5 Remote Work Security Risks to Watch Out For

While it’s not quite as prevalent as it was during the pandemic, remote work is far from over. In fact, according to Gallup, U.S. employees now work remotely an average of 3.8 days per month. While that’s down from the pandemic high of 5.8 days per month, it’s still more common than before the pandemic, when the average was just 2.4 days.

Employees covet opportunities to work remotely, at least some of the time. Six in 10 employees with remote-capable jobs want a hybrid work setup, Gallup says, while about a third prefer fully remote work.

With numbers like those, remote work is an attractive benefit to offer your employees. But can you be sure that they can do it safely? We recommend identifying risks in your IT operations and taking proactive measures to create the most secure remote work environment you can.

Risk #1:  Unprotected Wi-Fi Connections

While many remote workers want to work from their homes, others prefer to work from coffee shops, libraries or other public spaces. You want your employees to feel comfortable where they work, but this environment can be dangerous for your organization.

Imagine you’re talking about company secrets in a crowded cafe, and anyone could overhear. Using open Wi-Fi is just like that — the person at the next table could be a hacker who would just love to access your company’s data.

Outside the secure network in your office, you should require employees to connect to your systems via a virtual private network (VPN).

A VPN secures all the data on your employees’ devices and lets them work as if they’re in your office on your network. It keeps prying eyes away from sensitive information and gives your team access to all the files and programs they need to work effectively from anywhere.

Risk #2: Phishing Attacks

Phishing attacks are attempts to gain access to data by pretending to be a legitimate company or person the victim would be likely to trust. Phishing comes in many forms, each seemingly trickier than the next. In the workplace, common types of phishing include:

• Spear-phishing: Targeting a person in a specific position that has particular data the hacker wants. This could be a system administrator, finance employee, or HR rep.
• Whaling: Going after the biggest “fish” in your organization like C-level employees. High-level employees are often rushed and receive so many communications each day that they might not spot a fake one. Hackers count on a person’s distraction to gain trust.
• Business email compromise: Impersonating a trusted colleague or vendor in an email message. Hackers typically either fraudulently gain access to the email of a real person or pretend to be someone by creating a fake, yet similar, email address — and hope you won’t spot the slight irregularity when they ask for money or sensitive data.

Phishing attacks are common when employees work remotely. One report revealed that attacks on mobile devices increased by 50% between 2021 and 2022.

Why? First, outside an office environment, they might be less inclined to think critically about an email’s validity. Second, the Bring Your Own Device (BYOD) trend — letting employees access company systems from personal devices — gives hackers even more ways to reach employees. (More on that below.)

Wherever your employees are, frequent phishing training is a must. Regularly updating employees on the latest tactics and what to watch out for will keep them aware of new dangers as hackers get craftier.

Risk #3: Outdated Software

Inside or outside an office, many employees are hesitant to install updated versions of software. Maybe they feel they’re too busy to deal with it or they’re used to the software’s current setup and don’t want to change.

Because they’re not on-site, it’s often especially difficult to get remote employees to follow through with software updates. But it’s a necessary part of your cybersecurity efforts  — especially for those outside your office. Software updates usually contain vital security patches to keep users safe. They also improve performance speed, making it easier for your remote team members to work efficiently outside the office.

Risk #4: Using Personal Devices for Work

Believe it or not, there was a time when we all left work at work because we didn’t have an efficient way to do it anywhere else. Today is a different story, of course, and we’ve figured out how to work just about anywhere when and if we need to.

The trouble starts when employees want to access your network using their own devices outside the office. Let’s face it — it’s often faster and more convenient to complete a task from a phone or tablet.

But employees likely don’t have the same high standards for backups, security and passwords that your IT staff does. And the more endpoints (devices) your network has, the more open your business is to cybersecurity issues.

If your employees really want or need to use personal devices, ensure you have a BYOD policy in place to outline the requirements you have for accessing your network from a personal device. Common requirements include password strength, VPN usage, and multi-factor identification — creating steps beyond entering a username and password to prove the user is authorized.

Risk #5: Weak Passwords

Most of us have seen the chart that details how long it would take a hacker to figure out a password with varying complexity. Four numbers only? They’ll crack it in an instant. Eight uppercase and lowercase letters? They need less than a minute.

As you add more and varying types of characters, the password gets harder and harder to crack — a complex 18-character password would take a hacker 26 trillion years to bypass.

While your IT staff can probably force employees to make frequent password updates on company-owned devices, what about their own? As we discussed, allowing employees to use personal phones, tablets and laptops to access your network and its data is risky. You can lessen the risk with a solid BYOD policy with tough requirements for password strength.

Need help making remote work secure?

Whether you have a full IT team, a single admin, or no tech staff at all, the Cenetric team can be your experts for a cybersecurity project or ongoing support.

Setting up the right cybersecurity measures for remote work can be tricky — but our team has the reliable expertise to handle your cybersecurity concerns. Tell us about your challenges and we’ll get — and keep — your business secure.