Dealing with risks while staying remote: stories based on real use cases
Remote work is the new reality which even the most traditional companies have to deal with. In some countries, the number of specialists who work remotely at least sometimes has grown by 159% over the past 15 years, but the current healthcare situation turned the urgent move to remote work into unavoidable escape and pursuit of financial stability.
Regardless of the reason for the transition to remote work, if a company doesn’t have the relevant experience, relocating business processes for the first time is fraught with serious risks.
Let’s pay attention to typical and hidden threats when moving to remote work, provide examples of safe work outside the office, give everyone common recommendations on detection and prevention of policy violations with the help of special instruments and illustrate our advice offering real life cases.
What can happen?
18 million phishing emails and 240 million spam messages exploiting the topic of COVID-19 were intercepted by Google daily. Remote work demands that a new kind of workflow is arranged which would differ from that established in the office. Not only social engineering or dangerous BEC attacks can become a massive problem while you are away, but many other threats may surface making your company face security issues.
Technical problems include corporate servers failure due to insufficient bandwidth — remote connections add some pressure, and systems might lag; unprotected channels for remote connection between users’ PCs and corporate systems; virus infections of corporate networks caused by an already damaged employee’s laptop.
Human factor problems emerge because of error or negligence — the quick transition to remote work can make network administrators incorrectly configure remote user rights; discipline violation, as even at the workplace, employees spend up to 30% of their time talking, drinking coffee or doing something else; corporate fraud. During a crisis, employees worry about their financial situation and some might decide on selling company secrets to competitors. According to experts, the number of such incidents gets twice as big when a company moves to remote work.
How to protect your business?
Ensure remote connection to corporate resources via a VPN channel with two-factor authentication, make sure the bandwidth of the Internet connection channels is sufficient, whether it can cope with the extra load, and establish backup communication channels.
Install protection tools (antivirus, firewall) on each laptop, make sure that the OS versions, the monitoring instruments and software needed for task implementation are updated.
Encrypt hard drives and create content backup to the corporate cloud. The company will not lose data, even if drives are removed or damaged.
Ban users from accessing a corporate laptop BIOS so they couldn’t boot the operating system from a USB flash drive.
If corporate laptops can’t be taken home, configure access to terminal servers with two-factor authentication. Like this private employees’ PCs will serve only for input and output of information — as a remote screen, keyboard and mouse.
Use innovative control solutions:
· SIEM systems for ensuring the security of corporate IT infrastructure (hardware, software, user account activity)
· DAM (database activity monitoring) solutions for data control in DBMS and business applications (control of user requests to a database, changes, deletions, downloading, unauthorised access attempts)
· DCAP (data centric audit and protection) solutions for file storages monitoring (which files are confidential, where they are stored, who has access to them and what does to them)
· DLP (data loss prevention) systems for monitoring of data transfer channels and user PC activity (accidental and intentional data leaks, corporate fraud attempts)
PLEASE NOTE: monitoring solutions should be installed on all corporate servers and PCs to which remote users will connect, as well as all corporate laptops that employees will use outside the office. So an employer will be able to get the whole picture of what is happening in the company, and be aware of any inside violations.
How does it work?
We have collected the stories of SearchInform clients that demonstrate how information security tools help control the productivity and legitimacy of remote employee activity.
Case: Performance degradation
What happened?
A senior manager complained to the superiors that it was impossible to complete all the tasks as promptly as it was required, and an assistant was needed. After an assistant was hired the results remained the same.
Investigation
The DLP system showed that since the company moved the employee to remote the efficiency has fallen, up to 4 out of 8 working hours were spent unproductively — the worker played online games and watched shows. When an assistant was hired, the employee delegated all the work, and the number of unproductive hours increased up to 6. The assistant was constantly busy in task-oriented programs: CRM, product base, office software, and processed more applications a day than needed. The management took measures: the employee was fired, the assistant officially took the senior manager’s place.
PLEASE NOTE: in modern DLP systems, security monitoring is combined with user activity control. Special modules of the system monitor the time when employees start and finish work, detect being late, turning off a laptop before the workday ends or working extra hours, count productive hours at work, and the time when an employee was passive or busy with personal issues. Systems analyse the efficacy and productivity of employees and report obvious discipline violations. A comprehensive DLP allows you to get information on your team’s progress using screenshots or viewing their screens online only when necessary in case security policy violation is detected automatically: you can see what exactly users are doing on a corporate laptop if you have doubts.
Case: Data leakage
What happened?
The DLP system identified a user who was spending a few hours on a suspicious website.
Investigation
Thanks to the screenshots made by the specialists responsible for risk mitigation, it was easy to see what an employee was looking for. He was working from home on his private laptop and visited the website where orders for personal data were posted. The worker took one of such orders and continued to discuss the details with the customer via Skype. The DLP solution discovered that the employee explained to the customer that there would be no problems as he was working at home and there was no video surveillance. The next warning came from the DAM software — it alerted the security specialists to the export of corporate data from a database. The incident was prevented as the company connected to the employee’s laptop remotely and deleted the file with sensitive information. Access rights management controls helped to promptly deny access.
PLEASE NOTE: DLP systems collect information about user activity on websites or with software and classify the topics of these resources. You can select unwanted ones from them and configure alerts for each case when employees attempt to visit them. It is also useful to set a rule so that the system discovers users who access unwanted software and websites. This will help you track suspicious activity and provide additional evidence if corporate violations are detected.
Case: IT infrastructure failure
What happened?
SIEM alerted to an antivirus failure on the corporate file server.
Investigation
It was revealed that the antivirus couldn’t deal with the malware located in one of the PDF files in the network folder. To understand how it appeared to be there, specialists tracked down the content route using the DLP system. It turned out that the file was downloaded by the manager of one of the offices, who worked from home on a personal unprotected laptop. She explained that she received an email from authorities with new instructions on the sanitation of retail premises. The employee placed the attached file in a folder accessible to other workers. Another user opened the document and accidentally provoked a viral infection.
The problem was eliminated, the damaged documents in the corporate storage were restored using shadow copies in the DCAP solution.
PAY ATTENTION
Not only data protection solutions, but also employee training or preparatory conversation with your team save from accidental information security errors. Explain corporate security rules to them or even conduct lessons: tell them about the importance of using antiviruses, ask them to remember the official email addresses of regulators, executives, key partners and clients, and prohibit downloading email attachments created by suspicious mailers.
