Managing Good Cyber Security When Working From Home

Many organisations embrace the flexibility of home working, with UK employees now averaging 1.8 days a week of remote working, above the international average of 1.3 days, according to the Global Survey of Working Arrangements (G-SWA).

“This isn’t just a post-pandemic hangover – British workers have clearly decided they’re not going back to the old ways. Remote work has moved from being an emergency response to becoming a defining feature of the UK labour market,” Dr Cevat Giray Aksoy, a G-SWA co-founder and associate professor at King’s College London told the Guardian, who reported on the survey.

For very valid reasons, remote and hybrid home working is here to stay. Which means, as an employer, you need to manage the potential risks to cyber security on an on-going basis. The following tips are intended to help you put together a robust level of cyber security for your home-based employees.

The biggest threat to information security is lack of awareness of where the risks lie, which is how many mistakes are made. It’s worth emphasising that people generally ‘don’t know what they don’t know’. In other words, employees may have varying experience with working from home, particularly when it comes to awareness of the security issues.

As such, clear guidance on what employees need to know is valuable. It will help reduce their levels of stress and it will support your IT team. Remember, there’s no colleagues at home to ask and there is a danger of people doing their own thing.

Many workers are used to online training, so you might want to include the Top Tips for Staff e-learning package from the National Cyber Security Centre (NCSC). It takes 30 minutes and the training introduces why cyber security is important and how attacks happen, with guidance on using passwords and securing devices amongst other relevant topics.

Topics for guidance:

‘How to’ guides are helpful – you should make sure your policy and processes on the following are clearly laid out and accessible:

• How to use your Virtual Private Network (VPNs).
• How to protect your home Wi-Fi.
• The software you use and how to keep it up to date – antivirus, security updates etc.
• Bring Your Own Device (BYOD) guidance – if you are allowing your employees to use their own devices for work.
• Cyber safe use of collaboration tools.

Incident management procedure – what to do in cases of compromise or loss of equipment.

As valuable as guidance is, there is a danger in assuming it will be read. This is why the role of line managers is key, as they can be tasked with reminding employees about cyber security. These conversations should be included in check-ins with their teams and in the induction process for new recruits, many of who may be starting with the organisation working from home.

Cyber security has always been everyone’s responsibility – and non-office-based working only makes it more so. The line manager has a critical role, acting as the glue between the employee and the organisation. They will often be the person who team members turn to for clarity.

Mistakes happen, and devices can be easily lost or stolen away from the office or home. In case this happens, simple security measures can go a long way to prevent data loss. Make sure all devices are setup to require passcodes and encrypt data while at rest. Most devices now have encryption built in, but it may still need to be turned on and configured.

As an employer, you might consider mobile device management software to enable you to remotely lock access to stolen mobile devices, and erase or retrieve data stored on it.

Should your staff encounter a problem they feel could compromise cyber security, they should be aware of the process for reporting it. The emphasis here should be on speed of response and that it’s better to raise a concern, no matter how seemingly insignificant, than risk potential damage.

Your incident management plans should be sufficiently flexible to deal with the range of security incidents that could occur, including the loss or compromise of a device. As mentioned above, mobile device management should enable the remote disablement of stolen devices.

Popular collaboration tools such as Slack, Microsoft Teams, Zoom and Google Docs present a convenient way to stay in touch, maintain team motivation and engagement – but they are not without their security risks. If an account is compromised, a bad actor can pose as a trusted employee to share malicious docs or, within file-sharing apps such as G-suite or Sharepoint, gain access to sensitive data.

While it’s impossible to prevent a business from compromise via a collaboration tool, there are measures that help more secure collaboration. For example, using two-factor authentication wherever possible to avoid unauthorised access and restricting permissions only to those necessary. User-awareness training should be included too.

Shadow IT is where employees download their own apps and software instead of the recommended company applications and collaboration tools. It’s nothing new – but home working means more of it is almost certainly going on in your organisation. Do your employees communicate via WhatsApp without official approval? That’s shadow IT. Often done with the best of intentions, it opens up additional vulnerabilities.

The best way to manage Shadow IT is to acknowledge that it’s happening. By understanding what your users are trying to achieve with their Shadow IT solutions, you’ll be better able to serve their needs and manage the security issues.

Traditionally, boundaries applied to actual premises. Network security focused on physical hardware with security policies based on internal working and the management of firewalls were usually down to the IT dept. On-premises, firewalls would secure every device connected to your network, whether that be at an HQ or a network of offices. The growth in remote working has seen cloud based firewalls increase in usage, offering remote access to networks while maintaining secure connections.

If you are using a cloud-based firewall, you can take a few additional measures to ensure it provides robust connectivity and a secure environment for remote based employees. Deploying a next generation firewall, known as a Firewall-as-a-Service (FWaaS), provides a simple and flexible architecture to provide connectivity to all employees, no matter where they are working.

You can also set up fast, secure and fully managed VPN connectivity and increasing security measures such as multi-factor authentication at login to add an additional layer of security. Cloud service providers, such as Amazon Web Services, Microsoft Azure, or Google Cloud, give businesses the ability to provide consistent, secure connectivity to employees working from anywhere.

Attempted phishing attacks happen when scammers use email or text messages to trick employees into giving them personal information. It often works by sending a message that appears to be from a well-known source (i.e. a colleague, manager or client), looks legitimate and may claim to be urgent.

Home-based workers are even more vulnerable to phishing because they are dispersed and it’s harder to check the validity of messages with others. That’s why employers managing a remote workforce should include awareness of the threats from phishing and how to focus on identifying, combating, and responding to an attack when working from home.

Working from home carries increased risks but it doesn’t have to be open season for cyber criminals. Many of the aspects of good remote or home-based cyber security are the same as they would be if office-based. Good cyber security practices are fairly universal. The threats increase at home when there’s a lack of available information and guidance, which is why consistent and clear communication is so important.

Don’t assume that the message has got through because you’ve created a policy or guide – your line managers need to emphasise good home-based cyber security along with other communications.