For millions of employees, remote working is here to stay. The COVID-19 pandemic forced a seismic shift in working habits, showing businesses and their workers to be highly adaptable to the changing winds. With the pandemic over, many businesses have kept a remote working modal, whether it be in full or in part.
The increased flexibility has proven popular. And as the new world of remote work continues to expand, many businesses are wondering how they can best secure their employees while they’re out of the office. Businesses that have continued remote working in one form or another are rightly concerned that with this newfound flexibility come new risks. And, more importantly, how businesses can better secure their remote workforce.
More and more data is being churned out that indicates cyber threats on remote working are increasing. We saw back in 2019 how cyber criminals were taking advantage of the millions who, mostly unprepared, were forced to begin working from home for months on end. And this trend is continuing.
Phishing, malware and other threats are being targeted toward remote workers, their devices and networks. Many of which aren’t aware of, or prepared for, such targeted attacks. These threats can be devastating. Unsecure remote workers who are targeted and infiltrated can cause irreparable reputational damage and massive financial loss.
But organisations can bolster the defences of their remote workforce by developing new policies and processes, updating device and network security and implementing or improving staff training and cybersecurity awareness.
Why is it important for businesses to secure their remote workforce?
Remote working, whether in full or as a hybrid model, means more personal devices connected to businesses through a variety of different networks. By definition, remote working means connecting to business resources, such as shared applications like those in the cloud, email and confidential files and folders. While employers can provide work computers to their staff, they often won’t or can’t afford to. This means that personal devices are used on off-site networks, and employees will often connect to other devices such as smartphones to use for work email on the go, for example.
All in all, the increasing amount of work devices on home networks, which may be insecure, means an increased chance for cybercriminals to find a fatal flaw that could lead to an attack on the business — and it only takes entry through one device to do business-wide damage.
The key threats and their consequences.
A joint advisory was published by the US Department of Homeland Security Cybersecurity and Infrastructure Security Agency (CISA) and the UK National Cyber Security Centre (NCSC) which stated that one of the main threats to organisations and their remote workforce is attacks against new and rapidly-deployed remote access infrastructures. And back in 2020, during the height of remote working, exposed remote desktop protocols spiked, increasing up to 127%.
Attacks which take advantage of remote workers using these techniques could result in large-scale theft of customer information, intellectual property and complete business outages. Once security is breached, it can be difficult and expensive to get back up and running. And, according to Verizon’s 2020 Mobile Security Index Report, in more than half the cases of remote working security breaches (55%) through mobile devices, the companies suffered lasting consequences.
The financial and reputational damage can be severe. Direct money loss through being held to ransom during a ransomware attack is just one common form. But the long-term costs can be even worse.
The loss of productivity because of the downtime during an attack. The loss of reputation and trust in the business from its clients and customers. The cost of getting the business back up and running (especially if backups haven’t been made). And the consequences of a cyberattack can be especially harsh on small to medium-sized businesses (SMBs), which often don’t have the resources implemented to quickly and efficiently get them back up and running at full scale.
What are the best practices to secure a remote workforce?
The importance of securing the increasing number of remote workforces of businesses around the world is paramount for any business of any size. And the best practices for securing a remote workforce begin with some sound foundational principles.
1. Training and awareness.
Human error is the cause of a staggering 95% of successful cyberattacks. And the percentage has always been extortionate. Training and awareness of employees is a crucial aspect that should be one of the priorities of any enterprise that wants to secure its employees working remotely.
The purpose of staff training and increasing awareness is to focus employees’ attention on security, vulnerabilities and the need to protect data and information, how to spot and avoid potential threats and the necessity of reporting potential cyber threats properly.
Key elements such as recognising and defending themselves against phishing attacks, using strong passwords, securing their devices and reporting incidents are critical elements to staff training and increasing awareness.
2. Securing mobile devices.
Remote working means more use of mobile devices. Bulletproofing an organisation against cyber threats means securing its remote workforce by mitigating risks associated with mobile devices.
According to the Mobile Security Index Report, 39% of organisations suffered a security compromise through a mobile device in 2020. That’s up from 27% in 2017, reflecting the rise in mobile use and how and where cybercriminals are increasingly aiming their attacks.
Businesses can help secure their remote workers and their mobile devices by:
- Installing mobile threat detection: Whether a device is owned by the business or the employee, a high-quality threat detection app should be installed that offers full malware detection.
- Establishing bring-your-own-device policies: Decide whether employee-owned mobile devices can access corporate networks and data. If they can, ensure that devices are covered by corporate policies and protected accordingly.
- Application control: Applications make up a large percentage of security compromises through mobile devices. Setting up app controls like whitelists can help to minimise cyber threats.
3. Secure network infrastructure.
Organisations need to consider the networks connecting their remote employees to the corporate network and its cloud resources. After all, this is where confidential and important business data and information is being stored and transferred. These communication channels link computers and mobile devices through employees’ internet connections to business applications needed for remote working. They need to be fast, secure and easy to manage.
Two strong options businesses have to improve network security for remote workers are VPN and SD-WAN.
A VPN (virtual private network) offers a secure, encrypted link between the remote workers’ computer or mobile device and the internal corporate network and its cloud resources. It prevents attackers from eavesdropping on communications or stealing sensitive data. A VPN is especially good for mobile devices as they mitigate the risk of man-in-the-middle attacks that use public WI-FI. A good VPN can be easily configured, provides flexibility in connectivity options and offers scalability through dynamic mobile network routing.
An SD-WAN (software-defined wide-area network), on the other hand, offers businesses an alternative to multiprotocol label switching networks. These are software-defined, which means they can be easily managed centrally. Traffic can be routed to optimise bandwidth. And security-enhancing features such as firewalls, threat detection and encryption can be implemented. An SD-WAN provides simple, efficient security at a low cost for businesses and their remote workers.
As remote working continues to be implemented, it’s evermore important that organisations learn how to secure their remote workforce. Get more information on securing a remote workforce and business vitals by viewing the services and solutions we offer mentioned here or talk to our specialists for expert help and support today.
Get full security for remote working.
References.
- https://www.ncsc.gov.uk/404
- https://reposify.com/blog/127-increase-in-exposed-rdps-due-to-surge-in-remote-work/
- https://www.verizon.com/business/resources/reports/2020-msi-report.pdf
- https://resources.infosecinstitute.com/topic/four-examples-of-human-error-in-cybersecurity-and-how-to-fix-them/
- https://www.verizon.com/business/resources/whitepapers/2020/securing-remote-workforce-against-cyber-threats.pdf?_gl=1*x36mow*_ga*MTI5Nzc2NjY5NC4xNjYzNzU5MTA1*_ga_12R1DX1LX7*MTY2NDgwMzg3NC42LjEuMTY2NDgwMzk4OS4wLjAuMA..&_ga=2.37063335.668803308.1664803875-1297766694.1663759105&_gac=1.55965017.1664803875.Cj0KCQjwkOqZBhDNARIsAACsbfLfThCuH-P4e0ZBqxSUsc5xxMvFOV-7xkesuViJS8hPQWa6B4kHiPUaAhwvEALw_wcB
