A vigilant remote work policy is the only way to safeguard your at-home employees from cybersecurity threats. While we’ve learned the value of remote and hybrid work over the past few years, we’ve also identified the pain points. Outside the office, your employees, their data, and your business information are at significant risk to hackers and scammers.
But there are too many benefits to work-from-home to let scammers scare you away. Instead, educate employees on what to look for and how to safeguard their at-home Wi-Fi connections. Let’s explore seven actionable tips you can leverage to set an airtight remote work policy.
1. Avoid Public Wi-Fi—Or Use a VPN
Using public Wi-Fi is one of the worst things your remote employees can do regarding cybersecurity.
Public Wi-Fi depends on encryption-free networks, meaning hackers can freely monitor file-sharing traffic between users and public servers. Unsophisticated hackers can inject malware into someone’s device after tracking it through a public network.
If your remote teams cannot avoid public Wi-Fi, ensure they use Virtual Public Networks (VPNs) to keep them safe. VPNs act as firewalls and are among the most widely-used cybersecurity tools on the market. They protect your remote employees’ laptop data while retaining the same functionality, security, and appearance as their company network.
VPNs have revolutionized how we protect ourselves online. They create encrypted data tunnels and protect your online identity by masking your IP address. That’s why remote employees should use a company-sponsored VPN to leverage public Wi-Fi spots safely.
Your employees can easily turn their VPNs on and off, as your remote work policy may require them to log out when using their computers for personal reasons after hours or over the weekend.
Because they log in with a username and password, you must use the most robust authentication methods available. We’ll touch on two/multi-factor authentication later—but basic practices surrounding solid passwords should be enough to keep them safe.
2. Keep Work Data on Work Computers Only
The work-from-home age has blurred the line between work-related and personal use regarding how employees use their work computers. While they have work-related projects open in one window, they might have Facebook or their emails open in another. It may seem harmless—but using work computers and phones for personal reasons can open new doors for hackers and scammers.
You might be sitting there saying, “my employees wouldn’t do that.” But according to a 2020 survey by Malwarebytes, an antivirus company, more than half (53%) of surveyed employees said they sent or received personal emails on their work computers. Moreover, 38% shopped online and 22% downloaded/installed non-company software, like games or other apps.
You can trust your employees to keep themselves safe online—but can you trust their spouses? What about their kids? Company computers are easily exposed to an employee’s family when working from home. While their nine-year-old son isn’t trying to steal your data, they may accidentally click on a malicious link or open a phishing email.
Ensure your team members keep their work computers password protected and away from young children. Your remote work policy should outline what employees can and cannot do on their work computers. Keeping work and personal tech separate is one of the easiest ways to protect personal and company data against cyberattacks.
3. Use Secure Collaboration Apps
The global shift to remote work forced many companies to invest in digital collaboration technologies to keep their teams together.
Some of these widely used tools weren’t designed for large-scale enterprise use. According to Oliver Tavoki, CTO at Vectra, a cybersecurity company, security teams may not understand the threat level presented by these collaboration tools.
He says that “these tools are also relatively immature regarding the accompanying security protections provided by third parties.” Until suppliers can implement more policy control, Tavoki anticipates this trend to continue.
When investing in remote work collaboration software, consider these key cybersecurity features:
- Password protection and access control: A robust collaboration tool will only allow users with specific permissions to access and edit sensitive documents. Some allow you to assign roles—writers, readers, and editors—so if changes are made, you know where they came from. For added security, you can lock sensitive files behind passwords.
- Secure data centers: You trust a third-party company with your data whenever you use a collaboration app. Assuming you can’t develop your software, you’ll have to trust that their data centers are safe and secure. Any reputable company will make this information readily available on their website.
- High-level encryption: Encryption is an added layer of protection your collaboration software company can provide. Even though the information is safe in their data centers, they'll take the extra step by encrypting your information in case someone breaches the system.
4. Implement a Zero-Trust Policy
In the ideal world, you can sit back and relax, knowing that anyone trying to access your company network is doing so with good intentions. Unfortunately, we don’t live in an ideal world. Malicious actors are making daily attempts to access your secured networks through malware, hacks, or phishing scams.
To enhance your remote work policy, consider implementing zero-trust architecture, a cybersecurity system that doesn’t grant implicit trust to any users. The easiest way to define zero-trust is “never trust, always verify.” Even if the access request comes from inside your company, the zero-trust system will still seek verification.
