Coronavirus has brought remote working to the top of everyone’s mind. With many organisations already enabling or exploring remote working, here are 11 tips from Sophos to help your users, and your company, stay secure while protecting everyone’s physical health.
By Sally Adam
1. Make it easy for users to get started. Remote users may need to set up devices and connect to important services (Mail, Internal Services, SalesForce, etc.) without physically handing them over to the IT department. Look for products (security and otherwise) that offer a Self Service Portal (SSP) that allows users to do things themselves.
2. Ensure devices and systems are fully protected. Go back to basics – ensure all devices, operating systems and software applications are up to date with the latest patches and versions. All too often malware breaches an organization’s defenses via a rogue unpatched or unprotected device.
3. Encrypt devices wherever possible. When people are out of the office there is often a greater risk of lost or stolen devices; for example, phones left in cafes, laptops stolen from cars. Most devices include native encryption tools such as BitLocker – be sure to use them.
4. Create a secure connection back to the office. Using a Virtual Private Network (VPN) ensures that all the data transferred between the home user and the office network is encrypted and protected in transit. Plus, it makes it easier for employees to do their jobs.
5. Scan and secure email and establish healthy practice. Home working will likely lead to a big increase in email as people can no longer speak to colleagues in person. The crooks are wise to this and already using the coronavirus in phishing emails as a way to entice users to click on malicious links. Ensure your email protection is up-to-date and raise awareness of phishing.
6. Enable web filtering. Applying web filtering rules on devices will ensure that users can only access content appropriate for ‘work’ while protecting them from malicious websites.
7. Enable use of cloud storage for files and data. Cloud storage enables people to still access their data if their device fails while working remotely. Don’t leave files and data in the cloud unprotected and accessible by anyone. At the very least, employees must successfully authenticate. Multi factor authentication takes that a step further.
8. Manage use of removable storage and other peripherals. Working from home may increase the chance of people connecting insecure devices to their work computer – to copy data from a USB stick, or to charge another device. Considering that 14% of cyberthreats get in via USBs/external devices*, it’s a good idea to enable device control within your endpoint protection to manage this risk.
9. Control mobile devices. Mobile devices are susceptible to loss and theft. You need to be able to lock or wipe them should this happen. Implement application installation restrictions and a Unified Endpoint Management solution to manage and protect mobile devices.
10. Make sure people have a way to report security issues. With home working people can’t walk over to the IT team if they have an issue. Give people a quick and easy way to report security issues, such as an easy-to-remember email address.
11. Make sure you know about “Shadow IT” solutions. With large numbers of people working from home, Shadow IT – where non-IT staff find their own ways of solving issues – will likely increase. Sophos recently discovered ‘public’ Trello boards containing names, emails, dates of birth, ID numbers, and bank account information. Ensure users report use of such tools.
Cybercrime is quickly becoming the number one threat to small to medium sized businesses and we are investing and working hard to ensure we are well placed to provide services to all our customers for the protection of their networks and data. We are therefore pleased to announce that Nick Theodoridis, Support Engineer at Conformedia has completed and passed his Certified Sophos Central Architect course.
The course focuses on Sophos Central Endpoint protection for server, workstation and cloud resources from Microsoft Azure, Amazon AWS and their integration into the Sophos Synchronised Security concept. User protection, directory integration, anti-virus and anti-malware protection.
Nick is keen to put into practise his new learning. “Protecting clients from malware and ransom attacks is a priority for us. It’s much better to establish great security than to deal with the fallout from an attack and therefore we fastidious about applying antivirus and updates and procedures.”
Nick’s qualification complements Cameron Christie-Smith’s recent Sophos Certified Architect qualification which concentrates on business perimeter protection.
Conformedia has been awarded Sophos Synchronised Security Partner status. This is in recognition of the training that the team has recently completed in business IT software and security.
David Rayner, managing director at Conformedia, explains the advantages of synchronised security. “Cyber-attacks are becoming increasingly sophisticated and much more frequent. We understand the risks that this bring to our clients and have invested in training throughout our service department, resulting in Sophos Synchronised Security Partner accreditation and ensuring we are best placed to deal with these threats.
Partnering with leading security business Sophos means we can provide our clients with a solution that offers maximum protection for their business.”
Synchronised Security is a solution that links all individual security elements throughout the network, each working together. Each responding automatically and full depth of coverage and managed through a single web console.
Each product shares information and works together when a threat is detected. Problems are automatically identified and dealt with in a fraction of the time of more traditional methods.
David continues, “It’s absolutely essential that businesses make cybersecurity, prevention and security best practises central to their activity otherwise they are vulnerable to hacking and data breaches. If you are unsure about your current security status, I would strongly advise that you review your security measures and prioritise remedial work”.
