10 Tips for a Secure "Work from Home" Experience

7th April 2020 11:45:12 AM

POSTED BY:

10 Tips for a Secure "Work from Home" Experience

As we battle through the beginning of 2020 and the COVID19 Pandemic, this advice should help you to keep your company and employees safe and secure.

On the outside, still working from within the system.

You may remember a post we published in early March pertaining to preparations we made at IDPP in order to achieve a couple of key goals:

Create a working environment that keeps our employees physically healthy.
Create a working environment that keeps our employees mentally healthy.
Revamp our IT Infrastructure to provide access to IDPP’s systems, securely.
Provide tools/equipment/software to help our employees perform their job functions as effectively as if they were in office.

Basically, we don’t want to let any barriers persist, especially regarding working comfortably and effectively from home.

Something that wasn’t covered in the above mentioned post, or the post written by Steph Sims regarding Tips for Working from Home, are the key steps needed to maintain a healthy CyberSecurity status during these unprecedented times.

Now, when staff work from dedicated offices, there information exchange occurs between a server, internal network and end user machine. As I say in my CyberSecurity training sessions, the biggest threats to CyberSec tends to be excessive user rights and weak passwords. Regardless of the specifics, it remains true that any IT system is only as strong as it’s weakest link.

Essentially, what the whole country has just done is start transferring (often confidential or sensitive) information from their home networks – which often don’t benefit from the added protection of MSPs or internal IT Security consultants. We’ve added public internet, local networks and consumer-grade security systems to the potential “weakest link” list.

Here are some tips on how to minimise those risks.

Photo by Arget on Unsplash

Knowledge starts with training, and solidified by ongoing experience.

I mentioned Cyber Security training earlier – it’s more of a primer, but everyone at IDPP has received training on a number of key elements: to beware of phishing emails, to avoid use of public Wi-Fi, to ensure home Wi-Fi routers are sufficiently secured and to verify the security of the devices that they use to get work done.

We’ve already seen some examples of certain groups or individuals taking advantage of the current global situation – I guess some just can’t pass up the opportunity to exploit vulnerable people, or perhaps they just want to watch the world burn.

As a very quick recap, open emails (and certainly don’t click links) unless you know who the sender is. You can always contact the sender to verify the contents of the email. I also talk a lot about the difference between Windows and Mac, plus iOS and Android app security, but the same rule applies to all; don’t install apps from anywhere but the official stores.

So, make sure that all staff working from home have been trained in the basics of Cyber Security, and make sure they know who to contact in the event of a breach, a threat, or just uncertainty.

Provide your employees with VPN access

If you use a lot of cloud-based services, such as a CRM or ATS, there should be sufficient security in place to access these with relative freedom. But for files hosted on a server, or shared drives, it would be advisable to put a VPN in place.

Remember, home networks aren’t likely to be quite as secure as the onsite infrastructure, but a VPN will help to hide a user’s location and IP address, whilst encrypting data packets

There are lots of VPN service providers, at IDPP we have a dedicated MSP with whom we’ve built up trust over many years.

If you’re looking for a more cost effective solution, I’ll leave some suggestions. Just remember, that you can’t necessarily trust any VPN provider, so do your homework. As tempting as it may be, I would suggest avoiding free services. You have to ask yourself, if you’re not being charged, what’s the benefit to the service provider, whose service is to handle all of your most sensitive and confidential information.

NordVPN and ExpressVPN are certainly good choices, but as I said, do your homework!

Once chosen, you should ensure that all relevant remote employees are provided with access to the service, and all business related tasks should be done via the VPN.

PPE, but digital

This one should go without saying, but I’ll say it anyway.

Anti-Virus Software
Firewalls
Encryption

These should already be in place, but if they’re not, put something in place immediately.

The area of least control: Passwords

Passwords are, by nature, secretive. It’s not practical, therefore, to assess individual’s passwords because that means they would need to reveal the password to you, nullifying it.

Have a password policy in place, including a minimum standard and tips on how to choose a secure password. Don’t overcomplicate it, it doesn’t need to be;

1 UPPERCASE, 1 lowercase, 1 number, 1 special character, 1 equation, 1 recipe for Aunt Edna’s delicious cookies, your name in Morse Code and a special handshake.

But it should be a defined policy that forces everyone to change the password regularly. And please, please… don’t just put a new number on the end when prompted to change your password.

