Remote working has long been recognised by forward-looking businesses as a practice that enhances agility and productivity, while giving staff the flexibility they demand from a modern employer. We’ve suddenly been presented with an enormous challenge, however: how to enable all of our employees to work from home, both productively and securely. People still need fast and easy access to business information and applications, but we need to be absolutely certain that all data and systems remain protected from cyber breaches.
Cyber-attackers are on the prowl – ready to jump on any gaps in cybersecurity strategies, or to take advantage of distracted workers. According to security researcher KnowBe4, phishing email attacks related to COVID-19 increased by 600% in the first quarter of this year. Meanwhile, GDPR hasn’t gone anywhere, and businesses still face fines and reputation damage if they fail to comply.
The risks are real: in a 2019 survey of IT decision makers carried out by Apricorn, one third said their organisation had already suffered a data breach as a result of employees remote working.
Fortunately, the process for identifying potential vulnerabilities around remote working, and addressing them with good cybersecurity practice, is pretty straightforward. It embraces three key areas: policy, technology and people.
Policy: find and fix the chinks in your armour
Chances are that until very recently your cybersecurity strategy was fit for purpose, but ‘business as usual’ has gone out of the window. It’s important to review all of your security policies, as well as the different controls that are in place, checking for any weaknesses.
Update corporate policies that cover mobile and remote working, creating new ones where necessary. These should clearly describe how employees are expected to behave when working at home, and the procedures they should follow.
Cross-check your security controls against relevant legislation and standards to see if you’re still compliant. IT teams also need to be absolutely on top of updating software and patching any known vulnerabilities. Introducing access controls can provide a safety net in case employees make mistakes. In line with the principles of ‘least privilege’, this involves allowing each employee to access only the systems and databases – on-premise and in the cloud – they need to do their job.
Technology: the tools for the job
It’s likely that your employees will need to use a mix of business and personal devices to access data and applications efficiently when they’re working from home. Policies should therefore cover the devices that are allowed – including removable media such as USBs and hard drives – and set out exactly how they must be used.
The risk of human error leading to data being inadvertently exposed can be mitigated by encryption, a process that transforms information so that it’s unreadable by anyone who isn’t authorised to access it. Encryption is specifically recommended in Article 32 of GDPR as a means to protect personal data. One way of guaranteeing that remote employees work in the safest way possible is to provide them with highly secure USB sticks that automatically hardware encrypt all data written to them.
People: build a team of responsible information owners
You’ll need to communicate all remote working policies and procedures to every single employee, as well as any contractors or freelancers you use. It’s a good idea to do this ‘in person’, via email or video, giving people the opportunity to ask questions. They’ll also need to be properly trained in the safe and responsible use of the approved technologies and tools.
Getting buy-in from employees is essential. Aim to educate people in what they must do differently, but also why. Detail the specific risks facing the businesses and the potential consequences of a data breach.
More than ever before, protecting a business’s data from loss or theft is everyone’s responsibility. Organisations must move quickly to protect themselves against data breaches, and create a culture of secure remote working. They should also have one eye on the longer-term, because this is likely to herald the start of a large and permanent move to increased home-working for many. There’s an urgency not just to address what’s happening now, but to prepare the ground for a sustained shift to a new – and potentially more effective – way of working.
By Jon Fielding, managing director EMEA, Apricorn