Expert reveals the worst security mistakes in remote working

Statistics on remote workers reveal that over 4.7 million people in the United States spend at least half of their working time remote, with more than one in five Americans set to work remotely by 2025.1,2 Not surprisingly, 20% of organizations surveyed have reported experiencing a data breach due to a remote worker since 2023.

RELATED: Is remote working a quick fix or something for the long term?

With this in mind, experts at Kiteworks, a company that unifies, tracks, controls, and secures sensitive content communications with a Private Content Network, have highlighted remote work cybersecurity risks and how organizations can ensure data security and compliance when employees work remotely.

The Worst Data Security Practices When Working Remotely:

1. Over-reliance on VPN’s

Tim Freestone, Chief Strategy and Marketing Officer at Kiteworks, comments: “While using a reputable and up-to-date corporate Virtual Private Network (VPN) is generally an effective way to enhance network security for remote workers, over-reliance on VPNs can actually elevate the risk of security breaches. A VPN should be just one component of a comprehensive, multi-layered security strategy.

Relying solely on a VPN overlooks other vulnerabilities, such as weak passwords. It is essential to prevent employees from developing a false sense of security when using a VPN and to ensure they follow additional best practices, such as using strong, unique passwords, enabling multi-factor authentication, and regularly updating software and security protocols critical to protecting your organization.”

2. Insecure Networks and Communication Channels 

“Organizations with remote employees that rely on insecure networks and communication channels, such as SMS or emails over a public Wi-Fi network, are at increased risk of cyber threats. Implementing security measures to protect your communication and data sharing is essential in a remote work environment.

Using end-to-end encryption, password protected WiFi networks, and secure file sharing solutions can significantly protect your organization from online threats. Equally key is highlighting to employees the importance of maintaining a clear boundary between personal and work communication to prevent accidental data leaks.”

3. Inadequate Data Access Controls

“Granting excessive permissions to remote employees or third parties can lead to unnecessary data access, increasing the risk of data breaches within your organization. For organizations with remote workers, it is vital to regularly track and audit access policies to detect any unauthorized activities. Access to content like financial information, customer records, and personnel files should be strictly limited to authorized users based on their current roles and promptly updated when access is no longer required.”

ADVERTISEMENT

4. Physical Security 

“Neglecting the risk of physical security threats with remote employees increases the risk of stolen equipment, which can lead to a data breach. Employees that work in public spaces, such as coffee shops or airport lounges, are particularly vulnerable to leaving devices unattended, exposing organizations to the loss of sensitive data, including personally identifiable information (PII).

Failure to encrypt hard drives and other storage devices further exacerbates this risk, as stolen devices can be easily accessed, exposing sensitive information stored to unauthorized access. To mitigate these threats, organizations should implement strict guidelines for remote work, including mandatory encryption of all devices like laptops, mobile phones, and tablet computers.”

5. Device Sharing with Friends and Family

“Using unprotected personal devices while working remotely presents a significant risk, particularly when these devices are shared with friends and family, as this can lead to the accidental exposure of sensitive data or the introduction of malware.

Allowing friends and family members to use a work device could also constitute a compliance violation of data protection regulations that your organization must adhere to. Whenever possible, employees should avoid sharing their work devices with others.”

What are the security risks linked to remote work?

When employees work outside the office, there is limited oversight of how they handle data, increasing the risk of improper data handling or inadvertent exposure to others. Remote work environments also present greater opportunities for family members, visitors, or even strangers in public spaces shoulder-surfing and viewing sensitive data on a computer screen.

Expanded attack surfaces pose a significant cybersecurity risk for organizations when employees work remotely. Remote work increases the attack surfaces for organizations beyond the corporate network. Employees’ home networks and personal devices each serve as potential entry points for cybercriminals seeking to launch cyberattacks.

Kiteworks’ Freestone shares some of the most effective prevention measures organizations can implement in order to reduce these remote work risks:

1. Implement Security Controls:

   “Security controls need to be concrete and supported by clear policies and practices, which should be well communicated to staff. This includes requiring strong password policies, encouraging the use of reputable password manager software to store strong passwords and refraining from using duplicate passwords across sites.

Additionally, implementing multi-factor authentication (MFA), using encryption tools to protect sensitive data in transit and at rest, and opting for cloud-based file sharing to prevent data from being stored directly on employee devices.”

2. Strengthen Corporate Data Security Protection Programs:

“To ensure a consistent approach to security, organizations should invest in strengthening their corporate data security and protection training programs. These programs should include annual training focused specifically on remote work security practices to better equip employees to protect sensitive company data.”

3. Invest in Strong Vulnerability Management Processes:

“Organizations should establish effective processes to identify, assess, and remediate vulnerabilities. This can be done internally or with consultants, using a risk-based approach to prioritize the highest-risk vulnerabilities like unsupported software and unrestricted access to sensitive information that could be exploited by attackers. This approach helps reduce the attack surfaces that could be exploited and provides protection for critical IT assets.

4. Run Regular Software Updates: 

“Regular software updates, including operating system updates and security patches are essential. These updates should be managed centrally by IT teams or clearly communicated as mandatory to employees. Outdated systems with unpatched security gaps are prime targets for cyber attackers. Similarly, migrate away from systems and applications that have been “EOL’d,” that a vendor no longer supports.”

5. Use Secure Wi-Fi networks:

   “Organizations should set and communicate strict policies regarding the use of public or shared Wi-Fi networks, especially when handling sensitive data. Instead, employees should be encouraged to use secure, private Wi-Fi networks whenever possible. This includes ensuring their home Wi-Fi networks are properly secured with strong, unique passwords and up-to-date encryption standards, such as WPA3.”

–

Credit: Kiteworks 

–