Remote work can be secure but risks must be addressed

The new office is the home office, with all its benefits and challenges.

For defense industry professionals, or any information worker dealing with sensitive data, there’s the added challenge of protecting confidential information when working outside of your company’s office and secure network.

The trend is becoming irreversible as employers -- including even the U.S. Army -- are now enabling employees to handle company intellectual property and client-sensitive material in their homes.

People tend to think of their home as a safe space, and project this sense of security automatically to their computers, network, and information. It is not.

The cyber world knows no home front or physical boundaries, and connectivity opens many avenues for compromise. At work, the protective physical and cyber boundaries are provided for us through security guards and firewalls. But within a home environment it’s harder to establish these boundaries.

In some ways, the cybersecurity risks at home are no different than at a hotel room or cafe. It is possible though to make a home office safe if the right technical safeguards are put in place for computer equipment and the right work behaviors are adopted. Companies can provide guidelines, equipment, and support, but ultimately, it’s up to each person to take steps to secure their own space and protect their work. The protection must now be around you and your work computer, and not just at the front door or at the network interface to your broadband provider. 

Cyber adversaries are taking advantage of both the collective chaos of COVID-19 and the increase in remote work to disrupt and compromise companies and workers. When many people began working from home in mid-March, the Cybersecurity and Infrastructure Security Agency issued an alert outlining the dangers of working from home and encouraging employees and companies to continuously update VPNs used for telework and to flag suspicious phishing emails -- but there are more steps you must take to keep your entire home work environment secure.

You can put a deadbolt and a security camera on your front door, but does your internet connection have the same security? Easy steps that anyone can take include strengthening your Wi-Fi password, disabling remote management, and ensuring your network is at the WPA2 level. Even if employees follow company guidelines to secure their networks, the computer for at-home work must have a zero-trust model, meaning that it does not assume the existence of a safe home network and only uses secure sessions to access corporate resources or networks.

The best way to protect company information is to give employees a computer with zero-trust safeguards that is remotely managed, updated, and scanned regularly. This computer should also encrypt its on-board data to protect it from theft and have an effective endpoint detection and response tool in place. With all these protections, it’s also critical that you separate personal work from company work and that you resist the temptation at home to copy and perform company work on a personal computer account or personal work on a company account. Compromises and data loss are often a result of workers side-stepping this separation.

A home office may also have more “visitors” than the usual workspace, and your loved ones and housemates may be more of a liability than you realize. While you may trust them to not steal your work secrets, any exposure of this data outside your company’s physical boundary presents risk, especially if you’re working with Personally Identifiable Information, Protected Health Information, or Controlled Unclassified Information.

Employees must keep their work area safe and free from incursion, either from people outside of the home or household members, when discussing and processing proprietary and sensitive information. This also includes how sensitive documents are printed and discarded.

Home office spaces are more varied and personalized than the usual at-work setting, so it’s up to you to determine your exact security needs and the level of precautions you need to take. A chaotic home office environment -- whether you’re sitting at the kitchen table, in the bedroom, or outside on the patio -- can lead to extensive security risks for those handling sensitive information. Few employees were prepared to work from home for this long and may not have adequate technology in place or even have a private working space to safely handle confidential information. But you can have greater control over what happens in your own home than in a shared work environment if you diligently apply these safety standards, since all factors are under their individual control.

If the company provides the best cybersecurity technologies and practices, if adequate safeguards are in place for the home’s physical and network environment, and if the employee takes an active role in protecting information, working from home can be both productive and secure -- perhaps even more so than in a traditional company office.