According to a survey of 2,000 individuals conducted by IBM, many people are new to remote work arrangements, with more than 80% of survey respondents stating that they rarely worked from home or didn't work remotely at all prior to the COVID-19 pandemic. Such an increase poses a challenge for organizations and their IT teams: How do you effectively secure your remote workforce and manage risk?

Cyber Criminals Know More People Are Working From Home

Hackers have been taking advantage of the chaos created by the pandemic to probe the expanding number of remotely connected computers and networks, which are being deployed to support a growing number of workers who find themselves trying to sustain productivity and efficiency while working remotely.

Some of the many cyber threats we're seeing bad actors leverage include:

• COVID-19 themed social engineering schemes
  • Distributing malware using pandemic-themed emails
• Phishing
  • Impersonating trusted or authoritative sources (e.g., executives, health authorities, etc.) to send malicious emails
  • CEO fraud: hackers exploiting the pandemic to create emails leveraging a false sense of urgency to get employees to act (e.g., purchase of eGift Cards and sending the "CEO" the codes)
• Attacks against newly deployed (often rapidly and sometimes misconfigured) remote access solutions
• Malware masquerading as a COVID-19 "contact tracing" mobile application (Android OS)

Rapidly changing environmental factors create additional risk. For instance, the spike in online shopping has created opportunity for hackers who decide to leverage the pandemic: Increasingly, they target ecommerce for consumer financial data theft by creating fake online stores and fake product deals.

Combine the isolation created by working remotely, varying degrees of pandemic-related stressors, the fact that many people are not used to working from home yet, and the knowledge that many organizations were not prepared to securely and rapidly deploy their workforce remotely (much less continue to support them securely), and you have an environment of heightened security risk for a remote workforce that has far more on their mind than the typical workday presents.

8 Actions You Can Take to Secure Your Remote Workforce

The following are some cybersecurity actions your business or organization can take to mitigate the increased risk of a partial-to-fully remote workforce:

1. Patch Your Security Flaws

Patching is an area many organizations struggle to properly address. With many employees working mostly remotely, it is even more important that organizations step up their system patching game, especially for key systems (e.g., remote systems, VPNs, public-facing servers/services, etc.).

2. Use Multi-Factor Authentication (MFA)

Speed up your company's deployment of MFA in order to secure remote access to company networks and resources.

3. Use Encryption

Encrypt company laptops and leverage data loss prevention (DLP) software to assist with detection of data breaches and leaks.

4. Make Sure Systems Are Visible

Are there systems being used for business purposes that are not company/organization property or approved (e.g., Shadow IT)? These systems are often used by individuals wanting to bypass company controls that they feel are unnecessary or too cumbersome. Gain visibility into the systems and tools being used by your personnel so that you can actually protect them. Without visibility, implementing risk-based controls is even more difficult.

5. Check in on Your Third-Party Service Providers

Confirm the security of your third-party vendors and service providers. Start by listing your service providers and detailing the services provided to your company or organization (including any data that they store or have access to on your behalf). Ask your service providers what they do to protect your data or secure access to your environment. Consider requesting independent reports (e.g., SOC 2, ISO 27001, etc.) showing what each company does with regard to security controls.

6. Document Your Incident Response Plan

When your workforce is remote, having a good incident response plan and clear procedures becomes even more paramount. Make sure your incident response plan is documented and up to date.

7. Take Advantage of Distance Learning

Embrace it. Employees need security awareness training (in addition to business process training), even more so when isolated by a pandemic. Distance learning is a valuable tool and should be secured like any other remote application or resource (e.g., MFA).

8. Communicate Clarity

Network users are inundated with pandemic news and health guidance. While important, the sheer volume of information can drown out crucial security guidance. Consider creative methods of delivering critical security information, such as gamified phishing tests or a Q&A channel via Microsoft Teams or Slack.

There are many challenges and risks that any organization seeking to successfully weather the economics of a pandemic must face, but with some effort and time invested in addressing the eight tips outlined above, cybersecurity doesn't have to be one of them.

About Delap Cyber

Delap Cyber provides consulting, assurance services, forensic investigations, breach response, and managed cybersecurity services to businesses throughout the United States. Our solutions are designed to provide peace of mind by implementing multiple layers of controls through specifically selected, implemented, managed, and monitored tools by security professionals.

You’ve spent your life building your business. Let us help you protect it.