Remote Workers – Implementing a Risk Based Cyber Security Plan

The COVID-19 era has succeeded in making remote work mainstream, mainly because of quarantine and social distancing policies. While some companies and employees have been able to make the change quite easily, remote work is not without its complications and risk.

Many corporate networks are protected by layers of security. However, with most companies having recently made the sudden shift to remote work, cyber criminals have turned their attention to where the employees are – the vulnerable home office.

It is, therefore, critical for companies to implement risk-based cybersecurity measures to ensure their employees are able to work without the threat of cyber breaches.

Below are some steps you can implement to protect your business and employees from cyber threats:

‍

1. Employing cloud-based solutions

Cloud-based cyber security solutions protect not only data in the cloud but also the devices being used and the identities of users.

With cloud storage, your employees can access files from anywhere with an internet connection. However, to ensure important files are not vulnerable to attacks, you need to choose a reliable service provider that has the security infrastructure to keep your information secure.

‍

2. Tying VPN to Active Directory and enabling multifactor authentication

Businesses can bolster security by tying VPN to Active Directory and enabling multifactor authentication to ensure only authorized people can access their networks, data, and apps. Businesses must instruct their employees to use VPN with public Wi-Fi.

They should also remind employees about opening suspicious emails, downloading files, and clicking links from unverified sources. Passwords need to be changed periodically, and multifactor authentication must become the norm.

‍

3. Testing and bolstering a virtual desktop environment

Testing your virtual desktop infrastructure (VDI) is crucial prior to full implementation because a poorly built one can wreak havoc on business continuity. It can lead to performance issues and slowdowns and cybersecurity challenges. Through testing, IT personnel can find that sweet spot where user experience is enhanced without sacrificing cybersecurity.

‍

4. Applying strict security protocols

There are measures your IT and network security team can implement to secure your company and its data assets:

• Have a plan in place for employees working from home to carry all business security protocols and policies over to their home workspace.
• Implement an agile mobile security platform with data-centric security that employees can install on any device they use.
• Instruct employees to increase home router security by changing their default password.
• Educate teams on spotting signs of fake requests and verifying all requests, whether through phone calls or video calls.
• Invest in a disaster recovery or emergency backup plan.

5. Process redesign and risk assessment

Work on identifying critical business functions that are not compatible with offsite work. These need to undergo a fast process redesign and risk assessment for your IT and network security team to put together a short-term action plan, while also coming up with a long-term control framework that’s also sustainable.

‍

6. Assessing the company’s threat model network

Whether it’s the nature of remote work or WFH factors such as VPN use, your IT and network security team should treat everyone and everything as a possible weak link. By studying all elements, traffic, and users, they can work on improving security and countermeasures.

‍

7. Establishing a culture of security training

Employee negligence has been found to be the biggest threat to cybersecurity – and one that you can manage. Employee negligence happens when a worker fails to perform their responsibility (or “duty of care” in legal terms) at work that causes harm to their employer or customers. Common examples of negligence related to cybersecurity include leaving a work computer unattended or unlocked and using an unsecured Wi-Fi connection to do one’s work.

To counter this, work on establishing a culture of security by training your employees on cybersecurity measures, such as protecting their mobile devices, using firewalls and antivirus software, and maintaining computer cyber hygiene.

They should also learn to spot signs of compromised security, such as computer slowdowns, unknown pop-ups on-screen, unauthorized program installations, and loss of mouse or keyboard control. You should also have an emergency plan in place so anyone who encounters malicious attacks online knows exactly what to do.

‍