Has remote working put a strain on your company?
By Kevin Prone, Head of Service Development at Nowcomm
Never has there been such a rapid shift to remote working than that caused by the ongoing Coronavirus pandemic. But could the emergency short term measures many businesses are taking lead to long term data and financial risks? Across a series of blogs we explore the cybersecurity issues businesses face and how to tackle them.
Coronavirus has meant that organisations of all sizes, and across all sectors, have been forced into adapting the way in which they work within a matter of days and weeks rather than what might otherwise be a gradual process over many years, if not decades. This blog will delve into why this change can put a strain on a business’ cybersecurity processes.
The speed factor problem
There are a range of implications generated by this rapid and emergency shift when it comes to secure IT and financial and data protection – regardless of what sector you work in, or how big or small your business might be. Many organisations may be deploying new devices and applications for the first time, and outside of a true benchmarking or stress testing process to valid the service or feature. Organisations maintaining various functions of business as usual are probably relying on their employees’ home internet and home WiFi to connect with colleagues and customers. In the rush to onboard remote working operations, they may not have had time to fully ‘war room’ these scenarios to see if the new services and remote working models effectively and continuously keep their organisations staff, suppliers, customers and the all the business systems and data secure.
The home worker vulnerability
Further, IT communications evolve at breakneck speed and organisations have already been facing a growing proliferation of cyberthreats for several years. Today these threats and vulnerabilities are increased when combined with employees adapting to their own personal stress and concerns of the lock-down situation. With this in mind, the newly created home worker may not have factored into the complex equation that their systems and IT access are likely to be missing many of the behind the scenes benefits of the traditional workplace environment. Benefits such as the various protective layers of cyber security and data protection the IT department has carefully tuned and configured for the expected on-premise working model.
Targeted phishing
When you add to the above challenges that cybercriminals are actively designing, such as phishing attacks specifically tailored to exploit pandemic-related uncertainty, then maintaining the effective protection IT security for remote workers and business operations as a whole, must be quickly acted upon by all organisations before a major impact such as loss of service, loss of data or loss of reputation is incurred.
Recent coronavirus-related scams have already been circulating and are capitalising on people’s desire for information, advice and updates to the global pandemic. These seemingly innocent but malicious messages and links can trick remote workers, for example by secretly installing key loggers and other malware onto the remote workers device. As discussed above, should this device be more vulnerable when not protected by the “traditional walls and policies” of the enterprise grade internal IT network, then serious problems may unfold for any organisation which may have up to this point successfully rolled out home working solutions.
Network exposure
A vulnerability from just one compromised remote device may be capable to spread into the wider organisation IT network and across and between the remote worker device base. Current remote working IT environments may not have been possible to stress test or fully model expected attacks and threats, particularly given we have all been reacting and working within extreme and unprecedented circumstances for a matter of just a few weeks. Yet, this situation is one which cyber criminals are actively targeting with opportunistic attacks and are being successful in exploiting for their own illegal purposes. The current working model that many organisations may have adopted amplifies how IT security needs to be addressed at both a corporate network and an externally located remote end user (and therefore end device) level. Our previous article explores the end user levels in more depth.
So, how can organisations best meet the challenges they find ourselves facing given the protocols we have needed to follow as our only course of action to continue some form of standard operational activity? In the next blog, we will look at securing your cloud services for remote workers.
