackers looking to use compromised user credentials.
Create and Implement BYOD Policies
A bring-your-own-device (BYOD) program can provide significant benefits to an organization and its employees, especially for remote and hybrid workers. For example, the company no longer needs to supply an employee with devices, and employees can work from their preferred systems.
However, BYOD can also introduce security risks due to the potential for compromised or insecure personal devices. Companies with a BYOD program should implement a security policy for remote workers that lays out requirements and restrictions for the use of personal devices for business.
Upgrade Password Safety
Password security is a common problem for businesses. If employees have weak or reused passwords, companies run the risk that an attacker will guess those passwords or that they will be exposed via phishing or an unrelated data breach.
Creating a password policy is not enough. Ensuring account security requires enforcing password strength and uniqueness requirements and implementing MFA to bolster password security.
Train Your Employees and Partners
Many of the biggest security threats that companies face are caused by
third-party partners or employees ignoring potential risks. For example, phishing is designed to trick users into performing some action, and many insider threats involve an inadvertent disclosure of sensitive information.
Companies can manage these security risks by providing their employees with cybersecurity awareness training. For example, education on common phishing tactics and best practices for secure remote work can help them to avoid common mistakes.
Remote Work Security Best Practices for Employees
Remote and hybrid workers can also take steps to manage their security risks, including implementing the following security best practices for remote workers.
- Update Software Regularly
One of the most common tactics that cybercriminals use to gain access to a device is exploiting vulnerabilities where the user hasn’t applied a security update. Often, these updates are publicly available, but the targets of these attacks have not yet installed them on their devices.
- Install updates as soon as they become available
By doing so, you reduce the window during which an attacker can exploit a vulnerability and gain access to your device.
- Learn about Phishing
Phishing is a common cyberattack technique because it is low-cost, easy to perform, and highly effective. A successful phishing attack can plant malware on the recipient’s device, gain access to their accounts, or potentially steal money or sensitive data from the organization.
Phishers are constantly refining their tactics to maximize the probability of their target clicking on a link or opening a malicious attachment. Learn about phishing and keep up-to-date on the latest threats to maximize your chances of detecting a phishing attack before it’s too late.
- Create Strong Passwords
The average person has dozens of online accounts, and each one should have a
long, unique, and random password. These can be difficult to remember, so it’s not uncommon for people to use weaker, more memorable passwords and repeat them across multiple accounts.
However, weak and reused passwords make it easier for an attacker to gain access to your online accounts. To help keep passwords strong and secure, use a password manager, and bolster your account security by enabling multi-factor authentication (MFA) wherever it is available.
- Physically Guard Your Computer and Workspace
If an attacker can gain physical access to your computer and other devices, they have a much better chance of stealing sensitive data from them. With physical access, they may be able to guess your password or read unencrypted data off the computer’s memory. When working remotely, take care to maintain physical control of your computer and other devices. This includes not leaving computers unattended (when going out for a break, for instance) and ensuring that sensitive devices and materials are securely stored when not in use.
- Exercise Caution when Joining Wireless Networks
If you’re connected to a wireless network, the owner of the network and anyone with the password can see your traffic. While the important data may be encrypted using TLS, analyzing the unencrypted bits can provide hints about what you do online. Public wireless networks are a major security risk. When using public Wi-Fi, connect via a VPN to ensure that your traffic is encrypted and can’t be spied on by everyone else connected to that network.
Additional Remote Work Security Best Practices
Some further best practices that both employers and employees should consider include the following.
- Encrypt data
Encryption is one of the most effective ways to protect data against unauthorized access and potential breaches. If data is encrypted, it is impossible for an attacker to read it without the decryption key. Always use SSL/TLS to encrypt data in transit and use a full-disk encryption (FDE) solution to encrypt data stored on a remote worker’s device.
