Work From Home Cybersecurity, Tips, and Risks

Introduction

We can disagree about many things, but we can all agree that the 11th of March 2020 wasn't a good day for anybody. This is the day when the world health organization declared covid-19 a global pandemic. 

 

People started to panic, most of them didn't show up for work the next day. Many shops have closed their doors in front of money to protect themselves from a potentially deadly virus. Things started to get out of hand until we all saw the online stores didn’t get affected at all. A lot of places have made the option for online shopping possible to save their trade and make life go on and this was a lifesaver and a perfect solution to deal with the pandemic.

 

On the other hand, for companies, it was not a choice to make their activities be remotely achieved or their business will collapse. As a result of all these successive events, we can see most of the employees work from home to achieve their tasks. 

 

But you should ask yourself if achieving your work from home is secure enough? Are you aware enough of potential threats that may harm you or your company? Do you know the latest campaigns against remote workers to compromise their companies? 

 

In this article, we are providing answers to these questions, suggesting how to maintain your security while working remotely.

Work From Home Cybersecurity, How To Stay Safe? 

In this section, we will discuss the most important solutions to make your remote work stay as safe as possible. 

Physical Security 

You should have separate devices used specifically to achieve your work, take them away from everybody’s sight. Use them during your job time only. Keep them safe as if you were in your office. Keep your family members away from your work devices. So mainly you should keep your cybersecurity work-life balance.

Devices Passwords

You should use strong passwords for all of your devices. By strong I mean not predictable, not related to you and not default credentials and of course, do not use the same password for more than one application. You can make use of password managers in case you forget complex passwords. Also, make sure you lock your device when you are away from your workstation. You can check our article here about useful tips for password protection.

Devices Security

First, list what are your work devices first -ideally- will be a router, computer (PC or laptop), maybe a phone, and others. You should check that your router is not using default credentials for login, also your router could be not updated that it had an old firmware that has a well-known exploit that can let the hackers be in your network without your knowledge. Regarding your computer, you should make sure you have the latest updates and patches for your operating system and your softwares.

Protect your Network 

You can make your home’s network private and hidden with a strong unpredictable password to connect. You should also keep monitoring the logged-in devices to your network. You can also limit access to known devices at home. Also, you can Enable the firewall in the router configuration.

Use VPN 

VPN is a virtual private network that enables users to send and receive data as if they are in person in this network. If there is an attacker in your network performing man in a middle attack or others, if he intercepts your traffic he will not see anything useful as it will be fully encrypted, generally using VPNs for untrusted networks is a good solution. Also, it is important to use a trusted well-known VPN and of course, make sure if you are using credentials to connect to it to be strong.

Phishing 

While you are using your work devices and connecting to your company network make sure that you are not pressing an untrusted link or clicking on an email that you are not sure who sends it otherwise you may be a phishing campaign victim and most likely this will be bad. Moreover, be wise while downloading stuff from the internet on your devices, if it is not from a trusted resource don’t download it or maybe you are a ransomware victim that will encrypt all your data instantly. 

Antivirus

You shouldn’t put all your security trust in the Antivirus, advanced attacks can evade antiviruses, However, it is always good to have a trusted well-known antivirus that can defend against famous trojans, malwares, and rootkits. 

Awareness Sessions 

If you are a manager you should make sure that awareness sessions will be held constantly to show the great importance of remote work cybersecurity and make sure your employees are performing the guidelines to keep your organization safe from potential risks.

Backups

Backups are a double-edged sword. Although it is very important to have backups to store your important data in case you lose access to it for whatever reason, it is kind of dangerous because whoever has access to it will have access to all your sensitive data. So it must have strong credentials to access and not be accessible by anyone. We really recommend having an external hard drive or cloud storage to keep your data safe.

Common Remote Work Cybersecurity Threats 

All the precautions we have discussed so far are really important, however, no one can fully guarantee 100% that you will be safe if you apply them because threats factors are countless. So having a good picture of threats will help you figure out the logical and appropriate procedures to make when you are standing in front of potential threats. 

 

Before digging into types of work from home cybersecurity threats, we should know what can be the sources of these threats so we can avoid them as much as we can.

