It is important to never leave your smartphone unprotected without a strong pin or password. Nowadays, most phones have biometric authentication options that make this very easy to implement.

Moreover, you should make sure to enable auto-lock as people inevitably tend to leave their devices unattended. In this way, you can prevent someone from easily gaining access to various functionality or the data on your smartphone.

Anti-theft protection

For cases when your device is lost or stolen, some mobile security solutions, like ESET Endpoint Security for Android, include anti-theft capabilities to prevent information and accounts on devices from being accessed by third parties, as well as aid in location and recovery. Anti-theft protection allows you to track a device via its GPS signal in order to locate it and send messages that can be read by anyone who does find it.

It is also possible to monitor the use of SIM cards by accepting only one from a trusted list. Should a thief insert a SIM card not defined in your approved list, the mobile screen locks and an alert SMS is sent to your IT administrator.

Lastly, this feature allows you to take preventive action on a device remotely, for example, by sending SMS commands that can lock it, reset it to factory settings, or even wipe all the data stored on it.

It is highly advisable to activate the applicable types of protection on both personal and corporate mobile devices.

Storage devices

A lot of information gets transferred to and from devices, whether that’s files, certificates, or session information for your various accounts. This information is usually stored on the disks and internal memories of various devices, including laptop hard disks, smartphone memory and USB flash drives.

If a device is lost, the information stored on it is lost too, so it is important to consider the following technologies and security measures:

Encryption

Encryption is a very useful security measure for protecting data stored on a device. It consists of modifying the data according to a mathematical pattern and one or more keys, in such a way that it can be decrypted only by those who possess the keys.

When we encrypt information, we make it unreadable. If an encrypted device falls into someone else’s hands, or malware on a device exfiltrates any encrypted files, all they will be able to see is a string of meaningless characters.

Despite what people may think, using encryption tools is highly practical and easy for any user to do. We just need to know what information we want to protect and to configure the encryption tool we are using with a strong and secure password.

Encryption tools come in two basic levels:

1. Full-disk encryption solutions like ESET Full Disk Encryption that encrypt the entire hard drive of a device. This solution improves anti-theft capabilities.

2. File encryption solutions like ESET Endpoint Encryption that, in addition to encrypting hard drives, can encrypt specific documents or emails. This solution enhances privacy and helps with data compliance regulations.

Backup

While we have considered how to protect information in cases when a device gets lost or stolen, it is also important to consider how to recover any lost information so that we can carry on with our work.

For this reason, we should back up any files that would be difficult to recover if lost. This especially applies to personally authored documents, reports, research, spreadsheets, presentations and photos.

There is a wide range of backup types that can be used, so it is important for each user to assess which solution suits them best. ESET recommends Xopero Backup & Restore for businesses.

Antivirus and security solutions on computers

An employee who adopts all the measures recommended in this guide thus far has gone a long to way secure their company’s data. However, there are still risks from several vectors, including attacks by malware, phishing or malicious links in emails and social media, malicious or fake websites, and other dangers from communicating over unsecure networks.

This makes it absolutely crucial to combine all of the aforementioned precautions with a proactive threat detection system, which can be achieved by installing a comprehensive security solution on devices.

The reason we talk about a comprehensive solution, and not just about an “antivirus,” is that detecting malicious code alone is no longer enough. Comprehensive solutions include a greater variety of modules that detect other types of threats, such as unsecure connections, fake websites, malformed packets and other signs of potential risks.

In companies where corporate equipment is used to work with information remotely, this equipment is usually protected by a security solution provided and administered by the company.

However, when employees use their own devices, the same security measures remain essential. Employees need security solutions not only on each desktop or mobile device that they use to handle business information, but also need to keep them updated to prevent new threats.

With home computers, particularly those shared by various members of the household, the risk of a threat increases because it is difficult to fully control how the computer is used, the files downloaded onto it and what websites are accessed through it. Having a solution like ESET Endpoint Security, supported and developed by a trustworthy cybersecurity company with a good track record in the market, solves these problems very quickly by providing multiple layers of protection for all home users.

In part three of this series, we will discuss the precautions you should take for securing your activities on networks.