- Never Use Unfamiliar Thumb Drives
USB drives have the ability to automatically run programs when plugged in, and enticingly-named files on a “lost” USB drive are usually malware. If you find an unfamiliar thumb drive, turn it in to IT to be handled safely and appropriately.
- Use USB Data Blockers When Charging from a USB Port
USB cords typically have two leads, one for charging and one for data transfer. When charging a phone, only the power one should be in use, but malicious USB charging stations can be configured to attempt to steal data from devices connected to them. When charging from an untrusted USB port, use a USB data blocker to ensure that the data transfer leads are not connected.
- Use Transparent Data Encryption
Transparent data encryption (TDE) is an encryption solution designed to protect the data stored in corporate databases. TDE encrypts data at rest — protecting it against compromise if a device is lost or stolen — and encrypts the data when responding to queries from authorized users and applications.
- Use Asset Management Tools
Remote work increases the risk that devices containing corporate data and software may be lost, misplaced, or stolen. If an organization lacks full visibility into its assets, these incidents may go unnoticed. If this is the case, the thief may have the opportunity to extract sensitive corporate data from the device before the organization knows to wipe it.
- Upgrade Endpoint Security
Remote workers’ endpoints are uniquely exposed to malware because they often lack the same defenses as on-prem devices. Cybercriminals know this and are increasingly targeting these devices to use as a stepping stone for remote access to corporate systems. To protect against these threats, companies should deploy advanced endpoint security solutions, such as Endpoint Detection and Response (EDR), Endpoint Protection Platforms (EPP), and Extended Detection and Response (XDR).
- Vendor Screening
Supply chain attacks have emerged as a growing concern in recent years. Cybercriminals that compromise one organization’s systems may be able to leverage this access to target their customers, vendors, suppliers, and partners as well. When considering and onboarding vendors and other trusted third parties, evaluate their security posture and integrate the potential threats they bring into your organization’s risk assessment.
- Prepare a Security Response Plan
Often, incident response plans are designed for on-prem security incidents. However, remote work creates unique security challenges, such as the fact that incident response may need to be performed remotely. Develop or update your organization’s incident response plan to cover security incidents involving remote and hybrid workers as well.
- Focus on Data-Centric Security
An organization’s data is often its most valuable asset, and remote work can place this asset at risk as it moves outside of an organization’s protected network. When designing a security program for remote work, take a data-centric focus to ensure that an organization has the visibility and control that it requires to adequately protect its data that is accessed, processed, and stored by remote workers.
- Shield Webcams
If an attacker has access to a remote worker’s computer, they may be able to activate the webcam to record images or video. In addition to compromising the user’s privacy, this may reveal sensitive information in view of the webcam. As a result, webcams should be blocked by a physical cover when not in use.
- Separate Work and Leisure Devices
Remote work and BYOD programs often involve dual-use devices used for both personal and professional activities. However, this can create security risks for the business if unsafe personal use of a device introduces malware or other threats that could compromise the security of business data on that device. Work and leisure devices should be kept separate to minimize the security risks of crossover between the two.
- Enable Remote Wiping of Compromised Devices
Remote work increases the risk of lost and stolen devices, especially if an employee carries a device with them to the office, public workspaces, or on travel. If these devices are lost or stolen, then data stored on them or accounts accessible from them may be at risk. Enabling remote wipes allows an organization to clear sensitive data from a device before it can be exposed.
Remote Work Security with Venn
Overcoming the security risks of remote work requires a mature remote work security program. In addition to identifying the potential risks that it faces, an organization also needs to identify, select, and deploy solutions designed to manage these risks. For example, a remote workforce security program may include endpoint security solutions on remote devices, Secure Access Service Edge (SASE) for network security, and a secure browsing and internet access solution to protect employees against malicious websites and the potential for data loss or malware infections.
Venn offers all of these capabilities and more in its Secure Remote Workspace Solution. To learn more about securing your remote workforce without sacrificing performance or productivity, check out Venn Software today.
