By now any issues with equipment, location, connectivity and, dare I say motivation, should have been resolved, but is your remote workforce also fully compliant and secure? For some, working from home is simply business as usual, but for most people it is a completely new routine.
Below is some guidance on the solutions and processes you might want to consider implementing to help bolster your security, based on our own practices and experience in remote working:
- Ensure all laptops staff are using are encrypted and require a password to boot up. Use tried and tested products to ensure your data is encrypted as the last line of defence in case your device is compromised. If employees have this facility on removeable media they should use the company’s stated tools. In addition, good password protection can also be enabled at the BIOS level when booting, as another recommended layer of security.
- Ensure password, pin or fingerprint recognition is enabled for all of your corporate mobile devices. Windows or mobile devices should by default have password/pin enabled. With passwords it is worth considering a “pass phrase” including a few word breaks and special characters as this will be much more robust.
- Use two-factor authentication to improve security. Multi-factor authentication adds yet another layer of security and solutions that integrate with a mobile device make it easy to use and to connect and track who is logging in.
- Implement device management to allow tracking, remote wipe or lock, in case of theft or loss. On top of reviewing your remote management tools to ensure you can effectively support your workforce from home you should also consider additional tools for preventative measures.
- Use encrypted connections to prevent data leakage over unsecured networks. Most remote/home users have broadband/mobile connectivity and VPNs must be implemented if they are not already.
- Restrict access to removable media such as SD cards or USB sticks. This common oversight allows remote workers on company-issued laptops the ability to connect anything from their USB ports so the facility to lock them down is highly recommended. If you operate a ‘bring your own device’ policy this might be more challenging. For sensitive applications, a virtual desktop solution and making all apps browser SaaS based, should be considered.
- Keep antivirus services, software and firmware up to date. Patch management is crucial to ensure there are no compromises to the applications, operating systems and other services the device is consuming.
- Provide users with the right security education. Typically, 80% of all breaches are user related. People are the weakest link so training your workforce to be more vigilant is highly recommended.
- Implement solutions such as monitoring software for data leak prevention. An example of this would be SQL injection, typically where the database is compromised and might not be patched, or has had its access rights breached.
- Control access to the network by using a combination of multifactor authentication and creating a range of user default profiles in active directory to control and limit what specific users have access to.
- Consider Thin Client VDI services for specific or complete application/desktop services. As previously suggested, moving both the application and, more importantly, data back to a hosted/cloud environment mitigates the possibility of a compromise. The corporate environment should be much more secure and procedural than a home/remote working environment.
- Review your monitoring policy. If your users at work typically operate in normal office hours at home they may be tempted to work outside this norm. The challenge here is how to support, monitor, control and alert as required. This is where you may need to introduce an additional support/monitoring regime, or simply talk to a partner like Pulsant to assist in out-of-hours working.
- Consider physical/logical testing such as penetration, social and phishing. Testing the resilience of your defences now that employees are remote working might be worth considering and many organisations already conduct periodic penetration testing.
- Ensure legal and industry compliance to standards and regulation such as PCI, GDPR and ISO. If your employees are dealing with sensitive data, it is worth revisiting the clauses of your policies to ensure you are compliant. More importantly this also applies to cyber security policies such as IASME and ISO27001.
- Make sure returning devices are safe to use back at work after the lockdown ends. For users who have had long periods away from the office, it might be worth introducing a quarantined network to screen the device when it is returned to the business.
Following and implementing the above processes or solutions can help improve your security posture in a remote working environment.
If you would like more information on how to support and protect your organisation for a more sustained period of remote working get in touch with one our consultants here.