Sources of Cybersecurity Threats 

Hackers: 

Usually, hackers are moving around scanning networks and see if there are vulnerabilities in a computer system or a network and then exploit them to gain access. They do it for several purposes: financial gain, revenge, stalking, personal gain, etc. Hackers can also do this for the purpose of bragging in the hacker community. 

Criminal Groups:

They are usually targeting a large number of people, not an individual, they use some techniques like phishing, spyware, malware, or ransomware for the goal of financial gain. They can be considered organized hackers.

Corporate Spies:

Corporate spies' goal is to make a profit by leaking sensitive information about a company or causing damage for the benefit of a competitor. The main difference between spies and insiders is that spies are an outside threat.

Malicious Insiders:

Hiring a new employee remotely and giving him a lot of access is not really a wise decision. Insiders can be employees, vendors, or any business partner who have legitimate access to company assets but they misuse that access to steal or leak information for financial or personal profit.

Hacktivists:

Hacktivists do their activities for political reasons mainly and not for financial gain. They target companies, organizations, or individuals who don’t get along with their political thoughts and agenda. Their purpose is to gain visibility for a cause they are promoting.

Terrorist Groups:

Terrorists launch the cyber-attacks to destroy and exploit systems, networks, and infrastructures without any negotiation, they just do it. They can also cause harm for an individual if they have the chance. Their main goal is to destroy, disrupt the economy and spread fear. 

 

Now, as we have a good understanding of what are the possible threats' sources for remote work cyber security, we can discuss the most common threats.

Most Common Types of Cyber Threats 

Phishing

Cybercriminals usually start large phishing campaigns that seem to be from a legitimate company with a generous offer or a one-time chance which tricks some users to click the malicious links in the email leading to installing malware or sending some sensitive information like passwords to a remote server.

Man in the Middle Attack (MITM)

This threat is very important to be aware of, a man-in-the-middle attack is when an attacker positions himself between a user and the resource the user is interacting with (ex: website). He could see the credentials and other passwords. His goal is to eavesdrop seeking credentials or to impersonate one of the parties. They can also filter and steal sensitive data and return different responses to the user to make it look legitimate.

Trojans

As we have discussed before, we should not download software on work devices from untrusted websites as it most likely will contain a trojan virus. A trojan virus is a malicious code that can provide you with the software you are seeking, but in the background, it will steal your sensitive information. It can also install a rootkit to have a backdoor in your system. It can also be designed for a specific purpose and it will be executed because you allowed this untrusted source software to be on your system.

Ransomwares

It has been very common in recent years to see people talking about their systems having ransomware, even large companies have suffered from it, check here. Their source is usually the same as trojans downloading software from untrusted websites. However, it won’t give you the software you are seeking, it will encrypt all your data and leave a note telling you to send money for the attackers to give you the decrypt key. The reason behind this ransomware is that it has a lot of families so the key is not the same and the encryption method itself is different from one family to another so it is not possible to get your files back without this decryption key. The best mitigation for this type is to avoid it. You can also check here for more tips.

Social Engineering

Social engineering is the act of manipulating a person to take an action that may or may not be in the target’s best interest. The attacker’s goal will be to extract sensitive information from you unintentionally. This type of attack is dangerous as you may not know you have been a  victim of a social engineering attack. The best mitigation is to be cautious not to continue any conversation its main topic around your work or company, there are some scenarios where the attacker doesn’t have to meet you in person and can achieve his call from a phone call, the mitigation for this is to end the phone call if you feel uncomfortable, especially if it is from an unknown number which is the most likely case in this scenario.

IoT Attacks

Nowadays, we can see in some houses IoT (Internet of Things) new devices have been installed to make their life easier. It is a great thing and revolutionary but some of them have vulnerabilities and public exploits which can be a clear way for an adversary to access your network and control your devices. So it is important to make sure all your smart devices at home are not outdated.

Password Attacks

We have mentioned earlier the importance of choosing strong passwords as mitigation of this threat factor.  Weak passwords can allow adversaries to connect to your network, access your accounts and this can cause a lot of harm under your name. 

