Remote work is on the rise. According to Upwork’s Future Workforce Report 2021, 40.7 million Americans are projected to be fully remote within the next five years. And with more than half of businesses (53%) saying that remote work has increased their willingness to source talent remotely, cybersecurity best practices are going to have to adapt to an increasingly hybrid workforce.
Remotely accessing networks and data via personal devices and Wi-Fi networks can create new data security risks. And hackers have ramped up their strategies to exploit the crisis, using email scams and spoof sites to spread malware.
With that in mind, now is an excellent time to give your IT security policy a closer look. Read on for some tips to beef up organizational security as your team goes remote.
1. Develop standard security rules and procedures
Establishing standard security rules and procedures for your remote teams can bring accountability and security to your organization through transparency.
For a remote team, standard remote work security best practices and policies might include rules and procedures for:
- Regulatory compliance
- Remote access control
- Backup and media storage
- Data protection
- Remote system management
- System ownership and return
- Information disposal
The general idea is to provide a single source of truth that clearly describes best practices for accessing your network remotely and protecting sensitive data.
2. Define PII standards
Personally identifiable information (PII) is classified by most regulatory organizations as data that could be used to identify specific individuals. Full names, addresses, birthdates, social security numbers, phone numbers, and biometric records all fall under this category.
Because the exact classification of PII can vary greatly by country, the definition of internal PII standards must meet the obligations for PII compliance in all territories in which your organization operates.
For example, in the United States, the National Institute of Standards and Technology (NIST) Guide to Protecting the Confidentiality of PII is a great place to start.
3. Train and educate team members
As the line between work and home continues to blur, it’s important to ensure that your cybersecurity training factors in the new reality of remote work.
With potential issues ranging from physical theft of a remote worker’s device to packet sniffers on public Wi-Fi networks, a remote workforce must be educated on the risks and how to prevent them.
Beyond the risks associated with remote working, you should already have at least an annual security training program in place to ensure all staff is routinely trained on how to protect themselves and others from the latest cybersecurity threats.
4. Don’t leave your electronic devices unintended
Never leave laptops, tablets, phones, and other devices unattended in public or an unsecured office. It only takes a few seconds to steal or tamper with a physical device. If you must get up to use the bathroom, take your device with you. And never leave your laptop unattended within a vehicle or checked luggage.
This is a solid rule to include in any security policy, but in practice, it pays to invest in additional security measures that will protect your data in the event a device is lost or stolen. Encrypting your hard drive (either through built-in Windows and macOS settings or a third-party security solution) is the one thing you can do to protect your data even in the event your device is stolen.
5. Set laptops and mobile devices to automatically lock
Setting your devices to auto-lock can go a long way toward discouraging petty theft or attacks. While a determined attacker can still get to your data by reading directly off the hard drive, locking your device does limit what they can do to access your files, especially when paired with an encrypted hard drive.
6. Do not leave passwords written down
While you may be tempted to jot down a password on a sticky note or keep all your passwords conveniently organized within a physical notebook at your desk, such information is only as secure as the physical security of the room you keep it in.
It’s one thing if you’re keeping that logbook of passwords locked behind a safe, but most people who write down passwords tend to do so out of convenience, leaving them out in the open for the eyes of any passersby. Plus what happens if you lose the physical password or accidentally take it out with the trash? There are far better ways to manage the hundreds of passwords a typical modern-day internet user must manage. This brings us to the next section…
7. Use a password manager
One of the biggest security threats to businesses by far comes from the inside: weak passwords.
Look into creating and enforcing organization-wide policies to make sure passwords are difficult to crack and changed regularly. Enterprise-grade password managers can help enforce certain behaviors and ensure they’re not reusing passwords across accounts. Password managers are available for businesses of all sizes, with some that offer convenient administrative oversight to IT and security departments.
When it’s time to change a password, a password manager can automatically update it so employees don’t have to or send an alert when a site for which a password is saved suffers a security breach.
8. Use a VPN and 2-factor authentication
Use a virtual private network (VPN) and 2-factor authentication—especially with bring-your-own-device (BYOD) remote work.
