As we covered in a recent article, How to Upgrade Your Remote Work Tech Stack for Better Productivity, Performance, and Security, remote and hybrid work models remain prevalent and popular around the world. For example, 52% of remote-capable jobs in the US have hybrid schedules, and 83% of employees prefer this model of work.1 The advantages of remote or hybrid work are obvious from the employee’s perspective, but for employers, it provides a powerful and relatively inexpensive incentive that can help attract and retain top talent.
But as we also cover in the article above, remote and hybrid work create unique cybersecurity risks. From poorly-secured home networks to public Wi-Fi connections, and insecure personal devices to delayed security patches, remote and hybrid teams need extra support to overcome these challenges. In this article, we’ll cover the seven best practices for organizations to protect their data and employees, regardless of where and how they like to work.
While most people understand that public Wi-Fi networks are inherently risky, 63% of those surveyed admitted to using public Wi-Fi networks for work-related tasks.2
What are the risks?
• Man-in-the-Middle attacks: Hackers intercept communications between the user’s device and the destination website
• Evil Twin hotspots: Malicious networks mimic legitimate Wi-Fi names to eavesdrop, steal credentials, spread malicious code, and redirect to phishing sites.
• Session hijacking: Cybercriminals steal login credentials by capturing unencrypted data packets.
Here’s How to Help:
Training is the first step. Let all of your employees—not just your distributed workers—know about the dangers of public Wi-Fi networks, and be clear that it’s against company policies to ever use them for work purposes and with work devices.
The second is setting up business-grade Virtual Private Networks (VPNs) for your employees to use. Business VPNs focus on secure access to company resources over personal privacy, offer centralized management, and feature far more powerful encryption and other protections. While the setup for a business VPN can be complex depending on existing infrastructure, cloud-based VPNs are an alternative with easier setup.
While most people are focused on high-tech modes of hacking, low-tech methods can be effective, especially in public areas like cafes, airports, and trains where professionals are often focused and in a hurry.
What are the risks?
• Shoulder surfing (or visual hacking): Where bad actors attempt to surreptitiously view credentials and other sensitive information.
Here’s How to Help:
Train employees to understand that physical security needs to be practiced alongside digital security. Choosing seating and obscured screen positions can be surprisingly effective, and low-cost tools like privacy screen protectors can limit the viewing angles of potential eavesdroppers. Lastly, simple digital tools like automatic screen locks can add an extra layer of protection.
While organizations with distributed workers have far greater needs to securely send and receive data, every organization today needs to send digital information beyond its own walls. Encryption turns readable data into encoded text that requires a decryption key. Security patches fix vulnerabilities in encryption and related devices that hackers can exploit.
What are the risks?
• Data in transit: When data is sent between devices, it can be intercepted.
• Data at rest: When data is stored on an external device, it can be compromised if the device is stolen or hacked.
Here’s How to Help:
Even if intercepted, properly encrypted data cannot be readily used by cybercriminals. By implementing detailed encryption—AES-256 encryption standards for stored data and TLS/HTTPS protocols for data in transit—you can ensure data integrity and security from both ends.3 Additionally, opting for communication tools with end-to-end encryption adds an additional layer of protection. All devices should be set to automatically update security settings and features, especially for operating systems, applications, and antivirus programs.
Due to convenience or to reduce expenses, many organizations—particularly smaller businesses—have “Bring Your Own Device” (BYOD) policies that enable employees to use their personal devices for work purposes. The idea is that the organization owns the corporate data and resources accessed on these personal devices. But the reality is that these devices can compromise an entire organization.
What are the risks?
• Decentralized security management: Organizations have no control over the security of personally owned devices, leaving them at the mercy of each employee’s personal judgement.
• Data leakage risks: By storing both personal and business data, as well being used for both personal and business reasons, personal devices essentially double the risk of data leakage.
• Lost or stolen devices: Become immediate data breach risks.
Here’s How to Help:
The best way to avoid these risks is to supply company-managed devices for work functions and formally ban the use of personal devices for work applications. If BYOD can’t be avoided for mobile devices, consider a Mobile Device Management (MDM) solution. These software platforms enable organizations to configure, manage and secure personal devices that access company resources.4
Believe it or not, it’s estimated that 60% to 80% of business communications are unencrypted.5 Many leading communication platforms like Microsoft Teams, Slack, and Google Workspace encrypt data in transit but decrypt it on their servers, which makes the information available to providers and offers the possibility of access to cybercriminals.
What are the risks?
• Data Interception: Data sent between servers, applications, and users can be intercepted by hackers.
• Compliance Violations: Many industries, including healthcare, finance, payment processing, and countries require encryption for sensitive data.
Here’s How to Help:
Consider your organization’s needs, regulatory requirements and size, and choose from email services, third-party tools, or custom solutions that best fulfill your needs. For example, S/MIME (Secure/Multipurpose Internet Mail Extensions) offers end-to-end encryption, ensuring messages are encrypted from sender to recipient, not just during transmission. While S/MIME is built into many leading email clients, it needs to be enabled and properly configured. Alternatively, you could consider specialized email encryption platforms for more robust encryption. Some platforms, like ProtonMail, replace email clients entirely, and some, like ZixMail, work as an extension to existing email infrastructure.
Password security is the first and arguably most important defense against cybercriminals. In spite of the fact that most people understand the importance of strong passwords, many people will choose weak passwords if left to their own devices. In fact, 81% of corporate data breaches resulted from poor password management.6
What are the risks?
• Brute Force: These attacks use automated tools to enter numerous character combinations until a working password is reached. There are many types, including dictionary attacks, which use common words and pairings, credential stuffing, which uses leaked credentials, and password spraying, which tests common passwords against numerous accounts.
Here’s How to Help:
Educate employees of the need to choose unique passwords with a minimum of 12 characters that include uppercase, lowercase, numbers, and symbols. Ensure all potential applications have these requirements for passwords whenever possible. Multi-factor authentication (MFA) adds an additional layer of protection should a password become compromised. SMS/email codes are the most common and convenient, but they are also the weakest. Consider authenticator apps with time-based codes for a balance of security and convenience.
Traditional cybersecurity relies on a “trust but verify” model, whereas a network treats anyone with valid credentials as a trusted user.7 This means that hackers can potentially explore and exploit many assets and applications even with limited credentials.
What are the risks?
• Social engineering: Where a bad actor gains access from employees by pretending to be a trusted vendor or colleague.
• Phishing: This is a common method for stealing credentials; in a trust but verify model, a single set of credentials can potentially lead to complete infiltration.
• Cross-Site Request Forgery (CSRF): CSRF attacks exploit applications that do not require redundant verifications.
Here’s How to Help:
A zero-trust security model is a framework—meaning it isn’t a single solution or platform, but rather it’s an overarching approach that combines many of the preceding best practices and builds upon them over time. Zero-trust should follow a phased implementation plan that starts with strong identity management with MFA. Next steps would be limiting privilege access and introducing network zone microsegmentation. The last general step would be an AI-driven tool for continuous monitoring and automated response.
Cybersecurity and cybercrime are continuously evolving. For businesses and professionals focused on security, the consequences of falling behind can be devastating. Given the diverse risks from unsecured networks, personal devices, evolving attack methods, and the behavior of individual employees, cybersecurity for distributed and hybrid teams is an even greater challenge. At IPC Tech, we have a division devoted to Cybersecurity Solutions. We can help protect your workforce—wherever they work—with solutions that are tailored to your needs, now and into the future.