Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


10:00 AM
Connect Directly
E-Mail vvv

7 Ways to Reduce Cyber Threats From Remote Workers

The pandemic's decline won't stop the work-from-home trend nor the implications for cybersecurity, so it's crucial to minimize the threats.

With the arrival of COVID-19 vaccines, we are (hopefully) nearing the end of the pandemic's crisis. However, its effects will long outlast its year-long reign.  The increase in the number of employees who choose to work from home (WFH) at least part of the time is among the likely permanent changes brought by COVID-19.

Many employees like the idea of WFH and, often, employers do as well. A Gartner survey shows that approximately three-quarters of employers intend to permanently implement remote work, even after the green light is given on returning to the office post-COVID. 

Related Content:

Prioritizing Application & API Security After the COVID Cloud Rush

Special Report: Building an Effective Cybersecurity Incident Response Team

New From The Edge: Cartoon Caption Winner: In Hot Water

This hybrid work model comes with advantages and disadvantages — and among the disadvantages is a sharp rise in the number of cyber threats and vulnerabilities. When employees connect to organizational servers, databases, and intranets via the Internet, they are really working at a remote endpoint of the corporate office. But unlike in office-based environments, they are not as diligently protected.

Therefore, CISOs need to view home-based devices as integral parts of IT and mandate that the devices, as well as the people using them, undergo the same level of security as they would when operating from the office. Like any other maturity improvement program, organizations must grapple with the challenges posed by their people (employees, third-party vendors, and so on), processes, and technology and implement the necessary security measures to protect them.

7 Ways to Secure WFH Employees:

  • Offer periodic awareness training: To avoid breaches, employers need to implement employee training courses with a focus on the latest threat scenarios. Management, operations, and R&D are all prime targets of social engineering, phishing, and scamming campaigns (among other threats). Employees need to be aware of the threats they face to take the necessary measures to protect themselves, their devices, and sensitive company information. 

  • Share lessons learned: Companies should implement periodic reviews of employees' and executives' experiences in dealing with phishing and other social engineering tactics. Listening to colleagues' experiences and "lessons learned" helps all personnel better identify and protect themselves from threats. As a result of these lessons, management should establish clear policies and procedures — with clear owners and defined responsibilities — to ensure home office security.

  • Harden endpoint devices: Before allowing employees to connect to the office remotely, organizations need to guide them on enforcing all related company policies and procedures with the updated threat landscape, including laptops and routers connecting from home offices and mobile devices.

  • Enforce home-based VPN connections: Given that home networks are generally easier to breach than office networks, organizations need to enforce employees' use of VPN connections when working remotely. VPNs encrypt and protect data, ensuring that the connection remains private and secure. 

  • Implement multifactor authentication (MFA): Single-factor authentication is associated with the vast majority of compromised user accounts. In fact, implementing MFA could prevent up to 99.9% of such attacks. While results may vary for different companies, there's no question that MFA — requiring two or even three levels of authentication for more sensitive assets — would greatly reduce an organization's vulnerability.

  • Separate the security organization: In many companies, cybersecurity is an IT department's responsibility and competes for attention with other IT issues. Companies should establish a security operations center (SOC) that is dedicated specifically to cyber defense and can monitor events, update security controls, and defend against attacks more effectively. The SOC can also monitor threats, scan the Dark Web for data breaches, and better protect company and employee information.

  • Establish an intelligent perimeter defense: Organizations need to take a thorough inventory of their assets, vulnerabilities, and methods of defense. IT is spread across servers, cloud installations, and now home endpoints. Organizations need to inventory these connections to locate the weak points and defend against potential threats by implementing security measures that mandate that only certain organizational assets can be accessed outside the office.

The last year has changed our lives for the foreseeable future — from our personal lives to our professional lives and how we work and conduct business. By taking necessary security precautions, organizations can ensure that employees' IT activities are as secure at home as they are when working from the office.

Reuven is a cybersecurity entrepreneur and a national cybersecurity expert. As a founding team member of the Israeli army's Red Team (Section 21) and Incident Response Team, Reuven is extremely passionate and knowledgeable in all things cybersecurity. His expertise is in ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Cyberattacks Are Tailored to Employees ... Why Isn't Security Training?
Tim Sadler, CEO and co-founder of Tessian,  6/17/2021
7 Powerful Cybersecurity Skills the Energy Sector Needs Most
Pam Baker, Contributing Writer,  6/22/2021
Microsoft Disrupts Large-Scale BEC Campaign Across Web Services
Kelly Sheridan, Staff Editor, Dark Reading,  6/15/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-06-23
Contao 4.5.x through 4.9.x before 4.9.16, and 4.10.x through 4.11.x before 4.11.5, allows XSS. It is possible to inject code into the tl_log table that will be executed in the browser when the system log is called in the back end.
PUBLISHED: 2021-06-23
Use after free vulnerability in file transfer protocol component in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via unspecified vectors.
PUBLISHED: 2021-06-23
Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in Security Advisor report management component in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to read arbitrary files via unspecified vectors.
PUBLISHED: 2021-06-23
Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in file sharing management component in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to read arbitrary files via unspecified vectors.
PUBLISHED: 2021-06-23
Exposure of sensitive information to an unauthorized actor vulnerability in webapi component in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to obtain sensitive information via unspecified vectors.