Your actual users—along with the devices they use to access your network (e.g., mobile phones, laptops, or mobile point-of-sale systems)—can often be the weakest link in the security chain. What was once on-site on one network is now scattered across devices on different home Wi-Fi networks, so you’ll want to adapt your IT security policy to account for more “endpoints.”
When it comes down to it, users are endpoints themselves, and they can do the most to prevent attacks by using good judgment, having effective antivirus software, keeping the software and operating systems up-to-date, and backing up data to the cloud. Encourage your remote workers to password-protect their networks and implement a VPN for remote logins, which can help to encrypt communications and data between your network and theirs. Using two-factor authentication (2FA) can also help tighten security for this large, and notoriously vulnerable, attack area.
9. Keep your operating systems and software up-to-date
It’s in the best interests of software companies to monitor their products for vulnerabilities and release routine updates to patch those vulnerabilities. But if you, the end-user, don’t allow those patches to run, often due to the inconvenience of a temporary disruption of service, your hardware runs a greater risk of being compromised through a known exploit.
Make sure your security policy includes planned downtime for extensive operating system updates for your company infrastructure. The operating systems of remote desktops, laptops, and other devices should also be kept up to date.
10. Use least-privilege protocols for data access
A common challenge when you go remote isn’t understanding what information users need to do the work—it’s figuring out how they can safely access it. How can you share internal information and data in a way that won’t leave your company exposed to unnecessary risk?
First, consider the level of risk involved. Data can generally be organized into five categories: Sensitive, confidential, private, proprietary, and public. Clearance should be role-based and “need to know”—essentially, giving individuals access only to the systems and information they require for their projects—and can be reevaluated or revoked as needed.
11. Choose tools and software with built-in security
For chat and other communications, many platforms offer built-in security and privacy features. Paid versions of software like Trello and Slack will offer better security and privacy features, and Slack’s paid tiers offer access to authentication, security, and compliance features. Using a platform like Upwork Messages for communications can keep messages and attachments centralized and encrypted via SSL (Secure Sockets Layer) connections.
Are you engaging independent development talent? Code versioning tools let you grant access to certain branches of a code base so developers can securely contribute without having carte blanche access to your entire system.
12. Consider antivirus and anti-malware software
Good data hygiene and cybersecurity training have no substitute, and most operating systems today have their antivirus defenses. That said, there’s still a market for organizations that need additional endpoint security to protect their sensitive data.
Antivirus software, or more broadly anti-malware software (as viruses are a subset of malware), are still relevant in 2022. These tools offer up-to-date databases of malware signatures, detect anomalous behavior, and can even remove malware from your device.
Major anti-malware vendors include McAfee, Symantec, and Malwarebytes, to name a few. These companies offer solutions fit for individuals, small businesses, and enterprises alike. At the enterprise level, antivirus systems are typically referred to as Endpoint Protection Platforms (EPP) and are much more comprehensive in their ability to protect fleets of distributed devices.
13. Understand phishing emails
Email phishing is a technique where hackers pose as legitimate companies, persons, or authorities in an attempt to trick users into providing sensitive information or downloading malicious files. It’s a popular vector for ransomware attacks.
Since email phishing has been around for a long time, the threat is constantly evolving. Today’s false emails are more sophisticated and convincing than ever before. That’s why it’s important to train your team with examples of what to look for in a phishing email.
14. Use a firewall
A network layer firewall is a good idea for monitoring what’s coming into and leaving your network’s walls when you have people working remotely. This will help you scan traffic for unusual behavior such as large data transfers, a hallmark of an attack.
What about keeping unwanted visitors and malicious software off your network? A firewall can help to make sure only the right people and files are getting through with a set of rules to block unauthorized users from accessing your network. They’re excellent lines of defense for preventing data interceptions and blocking malware from entering your network, and they also keep important information from getting out, like passwords or confidential data.
15. Delete old files when no longer needed
When old files containing sensitive data and information cease to be an asset, they become a liability. Hackers can’t steal what isn’t there. Deleting these files is the best way to ensure they don’t compromise your organization.
