A secure home office

Many employers offer home office as one of the benefits. However, during the COVID-19 pandemic, working from home has become a day-to-day reality for many people. Although this type of work brings many benefits to both employees and employers, it also poses an inherent risk. Cyber security turns out to be one of the main threats.

For hackers, computers and other devices outside the protected corporate network are usually an easier target to attack. There are several reasons for this which will be explained in this article. We will also offer measures which will make it much harder for hackers to do what they please. As a result, you will be able to better protect your devices from malicious attacks.

What are the main risks we should focus on?

• An unsecured home network and Wi-Fi – Many employees working from home use their home network to connect to the internet and to their employer’s network. Hackers can attack an insufficiently secured network and gain access to network devices, sensitive business data, and even your personal data.
• Email attacks – Many attackers send phishing emails to gain access to sensitive data, services, and devices. They usually try to win the employee’s trust and thus lower their guard when checking the legitimacy of an email message and what it asks them to do (such as open an attached file, click on a link, or enter sensitive information).
• Use of private devices for work – Many employees use their personal devices for work and vice versa. It is also not uncommon for employees to copy business data to their personal devices to work on it. In the event of a successful attack or a loss of their device, they expose (often sensitive) business data – and therefore their employer – to risk.

How to protect yourself

Secure your home network – We recommend the following:

• never use the default passwords on your home router or other network devices
• use a WPA2 or WPA3 encryption protocol to secure your Wi-Fi
• turn off WPS on your router
• disable remote administrator access to the router from the internet (WAN)
• if you are a tech-savvy person, you can set network access only to predefined devices based on their MAC address

Use multi-factor authentication – Multi-factor authentication means that a combination of “different factors” is required to log in – i.e. a combination of something you know (such as a login, password, or PIN), something you possess (such as a phone or a card), and something that is a part of you (such as your voice or a fingerprint). Even though this is somewhat less convenient, this type of security is a very effective protection against attacks. Use it wherever possible or where it makes sense.

Use strong passwords – We have written an article about passwords, but here is a summary of the basic tips.

• Create passwords including characters, numbers, and uppercase and lowercase letters.
• Do not use a single password for multiple accounts.
• Use a password manager.

Use secure applications to communicate – Instead of SMS or social networks, use secure applications to communicate with your colleagues and clients. The same applies to video conferencing applications. A suitable technology should usually be chosen and provided by your employer. If this is not the case, try to reach out to them. After all, this is also in your employer’s interest.

Use an antivirus software – Your employer usually provides an antivirus solution to protect your device. If you use your personal device for work, you need to protect it. Use updated antivirus software.

Don’t let your family use your business computer – Remember that your business device contains sensitive data, and if it is compromised it can become a gateway for hackers into your employer’s network.

Respect company policies – Report any unusual behaviour of your business devices to the IT department and follow the basic cyber hygiene rules, such as keeping your operating system, antivirus software, and web browser updated and regularly scanning your device for malware. Common security rules include measures such as:

• using a corporate VPN to securely connect to an employer’s protected network
• only using software approved by your employer
• not using your business device to visit unknown or suspicious websites
• not using business devices for personal purposes

Set up an automatic screen lock – Set your screen to lock automatically. This is another simple way to protect your company’s data.

Advice for employers

• Only allow employees to connect to your corporate network through a VPN.
• Introduce a password policy so that your employees use strong and secure passwords.
• Implement multi-factor authentication to access your company’s most sensitive data (or wherever it makes sense).
• Set inactive connection timeouts for applications working with sensitive company data. Employees do not always log out on their own.
• Only allow employees access to the data they need to perform their work.
• Use encryption on all corporate devices.
• Make sure all your web applications use HTTPS.
• Use all available instruments to secure employee communication (email, messaging, and video conferencing).
• Monitor your suppliers and service providers.
• Create and provide employees with a secure centralized data repository.
• Create a set of corporate security policies and rules for employees and make sure that employees become familiar with them.
• Train your employees on cybersecurity regularly.