Teleworking Securely and Safely

As we move to what seems to be a semi-permanent Remote Workforce due to the recent health scare, CISOs and Security Teams are trying to keep up with the change that is occurring at a very fast pace. Our job in cybersecurity is to reduce the Cyber Threats as much as possible, while continuing to enable day to day business processes and this new trend is pushing customers into a place that they were not setup to accommodate.

What we have found during our Baseline Audits and Security Program deployments is a large amount of organizations state that they have the appropriate Policies, Procedures and Technical Controls in place, but the opposite seems to be more accurate. In most cases, policies are stale, the procedures that are in place are not relevant due to the constant changes within the infrastructure and no real test of the technical controls are in place to validate they are working.

So… How does this relate to our ever-changing work environment? This is the time to validate the Security Policies and Procedures that SHOULD have been put in place are working as intended. If your organization has never adopted a remote access policy, it is imperative that it is created. Your organization must adopt the right security strategy so the remote workers can perform their business tasks and stay productive while at the same time reducing the risk of cyber-attacks.

As your organization is looking to implement Remote Telework Policies, make sure to take these suggestions into account:

• Prevent the use of personally owned devices. If a personally owned device has been approved for use, do not access NON work-related web sites or store organizational data elements locally. Personal devices often lack the tools built into business networks such as strong antivirus software, customized firewalls, and automatic online backup tools. This increases the risk of malware finding its way onto devices and both personal and work-related information being leaked.
• Verify that all AV and Anti-Malware definitions are up to date.
• Verify all patches have been applied. If the remote user is connecting with a VPN Client, sandbox the end device until patches and definitions can be validated. Once complete, then allow access to the approved resources.
• Only connect to Private or Secured WiFi Access Point. Unsecured public WiFi networks are prime spots for malicious parties to spy on internet traffic and collect confidential information.  
• When available – encrypt ALL data that is being developed or worked on.
• Screen Lock portable devices when not in use – hopefully this is automated with proper GPOs.
• If possible – attach a physical lock to the laptop while unintended.
• Be vigilant regarding Phishing campaigns. It is highly likely there will be an increase in malicious campaigns targeting remote workers. Do not click on web links within emails from unknown senders.
• Use Private VPNs when connecting to sensitive and private networks.
• Enforce Multi-Factor Authentication. This will provide an additional level of security in case user credentials have been compromised.

As always – Slate is always a phone call or email away assisting our partners with any security concern. If you require assistance or would like to discuss these in more detail, please reach out!