Many organizations lean on the traditional castle-and-moat method for verification. If you want access to the network (the castle), you must pass through a single point of entry (the moat). But, once inside the walls, you have free rein to do as you please.
The issue arises when you leave and come back. Because the network recognizes and “trusts” you, it lowers the drawbridge and lets you back in.
Zero-trust takes the opposite approach. Instead of trusting previously authenticated users, it treats them like a new access request every time. Zero-trust assumes every user originates from an unsecured open network and will verify their identity every time.
By implementing a zero-trust strategy, you can:
- Strengthen cybersecurity initiatives for hybrid and remote employees
- Better defend against malware, ransomware, and other complex threats
- Ensure those accessing sensitive cloud-based data are authorized to be there
- Limit security gaps
5. Use a Centralized Storage Solution
The Covid-19 pandemic forced most employers to blow the dust off their remote work policy handbook. Many in-person and paper-based businesses had to consider new data storage solutions to allow remote work to flourish.
At the same time, business leaders had to take necessary steps to ensure those data storage solutions were safe from cyberattacks.
The answer is centralized cloud storage. Instead of keeping crucial data in a single location—like a laptop's hard drive or on a thumb drive—cloud storage allows you to save files digitally in the cloud. Since the information isn’t saved on a physical device, workers can access their files regardless of location.
By shifting to a centralized cloud storage system, remote teams can access, manage, and share documents without skipping a beat. Additionally, cloud storage helps backup crucial data.
For example, if a ransomware attack compromises your physical data, you can rest assured knowing you have backups stored in the cloud. It might take some time to get everything back to normal—but it beats losing everything to a cyberattack.
6. Implement Multi-Factor Authentication
Many businesses resist making multi-factor authentication part of their remote work policy. They claim it takes too long to wait for an authorization code and would rather sign into their accounts without the added step.
While they have a point—waiting for and entering the code takes a few extra seconds out of their day—it’s far better than losing data and money to a security breach.
You likely encounter multi-factor authentication (MFA) every day. When you signed into your banking app or changed your Amazon password, did they send you a verification code via SMS or email to ensure it was you?
At its core, MFA is a security measure requiring two or more credentials to log into an account. What makes it unique is that those credentials can come in three different forms. They’ll include something:
- Knowledgeable, like a password or PIN.
- Physical, like your phone, keyfob, or laptop
- Biological, such as a fingerprint or face scan
You’ll need at least one (if not all) of these credentials to access your account. So, if a hacker obtains your password, they won't have access to your phone, face, or fingerprint. You’ll get an alert that someone is trying to log in and can notify the IT department. According to Microsoft, MFA can prevent 99.99% of account compromise attacks.
7. Educate Team Members About Phishing and Other Email Scams
In medicine, the old saying goes, “prevention is better than cure.” You can apply the same notion to cybersecurity, as avoiding an attack is much better than trying to recover from one. When writing your remote work policy, educate employees about the dangers of phishing and other email compromise scams.
Cybercriminals smelled blood in the water when the Covid-19 pandemic forced the world online. According to Forbes, more than 40% of businesses had at least one pandemic-related cyberattack in 2020.
As more companies keep their remote work policies, retraining their at-home workers on the best cybersecurity practices is imperative. After all, human error plays a significant role in 95% of all data breaches, according to the IBM Cyber Security Intelligence Index Report.
Some phishing and email scams stick out like sore thumbs; others are harder to detect. Train your employees on the more sophisticated tactics cybercriminals use. Do they know what CEO fraud is? Will they recognize a subtle difference between a scammer's email address and a trusted vendor?
While it’ll take time, money, and resources to upskill your team members on everything they need to know about cybersecurity, it’s better than the alternative. According to the latest IBM data breach report, the average cost of a cybersecurity breach in the U.S. is $9.05 million. Remote work was found to be one of the main reasons.
Secure Your Business for a Remote Work Future
Cybersecurity shouldn't be “just another expense.” It’s a business-critical factor that all organizational leaders must consider. Security breaches can cost your company far more than money. You could also lose sensitive data about yourself, vendors, and clients, damaging your reputation.
Minnesota Bank & Trust, a division of HTLF Bank is here to share best practices in fraud prevention and cybersecurity to help you stay informed so you can best protect your business. As fraudsters are becoming more sophisticated and are taking advantage of the remote work environment its essential to have a financial partner with a team of fraud experts in your corner. We remain committed to educating our clients on current trends and providing solutions to safeguard your business.