Watching social media, LinkedIn and the barrage of emails in my inbox on how to stay safe while working from home, I decided to do some research so that I could educate myself on what we can do in to be safe online while working from home. I believe that an educated market, armed with the correct principles will make good decisions regarding the security of their staff and businesses.
While doing my research, I had a look at the World Economic Forum (WEF) website for guidance. I found two articles (I am sure that there are more – go and look at the website for extra reading) that bear mentioning. These are not definitive guides but give some really good and practical advice.
The first article covers “Why cybersecurity matters more than ever during the coronavirus pandemic” and the second, “How to protect yourself from cyber attacks when working from home during COVID-19”.
The first article (https://www.weforum.org/agenda/2020/03/coronavirus-pandemic-cybersecurity) written by Algirde Pipikaite and Nicholas Davis listed three reasons that explain why “…robust cybersecurity measures matter more than ever..”:
- There is a heightened dependency on digital infrastructure and that raises the cost of failure;
- cybercrime exploits fear and uncertainty in people; and
- more time online could lead to riskier behaviour.
The article concludes that we need to change our online behaviour to maintain high levels of cyber security.
The second article (https://www.weforum.org/agenda/2020/03/covid-19-cyberattacks-working-from-home/ ) says “…As we navigate the challenges posed by COVID-19 and the need to halt the spread of this deadly pandemic, many of us are settling into a routine of working from home. This can pose many difficulties, including how to maintain focus, how to balance other priorities, such as childcare, and how to be productive without requisite tools or dedicated office space – not to mention the struggle to avoid raiding the whole snack cupboard in one day. There are compromises to be found for many of these challenges in what we hope will be a relatively short-term arrangement. What we must not compromise on is security…”.
The article written by Amy Jordan and Ryan Olsen goes on to list details of how businesses and individuals can respond. Let me summarise the two areas:
Business Response
- Understand the threats to your organisation
- Provide clear guidance and encourage communication.
- Provide the right security capabilities
- Secure connections and communications
- Endpoint protection on all laptops and mobile devices, including VPN tools with encryption
- Enforce multi-factor authentication (MFA)
- Block exploits, malware and command-and-control (C2) traffic using real-time, automated threat intelligence
- Filter malicious domain URLs and perform DNS sinkholing to thwart common phishing attacks. (“…DNS sinkholing is used to spoof DNS servers to prevent resolving host names of specified URLs. By using the DNS sinkhole technique it is also possible to deny access to any of the websites. This can be used to restrict access to specific sites that violate corporate policies, including social networking, abusive content, etc…). (https://resources.infosecinstitute.com/dns-sinkhole/#gref)
Individual Response
- Maintain good password hygiene.
- Update systems and software.
- Secure your WiFi access point.
- Change your default settings and passwords in order to reduce the potential impact on your work of an attack via other connected devices.
- Use a virtual private network (VPN).
- Be wary of COVID-19 scams.
- Don’t mix personal and work – use your work devices to do work and your personal devices for personal matters.
The article concludes with some simple advice: “…Taking these relatively straightforward steps at both an enterprise and individual level should help address some of the most common security risks facing our home-working environments. We should also recognize that our threat environment is not static, which means it’s important to keep a close eye on evolving threats to avoid unnecessary additional costs and disruptions in a time when we can least afford them…”.
So, armed with this information we should:
- be more vigilant in our approach to technology and working from home
- understand where we are exposed, what risks there are to our business, and how to address:
- secure access to corporate resources (this should include MFA and PAM at a minimum)
- business efficiencies that can be unlocked, using online collaboration tools, digital signature solutions, etc
- the needs of our BAU teams – developers still need to develop applications securely, engineers still need to support users, and for those still using passwords as the single authentication factor – it still needs to be reset. Business needs to carry on. How do we enable this securely?
- staff availability – Our already stretched resources will be stretched even further and face different challenges. We cannot solve new problems with old ways of thinking.
- on premise vs Cloud services – is there a one size that fits all or is there a hybrid solution?
- what is the level of security awareness of our staff, contractors and 3rd parties? Are we able to run programs remotely? How are we enabling user awareness during this “work from home” environment? Our users are the most targeted and we should protect them
- objectively view the world during this pandemic – take advice from reputable sources only.
And finally, in these uncertain times, be kind, stay calm! Let us be defined by our Manaakitanga toward our community.
