Why Cybersecurity Should Be a Part of Your Employee Return-to-Work Plan
With vaccination rates continuing to grow and national COVID-19 infection rates gradually declining, many businesses have resumed on-site operations. Others have announced permanent hybrid operations and have established return-to-work dates for staff. As workers return to the office, companies must take the appropriate measures to protect their employees and organization in this new environment.
While enhanced sanitation and other health-related strategies are important, businesses must also contend with even more online threats than ever before. Remorse and hybrid-remote work have opened up a new set of cybersecurity vulnerabilities and exposed many longstanding ones. As employers scrambled to prepare for the shift to remote work, many did not take the proper precautions to secure their network. In some cases, employees worked and continue to work using personal devices. Other employers have not established secure remote access points through which employees working from home can access the corporate network.
Addressing the growing threat
Cybercriminals have been taking advantage. Between 2019 and 2020, there was a 69 percent increase in the number of reported cybercrimes, with phishing, ransomware, and other cyber attacks costing companies billions. Not only are these crimes growing in quantity, but they’re also growing in sophistication. Emboldened by early successes and tools available on the dark web, cybercriminals target corporations and organizations of all sizes and industries. From small businesses to political parties, no organization is safe from being targeted.
Now, businesses must address the new network insecurities from remote work and old vulnerabilities that have taken center stage. For example, hackers were able to infiltrate Colonial Pipeline recently through a spearphishing effort, highlighting the gaps in employee cybersecurity awareness businesses have long faced. Small and midsize businesses (SMBs) have long struggled to dedicate the cybersecurity resources needed to safeguard their business. Still, as attacks continue to escalate, they can no longer avoid doing so.
The cybersecurity steps employers must take
As employees return to work, employers must take certain steps to mitigate the risk of or damage from a future cyberattack. Part of the return to work transition plan should include clear cybersecurity protocols and training, especially if the workforce will continue to spend part of the time at home. Employees must understand what management’s cybersecurity expectations are at work and home and how to identify and respond to potential threats. Cybersecurity awareness training should be interactive, consistent, and current, with knowledge checks and practice exercises to aid employee retention. A good cyberawareness curriculum can be a win-win, as educated employees can also secure their personal devices from hacking as well.
Employers must also collect company-owned devices from remote workers who are returning to the office permanently. Loose devices unsecured in employee homes are a liability, so IT departments and administrative staff must ensure all outstanding devices are returned to headquarters. And if employees were abruptly separated during this period, it’s critical to reclaim their devices, if not done so on their last day.
It’s also important for employers to ensure that no sensitive data is floating around on employee-owned devices. Employees often download business information to work from home, whether doing so is permissible or not. Employees who’ve been using their own devices throughout the pandemic may have dozens or even hundreds of files stored locally on their personal laptop, device, or cell. If these devices are stolen or compromised, then their employer could be at risk. IT departments and managers should work with employees to explain the risks, walk them through using the virtual desktop option you may have available, and have them delete any locally stored files from their devices.
Dealing with insider risk
Many workers have suffered financial hardship throughout the pandemic due to reduced hours, layoffs, and rising expenses. Ongoing financial stress may make some employees more likely to steal company assets. Further, the ongoing mental health strain employees have faced may make some employees more likely to act in ways that compromise the company. For example, rather than constructively coping with work-related stress, a distressed employee may decide to leak sensitive information to the media or online.
Employers must be prepared to recognize the signs of employees under strain and connect employees with the mental health resources they need. Businesses must cultivate an organizational culture that encourages employees to come forward with their concerns before those concerns manifest in bad behavior that can compromise the company. But employers should also mitigate insider threat risk by vetting prospective employees very carefully and making all employees aware of the employer’s code of conduct and the consequences for violating them. Employers should also consider investing in insider risk management technology, which can help them identify suspicious employee activity and protect them from fraud attempts from vendors and other stakeholders.
Dedicating resources
Even though their IT departments have many competing priorities, businesses can no longer afford to sit and wait until suspicious network activity is confirmed as an infiltration attempt or attack. IT personnel must proactively monitor the web and dark web to ensure that sensitive information has not been stolen. They also must keep abreast of threat actors and new schemes to harvest credentials, infiltrate business IT networks, and commit other online crimes. Once a criminal has accessed the network, it’s too late to do anything other than mitigate the damage. But by staying on top of emerging cybersecurity developments can help a business prevent such criminal efforts from being successful.
However, many businesses lack the necessary cybersecurity expertise among in-house staff and have budget constraints that prevent them from bringing on experienced cybersecurity full-time. Managed security service providers can help, bringing dedicated cybersecurity professionals and resources to help business IT teams assess vulnerabilities, remediate weaknesses, and proactively search for threats. As employees return to work, corporations large and small must take advantage of this resource to prevent cybercriminals from exploiting this transition period.
If you’re located in the Cincinnati area and are concerned about your cybersecurity readiness, 4BIS.COM can help. We’ll work with you to create a digital shield around your business and help you respond quickly as soon as threats are detected. Working with Cincinnati companies since 1996, our experienced team is ready to help you build the right kind of cybersecurity plan for your unique business. Contact us today, and let’s get started.
