Securing Devices at Home and Work
According to a 2018 study by CNBC, there were over 70% of employees around the world working remotely at least one day per week. With the recent COVID-19 pandemic, many organizations have had to make full-time remote work an option just to stay in business. As full-time remote workers are progressively more common, there still aren’t many resources that focus on the cybersecurity risk created by working remotely.
With the latest surge in working from home (WFH) employees, businesses are forced to rely on business continuity planning. This means that organizations must find ways to protect their customer’s sensitive data simultaneously granting workplace flexibility. Provided the current conditions we are all facing and in celebration of Cyber Security Awareness Month (CSAM), we thought we should share a few tips to help your business increase its cybersecurity.
Security tips for the home, office and working from a home office
Secure your working area
The first and easiest piece of security advice would be to physically secure your workspace. Working remotely should be treated the same as working in the office, o you need to lock up when you leave. There have been way too many instances when laptops with sensitive data on them have been stolen from living rooms, home offices, and even in public settings such as coffee shops. Never leave your devices unattended and lock doors when you leave.
See why laptop and home office security is so important.
Secure your router
Cybercriminals take advantage of default passwords on home routers because it is not often changed, leaving any home network vulnerable. Change the router’s password from the default to something unique. You can also make sure firmware updates are installed so known vulnerabilities aren’t exploitable.
Use separate devices for work and personal
It’s important to set separate restrictions between your work devices and home devices. At first it may seem like an unnecessary burden to constantly switch between devices throughout the day, but you never know if one has been compromised. Doing the same for your mobile devices, can decrease the amount of sensitive data exposed if your personal device or work device has been attacked.
Encrypt the device you are using
Encryption is the process of encoding information so only authorized parties can access it. If your organization hasn’t already encrypted its devices, it should. Encrypting the devices prevents strangers from accessing the contents of your device without the password, PIN, or biometrics.
Below is a way to encrypt devices with the following operating systems:
- Windows: Turn on BitLocker.
- macOS: Turn on FileVault.
- Linux: Use dm-crypt or similar.
- Android: Enabled by default since Android 6.
- iOS: Enabled by default since iOS 8.
Check that your operating system is supported and up to date.
Usually, operating system developers only support the last few major versions, as supporting all versions is costly and the majority of users upgrade when told to do so. Unsupported operating systems no longer receive security patches, making your device and sensitive data at risk. If your device does not support the latest operating system, it may be time to look into updating the device.
Here’s how to check if your operating system is still supported:
- Windows: Check the Windows lifecycle fact sheet
- macOS: Apple has no official policy for macOS. That said, Apple consistently supports the last three versions of macOS. So assuming Apple releases a new version of macOS each year, each release of macOS should be supported for roughly three years.
- Linux: Most active distributions are well supported.
- Android: Security updates target the current and last two major versions, but you may need to check that your manufacturer/carrier is sending the security patches to your device.
- iOS: Like macOS, Apple has no official policy for iOS but security updates generally target the most recent major version and the three prior.
Read more about Android security here
Create a strong PIN/password only YOU know
Everything mentioned prior to this won’t matter if you don’t use a strong password. A common tip for creating a strong password is to avoid using repeating numbers (000000), sequences (123456), or common passwords such as the word password itself.
More tips on creating a strong password include:
- Avoid using anything that is related to you
- Avoid using your date of birth
- Avoid using your license plate
- Avoid using your home address
- Avoid using any family members or pets’ names.
A good pin/password should appear arbitrary to everyone except you. Consider investing in a password manager. A good password manager can help you create strong passwords and remember them, as well as share them with family members, employees, or friends securely.
Learn more about how to create a strong password
Install antivirus software
An antivirus software is a program that detects or recognizes a harmful computer virus and works on removing it from the computer system. Antivirus software operates as a preventive system so that it not only removes a virus but also counteracts any potential virus from infecting the device in the future.
Authorize two-factor authentication
Two-factor authentication is an authentication method where access is granted only after successfully presenting two pieces of evidence to an authentication mechanism. This method has been proven to reduce the risk of successful phishing emails and malware infections. Even if the cybercriminal is able to get your password, they are unable to login because they do not have the second piece of evidence.
The first and most common evidence is a password. The second takes many forms but is typically a one-time code or push notification. There are several applications that can be used for two factor authentication such as Google Authenticator.
Erase data from any devices you plan to sell
This should be the number one rule on any cybersecurity list. It is only a matter of time until your devices are obsolete, and it is time to upgrade. The one thing you don’t want is to have a data leak because you failed to properly erase the data from your device before selling or disposing of it. Returning the device to factory setting may not always be enough, as some hackers know how to retrieve the data that has been “erased”. Before doing anything, always remember to back up your data to multiple devices before clicking that “delete” button.
Consult with your operating system to see how to properly reset your device to factory settings. If you are certain you do not want the data on your device to be accessed ever again, we can help with that. Here is a list of data destruction services we provide:
Security tips for employers handling a remote workforce
Train employees on cybersecurity awareness
As cybercriminals are always looking for new ways to bypass security controls to gain access to sensitive information, cybersecurity isn’t something that can just be taught once. It must be a continual learning and retention. Here are a few things that a business can teach their staff in order to help thwart a cyberattack:
- Avoid malicious email attachments and other email-based scams
- Identify domain hijacking
- Use operations security on their social media accounts and public profiles
- Only install software if they need to
- Avoid installing browser plugins that come from unknown or unidentified developers
Use a virtual private network (VPN)
A virtual private network (VPN) extends a private network across a public network, enabling you to send and receive data across shared or public networks as if you are directly connected to the private network. They do this by establishing a secure and encrypted connection to the network over the internet and routing your traffic through that. This keeps you secure on public hotspots and allows for remote access to secure computing assets.