The complete Remote Worker’s Guide series:

Part 1: Risks, threats and corporate policy

Part 2: Remote working tools for employees

Part 3: Network connectivity

Part 4: Technical support and best practices

With a managed network in place in tier two, a lot has been done to secure your endpoints from attack. However, some businesses will need to assess whether the protection that has been achieved thus far is adequate to safeguard business data that has critical value, or is highly sensitive or highly regulated. In the third tier of this risk assessment, we turn to specific business use cases that demand tailor-fit protection.

Use Case 1: Protect against ransomware

Certain classes of small and medium-sized businesses, such as government and military contractors, healthcare clinics and practices, private investigative businesses, legal firms, etc., are often in possession of critical data that should never be compromised. Such high-value data represents a tantalizing opportunity for ransomware gangs who are looking to yield high gains for their time and effort invested.

An effective way of increasing pressure on businesses to pay up is through tactics such as doxing and “auction houses,” which require the criminals to steal the data before encrypting it. Businesses that refuse to pay the ransom for the decryption key(s) are then threatened that their data will be sold. That is exactly what happened to the law firm Grubman Shire Meiselas & Sacks, when Sodinokibi (aka REvil) ransomware operators reportedly stole 756 GB of data and threatened to auction it off, starting with the data from celebrities such as Nicki Minaj, Mariah Carey and LeBron James.

Businesses that have a low tolerance for loss of reputation or possess highly confidential data would greatly benefit from having a bulletproof solution against ransomware, such as ESET Dynamic Threat Defense. A powerful, cloud-based sandbox, ESET Dynamic Threat Defense uses high-performance cloud instances to run a machine learning engine that can analyze samples submitted from your environment for ransomware.

Use Case 2: Protect data from prying eyes

Data that is not encrypted is data that is open to the easy purview of any intruder. This applies especially to both email communication and physical access to data. Without encryption, hackers and thieves that get their grubby hands on emails, hard drives or USB devices can easily read their contents.

So, don’t email your patented work, blueprints, research and other sensitive communications without encrypting them first. If employees are allowed to use portable storage devices to transfer company data, make sure those devices are always encrypted. You don’t want to become the next news story about how an unencrypted storage device with patients’ medical data was found in a parking lot.

Using a solution like ESET Endpoint Encryption, which provides various options and features for email and file encryption, not only builds trust in your company’s data handling practices, but also prevents data breaches and fines levied for violations of the General Data Protection Regulation (GDPR), Health Insurance Portability and Accountability Act (HIPAA) and other data privacy legislation.

In order to protect company data stored on the hard drives of work desktops and laptops, employees should make sure to shut them down at the end of work hours. Solutions like ESET Full Disk Encryption render any data on a turned-off machine unreadable by encrypting it. In order to decrypt and read the data, employees are required to enter a password before operating system startup.

This can greatly limit the impact of a data breach in the case of home or office break-ins and thefts, since the data on stolen and tampered-with machines remains unreadable without knowing the password. According to article 34 of GDPR, there is no requirement to communicate a personal data breach to affected data subjects when the data is encrypted.

Use Case 3: Protect IT administrator and business owners’ accounts

The most desirable targets of social engineering attacks are the administrator accounts in your company. Administrators have special admin tools and privileged levels of access that enable them to perform management tasks quickly and easily. 

In a common social engineering attack, an administrator will receive a phishing email with a link that opens to a fake login page. Should an admin enter their credentials and attempt to “authenticate,” the page will usually respond with an error message while also sending the victim’s credentials to the phishing operators.

With admin credentials in hand, the operators can now authenticate as admins and use the company’s admin tools to do a lot more damage. In fact, that seems to be one of the explanations for the recent takeover of high-profile Twitter accounts, including those of Joe Biden, Elon Musk, Bill Gates and Jeff Bezos.

If, however, companies require their admins to doubly protect their logins with a multi-factor authentication (MFA) solution like ESET Secure Authentication, merely stealing the password is no longer enough for a phishing attack to succeed. A hacker would either have to bypass the MFA mechanism or steal the authentication code in some way.

In other words, MFA ups the ante on hackers. Businesses should strongly consider prioritizing authentication protection for their IT admins, as well as for business owners’ accounts (who often have admin privileges).

