Government, businesses and other organisations across South Africa, Kenya, Nigeria and Ethiopia are increasingly encouraging work-from-home strategies in a bid to slow the spread of COVID-19/Coronavirus. While the measure is undoubtedly effective in flattening the curve of Coronavirus increase, there are cyber risks to consider in relation to this change. Kaspersky experts share their insights and advice on the process of transferring to the remote workplace.
Transferring employees to work outside the office is a process that is usually treated with thorough preparation, as once devices are taken outside of an organisation’s network infrastructure and are connected to new networks and Wi-Fi, the risks to the organisation’s data, information and assets increase. During the emergency switch of large groups of people from work at an office to home-based activities, appropriate security preparations should still receive urgent and thoughtful attention.
“Many companies have already adopted a practice of regularly allowing their employees to work remotely or from home. The results have been quite positive and a home-based employee does not portray any risks if the approach to their cybersecurity is comprehensive. However, there are two major potential risks to the corporate networks related to the home office that should not be negated, including employees’ usage of unprotected devices when connecting to the corporate network, and connection via unsecure Wi-Fi and 4G/5G networks, especially for those who work from personal devices,” says Maher Yamout, a security researcher at Kaspersky.
Kaspersky research teams noted that the best practice would be to use a corporate device, instead of a personal one. They add that the biggest mistake a number of organisations make is to consider an employee device insignificant and ignore the fact that it might be the entry point of a cyberattack.
Continues Yamout: “A year ago, we have assessed the cases of cyber incidents and found that a third of them started from employees’ devices. In 34% of cases, it was either a download of a malicious file from an e-mail or a malicious website. So the more potentially contaminated or unprotected machines are connected to the corporate network, the larger the potential risk of infection. A vast majority of threats we see are not targeted, but come from mass-campaigns that rely on human errors or holes in un-updated software, which means that they are not unpredictable and can surely be prevented”.
The researchers recommend employers follow these basic precautions to minimise security risks to their networks:
- Provide a VPN for all staff to connect securely to the corporate network; ideally to tunnel all the network traffic
- All corporate devices – including mobiles and laptops – should be protected with appropriate security software, including mobile devices (e.g. allowing data to be wiped from devices that are reported lost or stolen, segregating personal and work data, along with restricting which apps can be installed)
- Make sure you have implemented the latest updates to operating systems and apps
- Restrict the access rights of people connecting to the corporate network based on the need-to-know and least privilege principles
- It is necessary to remind coworkers about basic cybersecurity rules: do not follow links in emails from strangers or unknown sources, use strong passwords, etc. Ensure that staff are aware of the dangers of responding to unsolicited messages. Also, it is essential to agree on rules of work: whether all questions are asked in protected chats and conference calls are made via secured channels.
To learn more about securing a remote workplace read the article on Kaspersky Daily blog post or watch Kaspersky webinar.
Provided by Kaspersky South Africa
