While we support our clients’ initiative to enable staff to work from home, we appreciate such adaptation can give rise to a great deal of risk, especially for teams handling sensitive content.
Thankfully, with some education and diligence, your staff can work together to mitigate these risks, and keep your business healthy without sacrificing productivity.
Here are 10 simple, highly effective security measures we recommend to start:
1. Use strong passwords
It’s really important to ensure that all accounts are protected with strong password. We all have too many passwords to remember, and it is easy to use shortcuts or repeat the same password for all accounts. This means that all it takes is one compromised password for a criminal to take over all of your accounts. Using a tactic called a credential stuffing, malicious actors can take leaked usernames and passwords and attempt to log into other online accounts.
Passwords should be unique to every account, and should be a minimum of 12 characters, contain upper- and lower-case letters, a special character, and a number. Update your passwords at least every 90 days. Don’t share your passwords, and don’t write them down, especially on a Post-it notes attached to your monitor. Used password managers to store and update your passwords.
2. Two-factor authentication
Having 2-factor authentication adds another layer of security to the login process. This will help to minimize the risk of account hacking. The extra layer can be an email or text message confirmation, an auto-generated code, or biometric verification on a device you own.
Using a Virtual Private Network (VPN), allows you to securely connect to another network over the internet. A VPN encrypts all of your internet traffic so that it is unreadable to anyone who intercepts it. This keeps it away from the prying eyes of any snoopers, including your Internet Service Provider (ISP), government agencies, or hackers.
4. Firewall and Antivirus
Firewalls are important when defending your data against malicious attacks. A firewall helps screen out hackers, viruses, and other malicious activity that occurs over the Internet and determines what traffic is allowed to enter your device. Most devices' operating systems come with their respective firewalls. Your router should also have a firewall built in to prevent attacks on your network. Make sure this is enabled.
Anti-virus (AV) protection software has been the most prevalent solution to fight malicious attacks. AV software blocks malware and other malicious viruses from entering your device and compromising your data. Use anti-virus software from trusted vendors and only run one AV tool on your device.
5. Secure your home router
It’s important to take simple steps to protect your home network, and prevent malicious parties from having access to connected devices. Changing your router password is a good first step. Be sure to use a strong password. Make sure firmware is up to date so that security vulnerabilities can be patched. The encryption should be set to WPA2 or WPA3. Restrict inbound and outbound traffic, use the highest level of encryption available, and switch off WPS.
6. Backup data
Data can be lost in a number of ways, including human error, physical damage to hardware, or a cyberattack. Ransomware and other types of malware can wipe entire systems without you having a chance to spot it, and the only guaranteed way to repair your computer is to erase and re-install the system.
7. Keep software up to date
Installing software updates for your operating system and programs is critical. Always keep your systems up to date, including patches for security vulnerabilities that have been uncovered since the last iteration of the software was released. In many cases, you can set updates to run automatically, often while you’re sleeping, so you don’t have to worry about downtime.
8. Avoid phishing email scam and sites
Phishing emails, as well as voicemails (vishing) and text messages (smishing), are a constant threat. Cyber-criminals will attempt to trick you into divulging personal information such as your login ID and password, banking or credit card information. To spot a phishing email, check the sender’s email address for spelling errors and look for poor grammar in the subject line and email body. Hover over links to see the URL and don’t click links or attachments unless you trust the sender 100%. If in any doubt, contact the alleged sender using a phone number or email address that you find somewhere other than in the suspicious email.
9. Never leave your device unattended
The physical security of your devices is just as important as the technical security. Password-locking your device will usually encrypt its contents until someone enters the password. For more protection use FileVault/VeraCrypt or BitLocker for full disk encryption.
If you need to leave your computer, phone, or tablet for any length of time, ensure to lock it up so no one else can use it. If you keep sensitive information on a flash drive or external hard drive, make sure to keep it locked as well. For desktop computers, shut-down the system when not in use, or lock your screen.
10. Be careful what you click
Avoid visiting unknow websites or downloading software from untrusted sources. Unknown sites can host malware that will automatically, and often silently, compromise your computer. If you are sent attachments or links in an email unexpectedly from unknown sources, or if they are suspicious for any reason, don't click!
As always, [RE]DESIGN is standing by to help you rise to the occasion. If you're curious about solution recommendations for a establishing a remote workforce, click here. (If you are suspicious of this link, good for you! You can also email us at: firstname.lastname@example.org)