![](\"https:\/\/blog.trendmicro.com\/wp-content\/uploads\/2020\/03\/WFH-Securely-300x270.jpg\")
<\/p>\n<\/p>\n
So you suddenly have a lot of staff working remotely. Telework is not new and a good percentage of the workforce already does so. But the companies who have a distributed workforce had time to plan for it, and to plan for it securely.<\/p>\n
A Lot of New Teleworkers All At Once<\/strong><\/p>\n This event can be treated like a quick rollout of an application: there are business, infrastructure, and customer security impacts. There will be an increase of work for help desks as new teleworkers wrestle with remote working.<\/p>\n Additionally, don\u2019t compound the problem. There is advice circulating to reset all passwords for remote workers. This opens the door for increased social engineering to attempt to lure overworked help desk staff into doing password resets that don\u2019t comply with policy. Set expectations for staff that policy must be complied with, and to expect some delays while the help desk is overloaded.<\/p>\n Business continuity issues will arise as limited planning for remote workers could max out VPN licenses, firewall capacity, and application timeouts as many people attempt to use the same apps through a narrower network pipe.<\/p>\n Help Staff Make A Secure Home Office<\/strong><\/p>\n In the best of times, remote workers are often left to their own devices (pun intended) for securing their work at home experience. Home offices are already usually much less secure than corporate offices: weak routers, unmanaged PCs, and multiple users means home offices become an easier attack path into the enterprise.<\/p>\n It doesn\u2019t make sense to have workers operate in a less secure environment in this context. Give them the necessary security tools and operational tools to do their business. Teleworkers, even with a company-issued device, are likely to work on multiple home devices. Make available enterprise licensed storage and sharing tools, so employees don\u2019t have to resort to \u2018sketchy\u2019 or weak options when they exceed the limits for free storage on Dropbox or related services.<\/p>\n A Secure Web Gateway as a service is a useful option considering that teleworkers using a VPN will still likely be split tunneling (i.e. not going through corporate security devices when browsing to non-corporate sites, etc.), unlike when they are in the corporate office and all connections are sanitized. That is especially important in cases where a weak home router gets compromised and any exfiltration or other \u2018phone home\u2019 traffic from malware needs to be spotted.<\/p>\n A simple way to get this information out to employees is to add remote working security tips to any regularly occurring executive outreach.<\/p>\n Operational Issues<\/strong><\/p>\n With a large majority of businesses switching to a work-from-home model with less emphasis on in-person meetings, we also anticipate that malicious actors will start to impersonate digital tools, such as \u2018free\u2019 remote conferencing services and other cloud computing software.<\/p>\n Having a policy on respecting telework privacy is a good preventative step to minimize the risk of this type of attack being successful. Remote workers may be concerned about their digital privacy when working from home, so any way to inform them about likely attack methods can help.<\/p>\n Any steps to prevent staff trying to evade security measures out of a concern over privacy are likely a good investment.<\/p>\n Crisis Specific Risks<\/strong><\/p>\n During any major event or crisis, socially engineered attacks and phishing will increase. Human engineering means using any lever to make it a little bit easier for targets to click on a link.<\/p>\n We\u2019re seeing targeted email attacks taking advantage of this. Some will likely use tactics such as attachments named \u201cattached is your Work At Home Allowance Voucher,\u201d spoofed corporate guidelines, or HR documents.<\/p>\n Sadly, we expect hospitals and local governments will see increased targeting by ransomware due the expectation that payouts are likelier during an emergency.<\/p>\n But Hang On \u2013 It Is Not All Bad News<\/strong><\/p>\n The good news is that none of these attacks are new and we already have playbooks to defend against them. Give a reminder to all staff during this period to be more wary of phishing, but don\u2019t overly depend on user education \u2013 back it up with security technology measures. Here are a few ways to do that.<\/p>\n\n\n
\n <\/td>\n \n