Conclusion

Balancing specific risks against available budget for your IT security is no easy task. Sometimes, considering how much a data breach or attack would cost your business can help you to decide what needs to be done. Especially for small businesses, one attack can do enough damage to close the business down. However, establishing which tier of risk you can handle, and then making the appropriate investment to get your IT security on par, can help you understand how prepared you are for the moment when an attack arrives.

In the previous tier 1 article, the first tier of a three-tiered risk assessment that can help small and medium-sized businesses (SMBs) better position their security investment against the cyber risks they face was discussed. Businesses that reach the first tier are using business-grade endpoint security to protect their employees. In the second tier, we turn to the remote management of the security of endpoints.

The remote management pitfall – RDP

When you’ve finally made the jump and purchased subscriptions for reliable, business-grade security software, your next step is to set up a managed network. You should keep on top of the security of devices located not just in your office, but also outside of it. Perhaps you’ve heard about Remote Desktop Protocol (RDP), a handy tool for admins to connect to employee notebooks over remote networks.

But beware: RDP is as much a temptation and risk as it is a solution for remote management of endpoint security. Using RDP exposes your business to serious security risks. Hackers are known to probe for RDP ports exposed over the internet that they can attack via brute force. Therefore, turning RDP off and using a more resilient management solution that provides better security brings us to the solutions offered in Tier 2.

Tier 2 – Visibility into employee devices is established via robust endpoint security remote management tools

For remote management of endpoint security, it is best to leverage tools like ESET Cloud Administrator (ECA) or ESET Security Management Center (ESMC). These tools are secure and provide real-time visibility, reporting and other important management features.

For SMBs that need to remotely manage 50 seats or less, the most agile and pain-free solution is to use ESET Cloud Administrator. ECA helps SMBs easily manage their employees’ devices by allowing ESET to do the hard work of maintaining servers and infrastructure in the cloud, while allowing businesses to focus on the continuity issues that they need to face.

Businesses that need more advanced capabilities can choose to build their management infrastructure on-premises and install ESET Security Management Center. Managing devices located outside your corporate network via ESMC is possible with some setup.

See this knowledge base article for remote management setup in ESMC.

Alternatively, it is also possible to deploy ESET Security Management Center in Microsoft’s Azure Cloud infrastructure. This solution allows businesses to leverage the full might of remote management – all from the cloud.

How does remote management improve security and efficiency?

Especially in a remote work era, remote management tools are crucial to help businesses ensure that patches are being installed, configurations can be made and malware is being blocked on endpoints – all in a timely and secure manner.

For IT staff, remote management provides at least three distinct advantages:

1. Security solution software can be pushed out to each endpoint remotely from the IT admin’s dashboard, rather than having to be installed with the admin physically present.
   
   
2. Subsequent configuration, updates and monitoring of the security of endpoints becomes centralized, making it possible for IT staff to work far more efficiently than if they had to manage each endpoint separately.
   
   
3. IT admins can connect to all individual endpoints, whether they are located inside or outside your corporate network – a game-changing advantage for adapting to conditions brought about by COVID-19 regulations.

The risks of not setting up a managed network come from making it difficult for IT staff to work efficiently and more easily maintain the security and compliance of your business with data privacy regulations. There are considerable risks from putting too great a trust in individual employees to cope with the myriad tricks, malware and vulnerabilities that hackers are leveraging every day.

You don’t want your employees opening up their RDP ports, downloading from torrent sites, using cracked applications or failing to update their devices. Make sure that doesn’t happen by using a secure remote management solution.

Mobile device management

In an increasingly mobile world, one of the key capabilities of ESET Security Management Center is managing mobile devices, including iOS. Remember, Apple mobile devices, unlike Android ones, cannot be protected by antivirus apps. Businesses need to use a management solution capable of deploying configuration profiles that will enforce best security practices on iOS devices. Available as an extra module in ESMC, that’s exactly what ESET Mobile Device Management offers to businesses.

Of course, the remote monitoring landscape is much more complex, including possibilities to use remote monitoring and management (RMM) tools – popular with managed service providers. ESET provides a variety of RMM plug-ins to allow managed service providers to administer ESET security products remotely from their favorite dashboard, whether that is NinjaRMM, ConnectWise, Datto or SolarWinds.

