9 April 2021

Exclusive article for Security Buyer, courtesy of Scott Lynn, Service Director, Agilitas. Scott Lynn, Agilitas’ Service Director, looks at how a company should assess its cybersecurity procedures in the new normal and warns that not addressing them can cause serious consequences. He also explains why it is critical to be knowledgeable about the developing workplace, including dynamic digital strategies and operational practices, and highlights why we need to reflect on past working styles to see how they can shape the very different future we now face. Home working here to stay Over the past year, millions of workers have had a crash course in what it is like to work from home. Some people have found pleasure in swapping their work desks for the kitchen table or the office for the spare bedroom, and others not so much. Some will hope to never go back, while others can’t wait to return, with many thinking working from home every now and again provides the perfect work/life balance. Whichever way you look at it, there’s no question that once this pandemic is over, the levels of home working will remain at high levels across the UK and beyond. There are a lot of benefits to businesses providing increased flexibility to their workforce. Giving employees the choice can greatly increase their fundamental happiness and motivation as they can make work fit their lifestyle and be at their most productive. However, home working also comes with one big concern for organisations. Can it be done securely? Fundamentally, the disparate nature of home working increases vulnerabilities. Put simply, there are more points of access, and therefore, more points of potential attack. When workers are spread out and isolated rather than working from the same office, both the surface of attack and the risk are increased exponentially. Organisations have less control and less oversight so, in essence, they are more vulnerable to attack. Homeworking attracting attacks In the last few months alone, some 7,000 UK email servers were reported as being potentially exposed by a security flaw in the global Microsoft Exchange email service. Malicious software was found on thousands of machines that the National Cyber Security Centre has been helping organisations to remove. Of course, email has become even more critical to businesses in these home working times and cybercriminals know this all too well. Hence phishing emails, ransomware, and spoofing attacks surging throughout the COVID-19 pandemic. Fraudsters and criminals know that security systems are only as strong as their weakest point, so if they can compromise one machine on one network, they can potentially get access to all kinds of valuable information. Why it’s so important to get security right Not paying enough attention to cybersecurity in this changing environment can be an expensive risk for any organisation. Highly valuable corporate information can be stolen in a hack and a significant amount of money can potentially be demanded in ransomware attacks. There are other costs to consider as well. When your business is taken down by a hack – it can spend days, if not weeks or months, dealing with consequences and repairing the damage, rather than focusing on its core business. On top of that, there are the potential legal consequences of mishandled data or failure to comply with standards. In many ways, despite the large ransomware demands, the biggest cost to your business from cybersecurity breaches is the impact it can have on your reputation long-term. Get cybersecurity wrong, and you risk losing the trust of your customers and industry partners. To operate successfully in 2021, you need to operate securely, no matter how widespread or isolated your workforce has become. Remote identity management So, what does working from home require from a cybersecurity standpoint? Of course, the end goals are no different from working in an office, but it can be a lot harder to achieve them. The starting point for good cybersecurity is a mechanism to ensure you can verify the identity of everyone accessing your network. That allows you to guarantee that your employees and no one else can log onto your systems remotely to access your organisation’s sensitive data. Organisations can achieve this through the use of up-to-date software and hardware that provides secure authentication. You must ensure that remote employees log into your system using methods that are reliable, strong and also easy to use. This could be through multi-factor authentication or through a combination of hardware and technology that allows for remote authentication. It’s imperative that organisations have the operations and flexible supply chain in place to provide the workforce with the hardware and software they need to work safely from home. If just one worker from home is not following protocol or is not equipped with the right tech and they become a target of a hack – they become the broken link in the chain with the whole organisation becoming compromised. It’s so important cybersecurity is taken seriously from top to bottom, with everyone adequately equipped, wherever they are. Working together while not together We now live in a virtual world. Virtual meetings, virtual documents, and virtually everything done online. Working from home has turned a simple face-to-face meeting or the sharing of a document into a scheduled Zoom or Teams call. Data security that allows for collaborative work to be securely carried out online is more important than ever. Employees need to be trained in security protocol and given software that allows them to safely collaborate with their colleagues. Fundamental to this is keeping access to files on a need to know basis, as the likelihood of potential security threats reduces when you limit access and don’t unnecessarily expose files. These principles also apply to internal collaboration, as well as when documents and files need to be shared outside your organisation. Businesses need the means to safely share their work while remaining in complete control of it. Threat response Good cybersecurity prepares businesses for worst-case scenarios. Organisations need to have an attitude