One of the ways I (casually) check people’s passwords it to observe their reactions and ask if their password contains:

The name of anyone they know (family, friends, kids, pets)
The date of birth of anyone they know
Any key dates
Their football team
The same password as before, with another number on the end

If you see a sheepish grin or any sign of familiarity, ask them to change their password.

Alphanumeric codes (with special characters) and use of two-factor authentication should become mandatory, and remember that CyberSecurity applies to all devices. Phones, Laptops, Tablets, Smart TVs, etc.

Don’t get left behind

Make sure your teams upgrade their software to the latest version, especially security patches and updates. New threats emerge everyday, whether they’re viruses and trojan horses, or phishing emails and social engineering. Keep up to date, keep safe.

Cloud systems are usually safer than local storage

A great way of preventing Cyber breaches is to make sure that data is not stored locally. If possible, stick everything on the cloud (as long as it’s secure. Again, a trusted MSP is a great solution here).

Employees should be encouraged to use cloud-based apps (such as Office 365).

Any password that is “default” is not safe!

A purely hypothetical situation here:

Emma works as an installation engineer for an internet service provider. She installs routers and sets new customers up with internet access. She works for a well known company who aim to keep their customers secure and happy. The company has the best intentions. Because you trust the company, you give Emma the space she needs to complete her job – install a router in your home.

Because of her training, Emma knows a thing or two about LANs, WiFi and Cyber Security. She also knows your address, because she’s coming to install your router. She also knows the default password, because it’s printed on the back of the equipment, and she has a smart phone with a camera.

A week after your installation date, Emma has a bit of a bad day. She’s received a huge bill and needs a quick bit of cash to pay it.

She pulls up outside your house, accesses your WiFi, and with a few bits of clever coding and a little bit of luck, she’s got all the information she needs to transfer money from your bank account, to somewhere else.

Default passwords are not safe. Plug your laptop directly into the router using an Ethernet cable, open your browser, and go to “192.168.0.1”. Now change your password to something secure. Everyone should be doing this!

A top tip from my own personal setup, my WiFi name (or SSID) is “Corrupted Network”. It may not be actually corrupted, but it’s worked as a great deterrent.

Mandatory backups

Backups are essential for disaster recovery. If you’re using cloud based services, it’s likely the service provider will periodically make backups for you. If not, put a backup system in place.

If cloud based services aren’t an option for whatever reason, employees could be encouraged to use external drives to back up computers. I say “could” because I’m not 100% convinced that this is a worthwhile risk – how secure is an external drive? Do you want your companies Intellectual Property stored locally in someone’s home?

Universal Security Breach (USB) Sticks

Avoid USB sticks. Maintain a safe Digital Distancing. There have been too many examples of such devices being infested with malware. Check out this article if you want to see exactly why this is an issue.

Replace the lost “office comradery”

Working from home is quite common, especially in the IT Markets. For other industries who haven’t really adopted a WFH policy on any grand scale before, the change of working environment can be strange at best, and lead to the dreaded Cabin Fever and beyond. Besides that, consider that your employees may get sick, or worse, during this crisis.

Having Teams, Zoom, Facetime, or some other form of group online meeting space, has already proven to be effective in maintaining healthy working relationships, mental health, and generally providing a safe space for people to discuss any barriers or concerns with the new working setup.

Someone may raise a concern that they felt was limited to them, such as visiting the fridge too much, or not getting enough exercise, or struggling to cope with the isolation. There are few things more reassuring than knowing that someone else is having the same experience as you. One of those things is knowing someone else had the same experience and they can help you overcome it.

All of your employees are likely to be under a great deal of stress, but it’s understood (rightly or wrongly) that working from home should be easier somehow. Communicate with each other, because you can see if someone in the office is troubled – you can’t assess someone’s tone and body language effectively from an email.

Show All Our Blog

Sign in / Register

Send CV / Profile

GET EMAIL ALERTS

About Us

Client Zone

Candidate Zone

Careers

Contact Us

Our Blog

Our Blog

Search Jobs

Search Jobs

10 Tips for a Secure "Work from Home" Experience

POSTED BY:

Peter Grint

View profile

0208 334 7511

See Peter Grint's jobs

10 Tips for a Secure "Work from Home" Experience

On the outside, still working from within the system.