By Jordan Shifflett
COVID-19 has already killed thousands and infected hundreds of thousands more. As a response to this pandemic, many governments have issued shelter in place orders for citizens to avoid a larger eruption of the novel Coronavirus and to not overwhelm our healthcare systems.
With all these changes occurring rapidly across the world, many organizations have adopted a business continuity plan of enabling employees to work remotely from home. This shift in workflow has caused multiple challenges and concerns for information security professionals.
As the number of telecommuting employees is increasing quickly, it has also amplified the exploitable opportunities for attackers. Many users are now working with sensitive data on unsecure networks and doing daily tasks on personally owned devices. This poses a risk as home networks are likely much less secure and personal devices are usually less maintained.
The skyrocketing number of remote employees leads to a rise in remote login activity, making remote user credential theft another easy target for threat actors.
Email has been the number one attack vector for quite some time, and it seems that email-based attacks are being focused even more now.
Here are some tips from the LRS IT Solutions Security Team to help secure the remote work force.
If possible, remote users should be working on corporate-owned machines with proper protections in place, such as endpoint protection software like Fortinet’s FortiClient or Cisco’s Advanced Malware Protection. Also, any time a user is working with sensitive data, they should be securely connected to the corporate network through a VPN.
Users should be utilizing strong passwords and not reuse these passwords across multiple applications. Strong passwords should also be used to secure each remote user’s home network. A password must be required to connect to a home network and it should not be the default manufacturer.
We recommend that all remote connections being made to internal or web resources should use a form of multifactor authentication such as Duo Security or Microsoft Azure MFA.
In addition, conducting a phishing campaign could help give insights on the number of employees who are vigilant and others who are careless when it comes to email security. User awareness training is another way to help employees understand what to look for and the impact of email-based attacks.
Users working on personal devices should make sure that updates are being applied regularly and vulnerabilities are being remediated. Users should also make sure host-based firewalls are enabled and any virus and threat protection are active. Microsoft Security is suitable option for most Windows personal devices.
The impacts of COVID-19 are being felt by everyone. Some have experienced physical health impacts, many have seen a change in lifestyle, and even more have felt the shift in business operations. Protecting remote employees from cybersecurity threats is an important step to take in dealing with this virus.
About the author
Jordan Shifflett is an Information Security Specialist with LRS IT Solutions. As a key member of our Security team, he is dedicated to helping our customers with multifactor authentication, endpoint protection, privileged access management and other general security services.