The global crisis caused by the COVID-19 outbreak has meant that millions of people around the globe are working from home. The tech giants such as Microsoft, Facebook and Amazon have already asked their workforce to log in remotely from home. While many organizations already have their remote working policies and infrastructure in place, others are preparing for this paradigm shift.

Remote working presents a new set of challenges for data security, as home environments do not have the same safety standards as your office. While at the office an employee has to work behind multiple layers of security, which prevent most data theft and security threats. However, when the employees log into organization infrastructure remotely, the organization is under high risk of data breaches and security threats. If the COVID-19 situation has forced your organization to extend work from home to employees, then you must be wondering about:

• The risks associated with working from home or logging into company infrastructure remotely
• Security or data privacy policies that could be introduced to safeguard against threats
• Other approaches to mitigate security concerns

During this blog, we will dwell on all these aspects, so that you can ensure the safety of employees as well as mitigate security risks for your business data.

Major Risks of Remote working

Before taking a deep dive into the solutions, let us first go through some common risks of allowing your employees to work from home.

• Inability to safeguard the security of a home office.
• Incapability to ensure the security of the network that employees would be using.
• Lack of understanding and employee training about best practices in information security.
• Absence of physical availability and support
• Unawareness among employees about their roles and responsibilities to ensure security while working from home.

Organizations need to mitigate the above-mentioned risks to facilitate a secured work from home environment. Now, let us take a look at some of the ways to mitigate risks.

How to Mitigate the Security Risks of Remote working?

Step 1: Create a well thought out Work from home Policy – It is essential to have a well-defined “Remote” or “Work from home” policy that contains a set of procedures that every employee must follow when working from home. This overall policy should be supplemented by additional information on data protection policies outlining the roles and responsibilities of employees when it comes to the remote working program. Additionally, the IT department needs to make special provisions to ensure a secured remote workspace for employees involved in highly sensitive projects. The security policy might contain additional clauses for such project teams.

Some procedures you might want to include in the policy are:

• Pre-defined process for applying and approving work from home requests.
• Clarity on the roles and responsibilities of every employee.
• Procedure and guidelines for new joiners, including how to assign a new laptop or how to control a security or data breach if they work on a personal laptop.
• Instructions on things a user must do to secure their remote workspace.
• Outline the process to eliminate means of attacks or device hardening.
• Ensure that all data stored and in transit are secured through encryption.
• Mandate the use of a VPN for all remote workers.
• Enforce a strict “change password” policy as a part of the Password Policy to make sure passwords are not compromised.
• Procedure for reporting any security incident.

Step 2: Have the Right Tools in Place – Having a well-defined policy will make the roles and responsibilities of employees clear, but providing them with the right tools is also essential to reduce the security risks of working from home. Tools need to be selected depending on your organization and the role of employees.

However, some of the commonly used tools to facilitate secure remote working includes:

• VPN: As most of your employees would be using a home network shared with others (family and friends), all your network traffic must be encrypted.
• Virtual Desktop Infrastructure (VDI): VDI software (such as Citrix and VMware Horizon) allows organizations to reduce the device-level security issues by converting the user’s computer into a thin client device. It remotely connects employees to a remote desktop hosted on a separate machine and preconfigured by IT. All the user’s activities take place in the virtual machine within the organization’s own data center.
• Remote Desktop Services (RDS): It is an advanced remote access solution by Microsoft. RDS allows the users to login via any device with Internet connectivity to a centralized server, presenting the same virtual desktop to all the users. All the logged in users have to share the server resources. Although certain settings can be customized, on a broad level every user has the same user experience.
• Built-in Encryption: BitLocker is a tool that supports the encryption of hard drives on Microsoft devices. It ensures that if any device is lost or stolen it would be difficult for someone to fetch data from the device.
• Password Manager: This tool helps the users store their passwords as well as generate secure passwords. It helps reduce the risks of users using the same password for all the services. Microsoft’s Multi-factor Authentication app is a powerful tool in this regard as it authenticates logins each time.
• Firewall: Windows Firewall is a powerful firewall for Microsoft’s users and can be easily enabled to secure devices from inbound and outbound malicious requests.

Step 3: Train and Educate your Employees on Security Best Practices – Establishing remote working policies and providing your employees with the right tools goes a long way in ensuring safety. However, your employees still have to be educated and trained in the best practices. In normal circumstances, this would mean conducting a Security Awareness Training for all employees. But during these unprecedented times of crisis that is not an option for organizations.

To overcome such a challenge, the IT department can leverage Microsoft Teams to organize virtual training sessions. Teams offers all the capabilities needed to host a training session. IT team could utilize internal communication applications to offer tips and advice on security best practices of remote working, cyber laws and compliance issues. Furthermore, Microsoft Teams also enables organizations to provide their employees with a common channel for chats, meetings, and calls. It can help your employees to connect through video and audio calls, communicate with Chats and strategize with meetings.

Remote working is the only option in the present situation, but it has certain security risks. So, it is important to lay a solid foundation to ensure that your organization and its data is safe. This foundation would include the remote working policy, tools for the purpose and virtual training to ensure that everyone understands their responsibilities. If you need assistance in creating a cybersecure infrastructure, click here.