How secure are your remoteworkers?

Now that we have a light and the end of the tunnel – which hopefully is not just an oncoming train – many companies have started to look at the future of how staff work past the end of lockdown. After all, for big and small businesses there is a massive cost saving in not having to pay out rent each month and that is before you start looking at other services and utilities.

Many of the companies I am speaking to have started to look at keeping staff working remotely. But with this comes the need for changes in the way companies handle their data and systems. But with the thought of working from home other factors now must be taken into consideration. In this article we will look at some of the fundamental things that need to be taken into consideration to ensure that your company and client’s data is secure.

Secure your home office

Physical security should not be forgotten when working from home. Just as you lock your office at the end of the day, do the same when working from home.

Laptops & tablets can be stolen from your home. If you chose to work from the garden on a summers day take your laptop inside when you go for lunch, make sure that the room that you work from is covered by any home security system you may have installed and most importantly lock the door to your home office. In a nutshell keep your home workspace as secure as you keep your office.

Secure your home router

Cybercriminals will look to exploit default passwords on home routers because most people do not bother to change it, leaving their home network vulnerable. This is just as valid for routers supplied by your ISP as it is for routers you have purchased.

Changing your router’s password from the default to something unique is a simple step you can take to protect your home network from cybercriminals who want access to your network and devices.

You should also ensure firmware/ software updates are installed as soon as possible so known vulnerabilities are not exploitable. Some routers will do this automatically while you sleep, but others will need you either confirm the upgrade or find the upgrade and install it manually.

Separate work and personal devices

It might be easier said than done, but it is important to keep the two apart on the network. Cybercriminals will look for the easiest attack method to gain access to your data. So, while you might have all the security on your work devices, if your home device is neglected then it becomes the weakest link in the chain and the easiest attack method. It can take no time at all for a cybercriminal to install some network monitoring software on an unprotected device and monitor what traffic is being passed around your home network. This would also give them easy access to the hardware of the unprotected devices in your home. Generally, all laptops now have a webcam and microphone built into them. Who knows how could be watching or listening to you working?

Encrypt your devices

Most modern operating systems now have a method of encrypting your hard drive built-in. While it will not stop a cybercriminal from gaining access to your device it will stop stolen devices having their hard drive pulled for the data on them.

Use a supported operating system

New vulnerabilities and exploits are found daily, and they can often impact old versions of operating systems that are no longer supported by their developers. Unsupported versions no longer receive security patches to vulnerabilities putting your device and sensitive data at risk.

In short, always use a supported operated system, and if your device allows it, the latest version then itis time to look at updating your hardware. Currently, the oldest version of Windows that is still receiving security updates and bug fixes windows 8/8.1. But from January 2023this will stop, and only recent versions of Windows 10 will receive updates.

Keep your operating system up to date

Even if you are using a supported operating system, there can be significant delays between the disclosure of a vulnerability and its fix. Even if the window is open for only a few days, zero-day exploits still represent significant risk to your business. Just look at how WannaCry’s EternalBlue exploit resulted in hundreds of thousands of infections in less than a day. To minimize this risk, ensure all devices apply security patches as soon as possible, ideally via automatic updates. Most modern devices will automatically apply updates by default often at night while the device is not in use or as part of the shutdown procedure.

Keep your software up to date

Operating systems are not the only thing that can be exploited. Any software can, web browsers as an example are a common target for cybercriminals. For the same reasons outlined above, it is important to keep all installed applications up to date.

Most modern software will check and apply security patches automatically. For everything else, check for the latest versions manually.

Enable automatic locking

If you walk away from your device at your home office, shared workspace, or a coffee shop, you should lock it. The issue is people forget. When we do, automatic locking is there to protect our unattended devices. But make sure to configure a period that is both convenient but not unreasonably long, such as 60 seconds for mobile devices and five minutes for laptops or desktop.

Use a strong PIN/ password on your device

But automatic locking does not matter if you do not use a strong password or PIN. Avoid anything that is easy to guess, such as repeating numbers, sequences, or common passwords. A list of the common passwords can easily be found online with a quick Google and a quick look at the screen of any smartphone or tablet will likely give you a good idea of the digits that are in the PIN code.

Use an antivirus / internet security

Security software can help protect your computer from viruses, spyware, ransomware, rootkits, trojans, and many other types of malware. Security software, as the name indicates, is a program that works to protect your device. It detects or recognizes the virus & malware, and then after detecting the presence of an infection, it works on removing it from the computer system.

Enable find my device and remote wipe

Being able to find and ideally remote your device is a crucial part of ensuring information security when a device is lost or stolen. Securely wiping a device makes it much harder to access your data, no matter how much time or determination an attacker has. Most modern operating system on computers and smart devices will have a way of enabling this.

Ensuring that many or all of the above areas are covered within your business will go a long way to making your business as secure as possible when it comes to working remotely, regardless of whether it is at home, in a shared workspace or at a local café/pub.

Chris Lambert

Datasense Consulting

Chris has been involved with IT Support since he used his first computer back in the 80s. He’s worked within IT Support for blue-chip delivery companies ensuring their systems and machinery keep the business running. He’s also worked alongside the Technical teams at Barclays Bank, Lloyds and TSB. With the links he’s made from business networking, he’s able to provide a wide range of services from basic IT support to Cyber Security testing and accreditation.

07932 535271

chris.lambert@datasense.ltd

datasense.ltd