In the next article, we will explore the Tier 3 business add-ons designed to help businesses address specific risks pertinent to high-sensitivity/highly regulated data or other digital assets.

With the current shift of office employees working from home, an increased number of devices are no longer guarded by the usual protections of corporate networks. This exposes companies to greater risks from cyberthreats that can attack via unsecured employee devices.

While some IT administrators are prepared for managing and securing remote teams of employees, others may need to either catch up or perhaps review any changes made in haste. Regardless of the stage of preparedness and response, businesses can better understand how the security posture of their companies stand in relation to the tools available for cyber combat by using a three-tiered risk assessment.

The bottom tier – Tier 1 – represents the lowest investment into security infrastructure, leaving you at higher risk of a cyberattack. Inversely, Tier 3 represents a higher investment with more risk minimized.

Understanding and being strategic about which risks your business can handle helps you to assess what security gaps are still existing and what tools you should be looking for to handle those risks. So let’s begin the ascent up the tiered ladder of cybersecurity tools available for your company.

Outlining endpoint security risks

Depending on available company resources and policy, sending an employee to work from home may mean transitioning your workforce, at least partly, into a bring your own device (BYOD) model. In other words, if there aren’t enough corporate laptops and mobiles to go around, employees may need to use personal devices to carry out work at home. This may especially be the case for small offices/home offices (SOHOs) or even larger businesses should device stocks run out.

In such situations, the same security measures that should be in place at any business remain essential. Employees need to have security solutions on each desktop, notebook or mobile device that they use to handle your business’ digital assets.

The risks of not being protected at this basic level are too great. Users are exposed to various online dangers ranging from phishing links found in emails or social media to malicious websites and ads and other malware. A security solution acts as a proactive threat detection system that can handle these threats.

Tier 1 – Endpoint security solutions are installed on all devices used for work-related purposes

Employers should ensure that endpoint security software, like ESET Endpoint Security, is installed on employees’ devices. If that is not a viable option, employees should have consumer-grade security software like ESET Internet Security or, at the very least, a free trial of such software.

For employees using mobile devices for work, the same principles apply. Employers can protect Android-powered devices with antivirus solutions such as ESET Endpoint Security for Android. Again, employees could also run a consumer-grade version like ESET Mobile Security for Android, which continues to protect phones with a robust free version even if the premium trial expires.

iOS-powered mobiles, however, cannot be protected by antivirus software. IT administrators will need to leverage the remote configuration options available via (Tier 2) remote management tools to stay on top of Apple’s mobile devices.

When do SOHOs start to benefit from upgrading to business-grade products?

In the smallest setups, a business has a few employees, and devices are likely protected by consumer-grade security solutions. But, either as the business grows or when employees work regularly away from the office, a few pain points can arise:

1. Work computers have limited file storage capacity, meaning that employees will be tempted to store files in personal cloud storage accounts.
2. Alternatively, employees could transfer files to USB disks and other external storage devices. These devices are usually unencrypted and may have personal files mixed in or, worse, malware.
3. Collaboration on files via email threads starts to become messy, and versions of the same file multiply.

All these pain points push the business to deploy a central place – a file server – where employees can securely store, access, collaborate and work on files. File server solutions are various, but they usually take one of two basic forms:

1. Businesses subscribe to a cloud business storage account via OneDrive, Dropbox, Google Drive or another similar platform.
2. Businesses provision an on-premises file server.
   

Both of these options come with their own level of risk and security considerations, but the transformative effect they have is to push businesses toward a server-endpoint infrastructure – the beginnings of a true corporate network.

Business security solutions start to play a larger role in this new kind of setup because, unlike consumer software, business solutions view individual employee devices as endpoints in a network – all interconnected through one or more servers. Servers, along with endpoints, need protection, and the new IT setup – offering shared resources hosted and accessed from centralized servers – demands extra security.

Now the benefits of business-grade solutions start to kick in and unlock the door to Tier 2 security features.

