How to manage cybersecurity for your in-house remote workers

In today’s unprecedented context, we’ve seen numerous companies turning to remote work. Until now, you may have collaborated with outsourced teams, but kept many roles in-house.

Without a doubt, managing cybersecurity for your remote workers is different than keeping them safe while they’re working on-site in the office. Every organization should be aware of the security implications of working remotely, especially when this shift happens unexpectedly. 

Remote work can substantially expand an organization’s attack surface, potentially (and unintentionally) also leading to non-compliance and cybersecurity incidents.

Although some organizations have a strong network security set-up in place at the office, others may be unaware of the risks associated with remote connectivity. 

Without the appropriate cybersecurity measures in place, remote work can put any business at risk. 

We’ve noticed an increase in traffic to malicious websites as more and more employees have started to work remotely. Compared to the pre-COVID-19 period, we’ve seen a 20% growth in the detection of file-based malware and an 8% rise in attacks.

At the same time, we’ve witnessed malicious actors capitalizing on the coronavirus pandemic by spreading email spam campaigns and registering thousands of new COVID-19-themed malicious domains.

Thus, what matters most right now is to ensure your organization does not become affected by cyber threats and still remains cyber resilient, even if your staff is working outside of your perimeter.

How to secure your remote workers 

The key aspect when it comes to securing your workforce is to focus on prevention methods rather than on mitigation. Below I’ve listed some good preventative measures that you should follow to ensure your business continuity while your employees are working remotely. 

Conducting cybersecurity awareness training sessions

In the cybersecurity field, employees are oftentimes considered to be the weakest link in an organization. Unfortunately, human error is oftentimes the root cause of many data breaches. This is why you should support your employees to gain at least some basic cybersecurity knowledge in order to keep your business safe.

Did you have the opportunity to train your workers on cyber protection fundamentals before they started working from home? If you didn’t, it’s not too late to conduct virtual training to educate them on how to react in the event of encountering cyber threats.

Teach them to always remain vigilant and what kind of digital risks to watch out for. And perhaps even if you did train them in the past, a quick reminder will be beneficial.

For example, social engineering attacks are a widespread practice among cybercriminals and can take various shapes in the online landscape. 

One of the most common types of social engineering refers to email phishing. After the World Health Organization (WHO), in a statement published at the end of January, declared the novel coronavirus an international disaster, phishing campaigns piggybacking on it began to emerge.

Cyber attackers now use persuasive (yet fake) communications disguised as messages coming from official health agencies and government divisions to capitalize on COVID-19-related concerns. For instance, these phishing emails can contain malicious links that point users towards credential-stealing webpages or malware-infected attachments that pose as legitimate documents issued by authorities. 

To remain safe from phishing and other cyber-attacks, your staff should be able to understand some cybersecurity best practices, such as:

• Paying attention to the email sender.
• Being vigilant of messages that use a sense of urgency and ask them to transfer money or disclose internal confidential details.
• Not clicking on suspicious links.
• Checking the email with a DMARC analyzer.

At the same time, your users should learn to never reuse passwords and in order to avoid the burden of remembering overly complex ones, they should rely on password managers instead.

If they are using the same passwords on third-party services and their login credentials ever become compromised, through the practice of credential stuffing, cybercriminals will attempt to sign into their corporate accounts.

Also, another important aspect related to passwords that enhances an account’s security refers to enabling and using two-factor authentication methods.

What’s more, if your employees ever believe they have fallen prey to a cyber-attacker and your company’s information has potentially been exposed, they should have some clear instructions to follow – employees must notify your organization’s IT admin so the threat can be mitigated immediately.

Having secure data backups in place

Backups are essential for any business because they enable you to regain access to your data in case cyber incidents occur. Do not rely on assets stored in a single location since you may risk losing all your data and be unable to recover it.

Cloud solutions are a great backup alternative as they can automatically sync your data and make it accessible at all times, from any location.

Both large and small organizations are susceptible to data breaches and ransomware attacks, so this is why it’s crucial for every business to invest in secure data backups. 

Always vetting your business partners

Successful outsourcing partnerships are fundamentally based on mutual trust, communication, and transparency. This also means you should have visibility into your business partners’ cybersecurity practices. 

There are many outsourcing firms like Connext that provide robust cybersecurity solutions. Trusted providers like them can help you further manage digital security for your remote workers.’

Vendor Email Compromise (VEC) – or what has commonly become known as the traditional Business Email Compromise (BEC) scheme targeted towards the vendor-customer relationship – is a real and emerging threat. VEC scammers are preying upon the vendors’ employees, with the goal of gathering intelligence on the business partners they are working with.

Essentially, their ultimate purpose is impersonating the vendor and requesting fake money transfers or gaining unauthorized access to the customer’s IT systems.

According to a study conducted by the Ponemon Institute, 59% of companies were affected by a cyberattack through third-parties. By evaluating the security and privacy policies of your vendors, the likelihood of a data breach can be reduced from 66% to 46%.

Asking them to provide cybersecurity self-assessments and requesting security audits will help you understand if their business is indeed secure.

Ensuring secure connections

Another remote work issue refers to how businesses are handling data transmission on every remote endpoint. You may be mostly relying on your corporate VPN, however, during the current COVID-19 pandemic, we’ve noticed VPN traffic exploding and exceeding the capacity of company VPNs. 

Before cloud applications became the norm, the software used within a company used to be installed and run only in the physical office environment and could only be accessed when using the organization’s network. 

Employees who want to work remotely typically have two options: either show up at the office and connect to the corporate network or use the company’s VPN software.

Naturally, as more and more users are trying to gain access to apps while working from home, the bandwidth and number of VPN connections skyrocketed. 

As Heimdal Security experts have recently pointed out, as a result of the colossal data increase, VPNs can no longer guarantee security. This may happen due to the creation of detectable “signatures” that malicious parties can use to steal confidential data while in transit.

VPNs do have many privacy benefits, yet when highly solicited, they can become unstable and under certain circumstances eventually lead to data interception and other types of network-related attacks. 

Our studies have revealed that relying on DNS over VPN when it comes to data security and privacy can be much more effective. 

DNS filtering solutions specifically address this issue since they look at the Internet’s infrastructure to ensure that no malicious “packages” evade detection and stop connections to Command & Control servers used in malware propagation.

These tools protect your organization from threats such as ransomware, data leakages, and phishing and stop attacks before they reach your endpoints.

Of course, DNS over VPN is just one of the measures that safeguard your organizations and ensure data security and privacy during the COVID-19 pandemic. 

Conclusion

Remote work clearly involves multiple security risks that you should be aware of and be actively addressing. All in all, a combination of human vigilance and using the proper remote work tools will keep your business safe. 

Fortunately, outsourcing companies like Connext can help combat these risks by implementing appropriate safety measures to protect your company’s data.