COVID-19 Highlights Security Challenges of Remote Workers

With much of the world’s workforce trying out new solutions for working at home, bad actors are taking this opportunity to spread viruses of their own.

Current Remote Solutions Lack the Capacity

Many companies have not had solutions to work at home widely available, or their current solutions don’t have the capacity for their entire team.  This causes employees to “figure out” their own solution.  Often their ideas are insecure. In addition to your employees getting creative some IT departments are favoring speed over security.  They have pressure from management to get all employees up and running working from home quickly.  This leads them to make bad decisions about how that is done. There are many secure solutions to work from home.  VPN, Microsoft’s Remote Desktop Gateway, web-based applications with 2FA enabled, various applications to securely remotely control their machine, and more.  However, urgency felt by IT departments is leading them to implement insecure solutions like opening Remote Desktop.  This leaves your business wide open to threats, particularly ransomware. When looking at solutions to work from home DO NOT OPEN RDP ON YOUR FIREWALL!  As mentioned, there are many other ways to work securely from home, and this is an unnecessary security risk.

No Control

The other challenge that IT departments face is that they have no control over what is on an employee’s home network.  They could have completely insecure wireless.  They could have machines used for torrenting that are riddled with viruses.  These items and many more suddenly become a concern for IT departments.  Users working from home could be connecting to the company network from these devices. It’s recommended that companies provide equipment whenever possible for their employees to work from home.  This allows the employer to ensure that the device is up to date with all security patches.  They can provide a quality antivirus solution, and a secure remote work solution. This enables employees to be productive from home.  It protects the company from unknown devices connecting to their network.  Remote work is done in the way that the company wants.

Inadequate Backups

Another concern that businesses should seek to address with remote employees is inadequate backups.  Typically work done in the office is saved on the server which hopefully has a great backup solution in place. Working from home can mean that employees end up saving their files locally on their desktop or laptop.  Depending on the situation this may or may not be a company provided machine, and likely won’t have individual backups on it.  This could lead to lost data or other problems. One solution for this is Microsoft SharePoint.  It’s a secure web-based file sharing platform that allows your employees to securely store company data from anywhere.  It has a robust set of permission that allow you to secure sensitive data when only a subset of the team needs to see it.  It also gives your employees a “network drive” they can save things to no mater where their location is.

Compliance Concerns

If your business must be compliant with HIPAA, PCI, NIST or other security protocols you will likely to have additional items to consider when folks are working from home.  HIPAA for example requires encryption on all devices that contain patient data.  It also requires any communications that have that data to be encrypted. Whole disk encryption for laptops and encrypted email solutions are a must for health care providers that want to allow their employees to work remotely.  They will likely need to investigate a solution for mobile device management as well to better secure patient data on cell phones and tablets. This is one example, but compliance should be one of the things you examine as you look at your solution to allow employees to work remotely.

Tips to Stay Safe

Here are a few quick tips that will help you stay safe working remotely.

1. Provide a remote work solution that is secure for your employees and enforce use of that solution only. VPN, Remote Desktop Gateway etc.
2. Cloud solutions such as web applications should be secured with 2FA whenever possible.
3. DO NOT OPEN RDP ON YOUR FIREWALL
4. Provide devices that are managed, up to date with security patches, and have your authorized solution for remote work configured whenever possible.
5. Provide a solution for secure remote file sharing when possible and centralize data to ensure that it is saved in the appropriate location where it can be secured and backed up.
6. Consider solutions like whole disk encryption and email encryption if compliance is a need for your business. (These solutions may change depending on your specific compliance needs)
7. Make sure you ask your IT department “IS IT SECURE?” before implementing new remote work solutions.

Here to Help

As always, the experts at i.t.NOW are here to help with all your remote work concerns.  Feel free to reach out to our team of experts and we can recommend solutions that will keep your staff secure and productive no matter where they work.