With millions of employees working from home during the COVID-19 pandemic, remote work security threats are a critical consideration for businesses. The vulnerabilities introduced by the work-from-home landscape merit the attention of security administrators to help improve endpoint security for their networks. Here are some of the most common remote work security threats—and how IT security teams can minimize them.
Unsecured networks
Many home Wi-Fi networks are protected by factory-default passwords—or, worse yet, no password at all. Some might also use older, easily compromised encryption methods, such as Wired Equivalent Privacy. And criminals sometimes set up "evil twin" access points with the intention of fooling users into connecting to them so they can steal sensitive data.
Solution: Direct homebound workers to change their Wi-Fi passwords, update their firmware and use strong encryption.
Phishing and malware
Most malware, according to the 2020 Verizon Data Breach Investigations Report, is delivered by email phishing scams. Nearly half of the respondents in Proofpoint's 2020 State of the Phish report were affected by phishing-induced ransomware, and about 35% suffered from some other phishing-related malware infection.
The pandemic has exacerbated the issue. Bad actors have taken advantage of the demand for information about the pandemic and set up thousands of suspicious domains that steal credentials or install malware. In April, Google said that its mail servers identified 18 million daily malware and phishing emails related to COVID-19 on top of the more than 240 million daily spam messages related to COVID-19.
Solution: Advise users to exercise extreme caution with any unfamiliar sites asking for login information, and remind them to never click on links or download attachments from untrusted sources. Implore them to check for encrypted website connections, use Whois to verify site ownership and avoid storing sensitive information on untrusted websites. Employees should know that reputable companies never ask for password or credit card information by email.
Unsecured home computers
Even employees who are well-educated about remote work security threats are at risk if others in their household use their computers. Family members and roommates can unintentionally introduce malware that gives attackers access to sensitive data.
Solution: Business devices should only be used for business, and they should be registered with and managed remotely by the company's IT team. Using firewalls and antivirus utilities, keeping software and firmware updated and choosing secure passwords can help safeguard home computers, too.
Unauthorized applications
Well-meaning employees might use applications that aren't sanctioned by the company because they think they're faster or more efficient. But improperly configured security controls can expose sensitive data to cyber criminals. Verizon's 2020 Data Breach Report ranked errors in message delivery and security controls as the third and fourth most common causes of breaches, respectively.
Solution: Develop a list of approved applications that allow administrative oversight, and evaluate and deploy technical tools that enforce the approved/not-approved list. Provide users with password management software that creates strong passwords and stores them securely.
Attacks on virtual private networks
Virtual private network (VPN) usage has surged since March—but so have threats against this tool. Attackers scan the internet looking for unpatched VPNs with known vulnerabilities. Compromised computers that hold VPN credentials offer another on-ramp onto the corporate network.
Solution: Ensure that your VPNs have been properly patched, or use a segregated option. Use multifactor authentication to regulate access to any corporate resources.
Discover how Verizon security solutions can empower your employees to work remotely with confidence.
The author of this content is a paid contributor for Verizon.