The hybrid workplace is here to stay. If the past couple of years have proved anything, it’s that many workers enjoy working remotely, or like the flexibility of working from home part-time.
Organizations also appreciate the benefits of a hybrid workplace; according to Gartner, 48% of employees will likely work remotely at least part of the time after COVID-19, as opposed to the 30% of employees who did so before the pandemic. A hybrid team means happier employees, lowered costs, and a wider talent pool for workplaces that want to hire permanently remote employees.
Unfortunately, hybrid workplaces also come along with security challenges; once your employees are home, far from the IT department, and out behind the sheltering firewalls of your network, the cybersecurity risks can increase. Employees may work from their own, unsecured devices, work devices may get into the hands of spouses and friends, and home wi-fi may be compromised.
So how can you manage your cybersecurity when you’ve got a hybrid team?
15 tips for managing security in a hybrid workplace
- Beware of personal devices. There are no two ways about it: personal devices are insecure. Home computers are often unpatched and not updated regularly, and bad actors know that. There is malware that specifically targets browsers and OS weaknesses that can compromise your employees and your data. If you’re not providing your workers with company devices, now is the time to do so.
- Non-employees should never use company devices. If you are providing company devices, put a policy in place that does not allow personal use of those devices. Even if it’s a trusted family member, even if they just want to charge their phone. No matter how innocuous the use, your security could be compromised if a third party uses a company device.
- Disable external drives. The USB drive is easily compromised. Criminals use them often to introduce malware to devices. Fortunately, cloud storage has made USB storage all but obsolete for most workers, so disable them and save yourself some trouble.
- Remember: devices can be physically stolen. Often, when we talk about cybersecurity, we’re talking about attackers who compromise security through technology, but devices can be stolen. Make sure your workers know not to leave their device in a place where it can be compromised and walked off with, and that they store it in a secure location when they aren’t working.
- Watch the wif-fi. Just as a personal device can be compromised, so can personal wi-fi. Be sure your team is equipped with VPNs so they can securely access your network.
- No public wi-fi, ever. We all want to work from a cafe or a beach or poolside, but working from public wi-fi is a terrible idea. Encourage the use of private hotspots and VPNs for any employees who like to roam.
- Segment your network. A remote user might be breached, but that doesn’t mean your whole network should suffer a breach. By segmenting the network, you can protect your most critical data behind a firewall, and contain attackers in a more public area of your network while you deal with them.
- Patch regularly. As soon as a patch is released, it’s important to install it; criminals know the vulnerabilities these patches are meant to correct and will gleefully exploit it if you don’t patch as soon as possible.
- Encrypt data. Sometimes, despite your best efforts, devices are stolen. Make sure all stored data is encrypted, so even if criminals get your device, they don’t also get access to all your data.
- Encrypt emails. Email is always a risk; messages can get sent to the wrong people, or bad actors can break into an account. Encrypt the data in your emails so that it doesn’t fall into the wrong hands.
- Use strong authentication. The last thing your organization wants is to be compromised by an employee with a “1234” password. Develop a password policy so that users have to use strong, unique passwords, and change them often. You might consider other forms of authentication as well, including two-factor authentication, single sign-on, or even passwordless sign-on, so you don’t need to worry about trusting passwords at all.
- Train your users. Many of the schemes criminals use to get at your data rely on tricking your users into giving up information. Phishing attacks, Vishing scams, malicious websites — all of these are counting on your employees to be the weakest link in your security. So make sure every worker has been trained to spot false messages and bad sites.
- Filter emails. Email filtering can catch some of the phishing emails sent by scammers. If your users don’t see them, they can’t click on them.
- Embrace the principle of least privilege. If a user does not need access to certain data, make sure they don’t have it. Often users have more access than they need, a state of affairs that can lead to accidentally leaked or lost data.
- Continuously monitor your security posture. By continuously monitoring your security, including all your endpoints, you can address issues as soon as they arise. Security ratings, for example, can help you see, at a glance, where the gaps in your security are. SecurityScorecard’s ratings are based on an A-F scoring scale that quickly shows you where vulnerabilities have been detected and which need to be prioritized first. Our ratings cover a variety of security factors, like endpoint security, network vulnerabilities, and patching cadence. By being able to identify your organization’s weaknesses quickly, you can keep your data — and your hybrid workers — safe from attack.
