Working from home presents two broad concerns:
Cyber-security. Ensuring systems are available and information is protected, and Physical security. Ensuring offices and assets are protected during reduced staffing.
Cyber-security
Remote workers may be operating outside of the security provided by the enterprise. If devices, such as laptops, have not been provisioned securely it increases a number of risks including the possibility of malware and the exposure of sensitive data. Many exisiting security practices are still relevant, more so for personal devices that may be being used for work purposes.
- Patching and updating is critical. Personal devices may not be automatically updating, including anti-malware. These should be enabled to keep software up to date.
- Multi-factor or Two-factor authentication should be utilised for accounts. Where not possible, ensure credentials (passwords) used are robust and sufficiently complex.
- Users should not be given account privileges beyond what they need to get their job done.
- Connections from home into corporate environments should be via secure (encrypted) means. Capacity may need to be increased to deal with higher load.
- Logging and monitoring of critical assets should be increased. Any suspicious activity should be investigated promptly.
- Maintain or increase levels of user awareness to threats, scams and social engineering. There are parties who will seek to exploit the current situation. If in doubt, call people before commiting actions such as payments.
- Consider the use of cloud-based security services that can be deployed rapidly and accessed without the need for face-to-face interactions. Equally, these may be de-provisoned when staff return to corporate security environments.
- Ensure back-ups are maintained and that these are not vulnerable to ransomware or cryptoware attacks.
- Utilise community resources such as NZ’s NCSC and CERT.
Physical security
Opportunistic theft may increase, while there are reduced numbers of public and staff in the vicinity of offices.
Organisations should consider:
- Putting attractive items out of view.
- Ensuring disk encryption is enabled on devices left in offices and credentials are required for access.
- Increasing guard patrols.
- Keeping security systems armed and not automatically disabled during business hours, including doors.
- Ensuring response functions are in place. If an alarm is triggered, someone will react to it.
- Determining if visitors, such as cleaners, are necessary.
