Protecting your cyber security at home

Before the lockdown, just 5% of UK employees – the equivalent of 1.7 million people – were predominantly working from home, according to estimates from the Office for National Statistics.

But with millions now working remotely for the foreseeable future, the threat facing businesses from cyber criminals is at an all-time high.

The basic issue is that remote working means more people are likely to be caught out by cyber-attacks, as companies are struggling to maintain the same level of security during the COVID-19 crisis. Cyber criminals across the world are actively looking to exploit the new ways of working firms are adopting, aiming to compromise personal data, introduce malware, and divert money and financial transactions. The attack surface for criminals has increased, creating a significant amount of new risk.

“Many more people are working from home, many more are using portable devices and remote-access technology, some individuals are unfortunately experiencing significant financial stress, and almost everyone is disorientated. These are the four things that really play to the attackers’ benefit”, highlights David Calder, CEO of Adarma.

By using portable devices more regularly and potentially sharing these with others in their households, employees may be exposing themselves to simple hacks without knowing it. Sharing personal devices is opening the door to malware which can jump the gap into company systems. Password-based authentication is not necessarily enough to protect companies, as remote access methods can be easily discovered by automated bots using common passwords.
And with face-to-face meetings a thing of the past, videoconferencing apps such as Zoom have come to the fore, but they need to be used properly to ensure security. Despite this, some firms are turning a blind eye and sharing confidential information in an unprotected environment.

The stress many people are experiencing may also make them more vulnerable to being caught out by criminals preying on their insecurities. The threat is real – since January 57,000 COVID-19 domain names have been registered, with many being weaponised to be used for scams such as phishing emails and ransomware attacks. Typical phishing attacks have asked people to add new payees to new supplier forms, or to change payment details.

Stay safe and protect yourselves

The best form of defence for companies, is to believe that they will be breached, and to deploy technology to counter criminals while enlisting staff in the fight. “You have to assume that you will be successfully attacked, and you need to work towards reducing the impact of that”, says Dan Brown, Head of CyberSec at FarrPoint Ltd.

According to Alex Bransome, CISO of Doherty Associates, “increased good policy guidance on how staff should be working, communicating and sharing data whilst working remotely” is key.

To achieve this, regular cyber security sessions with staff are vital. Awareness of the risks is crucial for security. Organisations need to clearly communicate remote working standards and acceptable device use policy as a first step. That should include making employees aware of the need to be careful at home, as confidential information can be seen or overheard, which means minimising notetaking and printing.

Staff need to maintain cyber security hygiene by using trustworthy sites and avoiding unknown links where possible. They should be encouraged to report when they or others make mistakes. Finance functions must be protected as a priority and companies should set up additional security protocols.

Technology can help. Firms can establish secure email platforms with malware scanning and impersonation filters, to identify spoofing attempts as well as an external email banner.

Introducing multi-factor authentication for devices is vital to improving security across the organisation, while software such as Microsoft 365 can mitigate the risk of IP theft by identifying sensitive data and blocking it from leaving the organisation.

Reach for the cloud

A global pandemic is not the ideal time to entirely restructure a company’s IT platform. But the future for cyber security is in the cloud and companies should consider moving to a cloud-based system.

It is more agile, secure and mitigates risk. Employees will not see any difference in their experience, while companies will have better visibility over their entire technology estate in and out of the office.

The technology is scalable, so will be cost-effective across the organisation, and it integrates with cyber security operations centres that can respond immediately to any incidents.

 

Moving to the cloud may be a project for the future, but in the meantime, if you wish to find out more please get in touch on investments@livingbridge.com.