But truly erasing old computer files is easier said than done. When you drag an item into the recycling bin and empty it, that file is still technically recoverable from the hard drive. You’ve only deleted the operating system pointer to the file, freeing up its space on the hard drive to be overwritten. But the file itself can still be recovered until that space in the hard drive is overwritten.
So how do you permanently delete files from a computer? The simplest approach is to overwrite the space occupied by the deleted file with gibberish. After removing a file from the recycling bin you can reformat the drive to ensure it can’t be recovered by most software. To truly eliminate all hopes of recovery though, you’re still going to need to overwrite that space multiple times with randomized characters such as in the Gutmann method.
Of course, this will also remove all data on your hard drive. It’s for this reason that digital shredding tools are designed to permanently erase files.
16. Properly dispose of old devices
If the software approach to data destruction is still not thorough enough, you can always destroy the physical hard drives. The best way to ensure that your data is truly unrecoverable is to destroy the devices before disposal. Common physical destruction methods include:
- Hydraulic press, is a device that thoroughly crushes and compresses a hard drive beyond repair.
- Mechanical shredder, which uses blades to turn your hard drives into scrap metal
- Degaussing, is a technique in which you apply a strong magnetic field to destroy the hard drive, rendering it useless.
17. Encrypt important data and communications
Encryption can help protect the actual data and files that are stored on your network, but it’s especially important if you’re using the cloud and have data and files that are in transit—in email, browsers, or on hard drives of remote workers outside the network. If data is intercepted, encryption makes it difficult for hackers to do much with it.
Utilize software-based encryption measures like full-disk and file-based encryption to safeguard data shared between endpoints or stored on your server, in the cloud, or locally on devices. Also, it’s good to ensure your website’s traffic is encrypted with an SSL certificate.
18. Move to a cloud-based system
Undergoing a digital modernization? When your network evolves, your security strategy should transform, too.
Microservices, APIs, and the cloud are behind the transformation of online work and distributed teams. However, with all of the scalability and convenience, they offer, moving operations, hiring, and data into the cloud takes critical functions outside your network’s secure perimeter. This can open you up to a new set of security concerns.
The Cloud Security Alliance (CSA), a not-for-profit organization to promotes best practices in cloud security, recommends that organizations use multifactor authentication and encryption to protect their data whenever it’s being transmitted or stored outside the organization. This is, according to the CSA, especially critical for organizations in regulated industries like banking and healthcare, which have much stricter standards for how data can be stored and transmitted.
19. Monitor network security regularly
Thanks to artificial intelligence (AI), breach-detection systems can watch for aberrations and abnormalities that signify someone has attempted or is trying to break into your network. If there are suspicious-looking actions occurring on the network—like someone or something trying to break in—a network intrusion detection system (NIDS) will pick up on it. NIDS passively monitors network traffic around the clock for behavior that seems illicit or anomalous. NIDS not only block that traffic, but also gather information about it and then flags it for network administrators to review.
20. Conduct system vulnerability assessments
The best offense is a good defense—especially regarding network security. Security audits can help hone in on any vulnerabilities in a computer, network, or communications infrastructure, preventing costly attacks in weak areas you may not know exist. This can be especially useful for businesses that must adhere to certain regulations and standards like PCI DSS, HIPAA, and NERC CIP, among others.
21. Go beyond the assessment with penetration testing
Penetration testing deliberately probes your network or system to safely identify vulnerabilities ahead of time and devise a plan to fix them. These can be flaws in operating systems, issues with non-compliance, application code, or endpoint problems. After executing this process, a tester can generate a report as proof of compliance and a prioritized list of vulnerabilities to keep on the radar.
22. Have a breach response plan
Breaches still happen. That’s why it’s important to have a data breach response plan in place. An effective framework can help you spring into action. The plan can be updated as often as you need to, for example, if you have changes to network components or new threats arise that need to be addressed. A plan can help ensure you have resources in place and an easy-to-follow set of instructions for sealing the breach and completing follow-up actions, whether that’s getting legal assistance, purchasing insurance policies, implementing data recovery plans, or notifying any partners of the issue.
Start securing your data today
Remote work may require you to shift your IT security strategy, but it can be just as secure as on-site work with the right proactive measures. A few tools and best practices can go a long way toward bolstering the security of online work.