In the next article, I will explore the Tier 2 remote management tools unlocked by business endpoint and file server security solutions

• Encrypt information stored on work devices.
• Install endpoint security software on devices and keep it up-to-date.
• Keep devices (also) up-to-date, including the operating system and applications.
• Secure and properly configure home networks.
• When connecting to a public network or Wi-Fi hotspot, always use a VPN and avoid accessing sensitive information.
• Periodically back up your data.
• Protect your devices with passwords and be wary of leaving them unattended while logged in.
• Enable anti-theft protection on your devices.
• Use two-factor authentication to protect your critical accounts.
• Always have in hand the contact information for your technical support and report any security incidents as soon as possible.
• Watch out for the latest scams and threats by following WeLiveSecurity news.

Conclusion

In this guide we have looked at the risks entailed by remote work and how businesses can significantly improve employees’ behavior to mitigate those risks and improve the security of communication over remote networks.

Keeping in mind the advance of 5G, IoT devices and other technologies – compounded with the accelerating force of COVID-19 – remote access to information by employees working from home is undoubtedly a foremost business concern.

The employee at home has become a fundamental piece in managing the security of your business data and processes. To face the new challenges, organizations must have clear policies for information management and adequate tools that allow employees to carry out their activities safely.

Changing the manner of working within a company needs to involve all employees and can take time. But with the right training, employees can quickly understand the risks of remote work and know how to avoid or counteract them. We are confident that this guide has furthered that goal.

The complete Remote Worker’s Guide series:

Part 1: Risks, threats and corporate policy

Part 2: Remote working tools for employees

Part 3: Network connectivity

Part 4: Technical support and best practices

In the case of home networks, it is important that the Wi-Fi router is inaccessible from the outside and has a strong administrator password that is difficult to guess. In addition, keeping the router’s firmware updated and monitoring the devices that are connecting to it are indispensable precautions.

Public vs. private networks

Public networks are another matter – they are very useful when you need to work in a bar, an airport or any other public space – but they are usually open networks offered as an additional service for customers. As such, these connections do not have restrictive security measures. A hacker that connects to public networks can potentially intercept data being transferred on the same network.

Therefore, when connecting to public networks, it is important to apply the most restrictive security setups, especially with regard to shared files and access to systems. The best advice is to avoid using services that involve sensitive information.

Most companies have private networks that protect data packets in transit and ensure safe browsing for their users. But when the connection to users is remote, that means communication will be happening over public, unsecured networks. Companies will need to establish an external-facing gateway that has additional controls and measures in place to protect both the company’s internal network and the communication with remote employees’ devices.

Sometimes, we use networks that are neither our own home connection nor a public one – usually some type of third-party network like a hotel or a friend’s house. Even though these are private networks, the user does not know who else is connected to that network nor what their intentions might be. For this reason, even if you know and trust the administrator, the same precautions should be taken as for a public network.

VPN

Virtual private networks (VPNs) are a technology that encrypts your communication over a network to provide you with secure remote access to a private network.

While there are various protocols available to connect via VPN, all use encryption to render data unreadable until it has reached its destination. In this way, should attackers intercept your communication, they will not be able to read or utilize your data.

Many companies provide their employees with a VPN connection to remotely connect to internal network services and data. Since these types of connections provide encryption, it is also recommended to use a VPN whenever connected to a public or unsecure network.

Don’t have an IT department to set up a VPN for your business? Check out this guide on WeLiveSecurity.

Two-factor authentication

Two-factor authentication (2FA) is a technology that complements traditional authentication to access services. In addition to the usual username and password, another piece of information is also required. This could be a security code, a hard token or anything else that the user possesses. 

Normally, a code is generated and available via an SMS, in an authenticator app (more secure), or even in something as simple as a USB key.

The purpose of 2FA is to protect access to your accounts and devices in cases when your password is compromised. This can happen due to malicious code, an infiltration in your company’s IT systems or via a scam.

Remote work increases the risk that your credentials can be stolen by an attacker. By adding a second factor to your credentials, an attacker’s attempts to use your password for authentication are confounded. ESET offers businesses a comprehensive 2FA solution via ESET Secure Authentication.

In part four of this series, we will take a look at preparing your employees for receiving technical support remotely and round off this series with a summary of best practices.

The complete Remote Worker’s Guide series:

Part 1: Risks, threats and corporate policy

Part 2: Remote working tools for employees

Part 3: Network connectivity

Part 4: Technical support and best practices

Part 2: Remote working tools for employees

Part 3: Network connectivity

Part 4: Technical support and best practice