Distributed Denial of Service Attack

A denial of service (DoS) is a type of cyber attack that floods a computer or network so it can’t respond to requests. A distributed DoS (DDoS) does the same thing, but the attack comes from more than one source from different geographic locations so it will be much more powerful and hard to trace. The source of this attack is other computers called botnets (also known as zombies) attackers use them to perform this kind of attack. A computer can be a botnet by variant methods like a virus, malware, the trojan is installed without the owner's knowledge. This threat mainly affects the company's servers available online.

Work From Home Cybersecurity Risks 

As we have discussed common remote work cybersecurity threats, we can move to talk briefly about what can be the risks of working from home.

File Sharing 

In a remote work environment, there will usually be shared folders to send documents and files to each other. if the permissions of these files are not set probably that may make it accessible through the internet. Also, if there is an adversary in your network he can intercept the traffic and may have access to see the content. 

Ransomwares 

We have mentioned Ransomwares as a cybersecurity threat. we can also point to it as a risk. Ransomwares have spread widely in the recent two years taking advantage of how data has become important for everybody.

Phishing Campaigns 

As you are working for your company from home you are a perfect candidate to be targeted by criminal groups. Your inbox and spam could have a lot of unknown source mails waiting for you to open. Just do not do that and we have discussed the consequences of that.

Passwords 

If a malicious person has your access passwords to your company, email, account, and others this will be very bad. Make sure your passwords are not easily guessable or your passwords weren't in a data breach before you can check that with "Have I Been Pwned". If it is not there that doesn’t guarantee you are on the safe side. We have discussed strong password thoughts before. Moreover, make sure you don’t write down your passwords on some paper and leave it somewhere in your office. You don’t really know whose hands can hold this paper.

DDoS (Distributed Denial of Service) 

If your company servers are under a DDoS attack then nobody can access your assets or make use of your services. This can cause harm to servers themselves and the reputation of the company. There are many modern solutions to mitigate DDoS attacks like WAF (Web Application Firewall) and other smart solutions to detect it and protect your assets. You may need to consider one of these if you don’t have one. 

Zero-Day Exploits 

Zero-Day means a vulnerability discovered recently that attackers can use to attack systems and it has no fix yet. These kinds of risks don’t have a direct solution but we can make sure we are using updated softwares, use only the essential softwares on our devices, and your antivirus firewalls are enabled according to Kaspersky tips.

Employees 

If you are a manager make sure your employees are focused and not tired. Remote working is more exhausting than being at your office. There is this human resources study that declares 1 in 4 employees rarely get enough sleep to feel rested after a remote workday. Over 2 of 5 employees are not satisfied with work-family balance during covid-19. In the end, tired employees can make some mistakes unintentionally which can cost the company a lot.

Work From Home Cybersecurity Best Practices & Tips

There are some softwares we all are most likely using daily in our remote work. We will discuss some helpful softwares which you can utilize. 

Zoom 

Zoom has been the most commonly used software for meetings, and why not and it has great video quality and a user-friendly interface. It also uses low bandwidth which means it will consume less data than a video call through other applications.

Slack 

Slack is one of the efficient softwares to manage work areas. It contains numerous channels, various integration, direct messaging, and the attachment of files and documents.

Google Drive

It is the most common way to share files between colleagues. However, make sure your files' permissions are assigned properly.

Trello 

It is considered one of the best great project management tools. All of Trello's works appear on boards which are further divided into lists. All tasks can be listed on cards that are on the list and categorized like pending, need reviewing, completed or any customized status you need. 

Google Docs

It has a lot of useful features that can make editing and driving articles easier like the auto corrector, code blocks, edit history, comments section, and other features that make life easier when it comes to teamwork projects.

 

In the end, we can drive brief tips which you can use to avoid threats during working from home:

• Secure your home network.

• Use strong passwords.

• Connect to your company’s network through a VPN.

• Invest in Backup storage (cloud, hard drive).

• Keep your work-life balance.

• Use separate devices for work and others for personal usage.

• Do not open emails from untrusted sources.

• Do not download softwares from untrusted websites.

• Use your company’s tool kit.

• Make available updates and patches for your systems and softwares.

• Turn on two-factor authentication on your accounts.

• Utilizing softwares can make your life easier while working from home.

• Secure your home router.

• Have a healthy life routine that can make you think clearly and unstressed.

Want to learn more? Discover related articles.