Cybersecurity when working from home

Grant Sanders is a Partner and Practice Manager and can be contacted on 01323 644222 or gs@stepherimmer.com

Homeworking and the importance of cybersecurity risk management

Having staff working remotely has presented significant challenges for many businesses, but one of the most difficult to address is the increased cybersecurity risk. As many companies did not have sufficient opportunity to prepare for the transition to homeworking, they may not have identified potential cybersecurity issues. Moreover, it is now much harder to monitor staff and ensure they are following safe practices.

Cybercriminals have wasted no time in exploiting these weaknesses, and businesses are encountering threats regularly. Here we look at the cybersecurity risks that homeworking may present to your business and, most importantly, how you can mitigate them.

What are the most common cybersecurity risks?

Homeworking raises numerous cybersecurity risks, and it is more important than ever for businesses to recognise these. Some of the most common risks include:

Human error

Data protection is a serious concern for businesses with homeworkers. An alarmingly high number of employees who work with sensitive data do not take adequate steps to destroy documents and avoid disposing of them in outside bins, where anyone might access them.

Likewise, unwittingly downloading contaminated files or software can infect devices with dangerous malware, including viruses, spyware and ransomware, and leave data vulnerable. This is a particular risk if employees use a personal computer for work since there is a greater chance of exposure.

Phishing attacks

Phishing attacks try to trick people into downloading malware or revealing sensitive information, like passwords. Often, they take the form of emails, text messages or phone calls purporting to be from well-known organisations that their victim is likely to recognise. Without proper awareness of the risks of phishing, employees can easily fall foul of these schemes.

Targeted attacks

Whilst phishing attacks are usually mass campaigns sent in the hopes of obtaining personal information, some might target your business to steal sensitive data. These attacks are often referred to as spear phishing as they are tailored to catch your employees. For instance, workers could receive emails allegedly from the company's administration, asking them to reset their password, and even WhatsApp messages claiming to be from the CEO.

How to minimise the risks to your business

There are many simple steps that you can take to protect your business from cybersecurity risks:

Provide employees with a dedicated work laptop

Giving employees a work laptop makes it less likely that they will visit risky websites on the same device that holds their work data. Doing this also means that you can appropriate malware protection installed.  

Set up a remote access VPN (Virtual Private Network) for employees to use

 A VPN creates encrypted connections between remote computers and your company servers, ensuring privacy and security.

Educate your staff

Having a keen awareness of cybersecurity risks will help your employees guard against threats. Giving them proper guidance on how to dispose of sensitive data, create strong passwords and recognise phishing attacks. Make sure they know who to reach out to for help and encourage them to do so.

Test your backup

Check that you will be able to recover data if your business is exposed to a threat.

Conduct regular cybersecurity risk assessments

Threats are constantly evolving, and it is crucial to keep on top of them. Frequently reviewing your business's vulnerabilities will help you stay one step ahead.