The risks of teleworking, is this practice becoming widespread?

Insecure credentials and networks, infected devices, untrained personnel… These are the risks of teleworking. A phenomenon that is here to stay but which involves serious cybersecurity threats

Martha is a queen at what she does. The best salesperson in her company. But just a few days ago she unintentionally triggered a serious cybersecurity incident. She made a mess. She connected with her personal computer from home to her company’s network and ended up infecting several servers with malware. One of the risks of teleworking.

A phenomenon that is here to stay. Yes, but it poses serious threats to companies that don’t understand its dimensions.

For those that, for example, don’t have cybersecurity services capable of analyzing this specific case.

The case of Martha evidences, perhaps, one of the great gaps of the generalization of teleworking. Lack of employee training, which often implies an incorrect separation between personal and corporate resources.

Digitalization is already forcing thousands and thousands of employees to update their knowledge in fields that are often alien to them. And in many cases even hostile.

Incibe argues that the implementation of teleworking is forcing companies to be very proactive in the training of their workforces and failure to do so could be foolhardy.

The proliferation of ransomware or malware attacks in recent months should have set off all guns blazing. Too much is at stake.

Oscar Mayo, cybersecurity advisor at Tarlogic Security, warns about the risks of teleworking and the security holes that can be generated by a poor configuration of the equipment and systems involved in this operation.

«Sending workers home expands the exposure surface for attack on an organization’s technology infrastructure if not done properly. Telework cannot be activated lightly», he warns.

Probably, the best starting point is to make the entire workforce understand that teleworking requires special sensitivity on their part to avoid inappropriate behavior.

Access to unsecured networks

Actions such as connecting to the company’s system through unsecured networks. Those of an airport or a hotel, for example. Or via non-corporate equipment that in many cases lacks security updates.

Namely, all of them entry points for cybercriminals.

Anyway, Oscar insists that companies must provide secure stations for employees who are going to telework. «Any workstation should be conceived as an extension of the company. A remote workstation that must have all the appropriate security guarantees».

Putting trust in workers’ personal computers doesn’t seem to be an option. Allowing an employee’s laptop to connect to the company’s systems without checking whether it’s up to date and protected is unreasonable.

If it’s infected, and many are, it will have every chance, for example, to spread malware throughout your company’s systems. If the protections are not up to date, which is even more common, you could be attacked relatively easily by the bad guys. A dangerous and persistent threat.

Just this week Microsoft introduced Windows 365 to meet the challenge that businesses have on the table. It’s a cloud service that uses both the power of the cloud and the capabilities of the device to deliver a complete and personalized Windows experience.

And all of this in a secure environment built in accordance with Zero Trust principles.

The multinational company’s objective leaves little room for doubt: «This is an innovative breakthrough at a time when organizations around the world are looking for the best way to facilitate hybrid work models, in which employees can work both from the office and located anywhere in the world».

Comprehensive vision and risk containment

The recipe, on the face of it, seems clear. Companies must have cybersecurity services in place that ensure a holistic view to address the risks of teleworking.

Actions such as the correct configuration of VPN’s access or applications that may be directly exposed to the Internet, i.e. something as commonplace as an Intranet, are essential.

Oscar Mayo also insists at this point on the need to correctly segment corporate networks to minimize damage in the event of an intrusion.

A security mechanism that would prevent the spread of a ransomware attack, for example, should it occur.

Limiting employee access to only those resources and servers that are strictly necessary according to their responsibilities or avoiding the use of software not authorized by the company are aligned with this same strategy.

It goes without saying that it is a priority to promote a policy of secure credentials. To circumvent, for example, the frequent association between email and ID as the default user and password created by default to access corporate intranets.

The use of secure passwords and second authentication factors (tools such as Google Authenticator, Microsoft Authenticator or FreeOTP, to name a few) are nowadays basic requirements to contain the risks of teleworking.

Finally, he insists on the need for regular security audits to contain all these threats.

Therefore, to guarantee along the way the pillars that have to guide teleworking:

• Availability.
• Authenticity.
• Integrity.
• Confidentiality.
• Traceability.

The five commandments of a phenomenon that is here to stay.

True enough. As long as things are done right, of course…

Discover our work and cybersecurity services at www.tarlogic.com