As the world grapples with a global pandemic, many businesses have been forced to move their day-to-day operations from offices to their employees’ homes. This global remote workforce creates new security risks for businesses, their customers, and their employees, with a significant increase in phishing, malware, and other malicious activity. It is a fitting time to celebrate Work Wise Week 2020 this week and National Work from Home Day on Friday 15 May in the U.K. and put a spotlight on how to work remotely, yet securely.
The Global Cyber Alliance (GCA), along with a coalition of nonprofit organisations from across the globe, launched the Work from Home. Secure Your Business campaign in March focused on shoring up the defences of a newly remote workforce.
The campaign provides clear, actionable guidance including links to tools and step-by-step instructions to put better security in place in the home environment. The campaign incorporates the GCA Cybersecurity Toolkit for Small Business, which offers free and effective tools for immediate action to reduce cyber risk.
Since the launch of the campaign, the coalition has grown to 23 nonprofit organisations, including several based in the UK.
Work From Home. Secure Your Business focuses on several key areas to help users work wisely while working remotely:
Patch to Protect
One quick, easy way to vastly improve security is to apply any security updates, or patches, immediately to ensure your devices are always up to date.
· Anything that is on your network, storing your data, or connecting your devices should be patched.
· Laptops, tablets, phones, and office and home routers should all be configured securely and updated.
· Turn on auto-updates. For most devices this will only take a few minutes each.
Take time to review the guidance provided within the Patch to Protect section of the website.
Sign in Securely
Knowing who is on the network and accessing your information is crucial. An important way to help with that is the use of multi-factor authentication (also known as two-factor authentication, or 2FA).
2FA requires multiple credentials, making it much harder for an attacker to gain access to your accounts. With 2FA, a user needs the following:
· Something you know, such as a password; and/or
· Something you have, such as a token (Google Authenticator, Authy, Okta, RSA, etc.) or a verification code sent to your phone; and/or
· Something you are, such as your fingerprint or face (biometrics).
Depending on your environment, the actions that need to be taken to implement 2FA will differ. If your organisation has a centralized work environment (servers are located at a central office), then the IT department will most likely use RSA, Symantec VIP, or some sort of corporate 2FA mechanism. If your organisation is more decentralized and using the cloud for many services, this is where you and your IT department will enable 2FA on those services and have users download an authenticator tool such as Google Authenticator or Authy. You can find more detailed guidance in the Sign in Securely section of the website.
Read More