Home Working Can Often Be A Security Threat

The majority of small business owners let their employees work remotely when it’s needed, but often many haven’t trained those employees on cyber-security. It’s a gap that could leave businesses open to a cyber attack, according to the US Nationwide Insurance company.
 
In the company’s latest annual survey of small business owners, it found that one-fifth of small business owners have not provided formal cybersecurity training for their employees. The security lapses employees may have at remote locations represent one of the largest threats to cybersecurity. 
 
An attacker could break into a worker’s computer over a public Wi-Fi network, for example. “What may seem like a harmless public Wi-Fi network could ultimately pose serious troubles for a business,” said Catherine Rudow, Nationwide’s vice president of cyber insurance.
 
While 83 percent of small business owners, and 95 percent of young business owners, allow employees to work remotely, only half have updated their remote security policies in the past year, the survey found.
 
“Many employees may not realise the magnitude of risk associated with a cyberattack as they may not have engaged in a formal training process,” Rudow said..... “The scary truth is that many small business owners, even if they are aware of these risks, have not implemented all the proper measures of protection.”
 
Sixty-five percent of business owners surveyed said they’ve been the victim of a cyberattack. Computer viruses were the most common type of attack, and 7 percent of companies fail to regularly update security software. 
 
Protect Against Ransomware
The Department of Homeland Security (DHS) wants to help small businesses across America protect against ransomware, and the National Cybersecurity and Communications Integration Center (NCCIC) has issued this message:
 
NCCIC has received multiple reports of WannaCry ransomware infections worldwide. Ransomware is a type of malicious software that infects and restricts access to a computer until a ransom is paid. Although there are other methods of delivery, ransomware is frequently delivered through phishing emails and exploits unpatched vulnerabilities in software.
 
Phishing emails are crafted to appear as though they have been sent from a legitimate organization or known individual.
 
These emails often entice users to click on a link or open an attachment containing malicious code. After the code is run, your computer may become infected with malware. A commitment to cyber hygiene and best practices is critical to protecting organisations and users from cyber threats, including malware.
 
How to Protect your Business
Only 4 percent of business owners have implemented all of the cyber-security best practices recommended by the US Small Business Administration, the survey found. 
 
Here’s what the SBA and DHS recommend:
In advice specific to the recent WannaCry ransomware threat, users should:
 
• Be careful when clicking directly on links in emails, even if the sender appears to be known; attempt to verify web addresses independently. For instance, contact your organisation's helpdesk or search the Internet for the main website of the organisation or topic mentioned in the email.
• Exercise caution when opening email attachments. Be particularly wary of compressed or ZIP file attachments.
• Be suspicious of unsolicited phone calls, visits, or email messages from individuals asking about employees or other internal information. If an unknown individual claims to be from a legitimate organization, try to verify his or her identity directly with the company.
• Avoid providing personal information or information about your organisation, including its structure or networks, unless you are certain of a person's authority to have the information. 
• Avoid revealing personal or financial information in email, and do not respond to email solicitations for this information. This includes following links sent in email.
• Be cautious about sending sensitive information over the Internet before checking a website's security.
If you are unsure whether an email request is legitimate, try to verify it by contacting the company directly. Do not use contact information provided on a website connected to the request; instead, check previous statements for contact information. Information about known phishing attacks is also available online from anti-phishing groups such as the APWG.
• Use and update antivirus and anti-spyware software. Most of them can be set to install updates automatically. 
• Secure your networks with a firewall and encrypt information. Keep Wi-Fi networks secure and hidden, and require a password to access the router.
• Set policies for how employees should protect sensitive data like personal information. Also set consequences for violating the policy. 
• Educate employees about cyber threats. Show them how to protect the business’ data and safely use the Internet. Require them to use strong passwords and change them often, ideally with multifactor authentication beyond a password.
• Work with banks and other payment processors to ensure anti-fraud services are in place. See if they offer multi-factor authentication, too.
• Regularly back up data on all computers, including text documents, spreadsheets, databases, financial information, human resources files, etc. 
• Control physical access to computers and other devices that can access the business’ network. Make sure each employee has a separate user account with strong passwords. Give administrative privileges only to those who need them.
• Make a plan for mobile device security. Require users to set passwords, encrypt their data and install security apps to protect information while connected to public networks. 
• Protect all pages on company websites, not just checkout or signup pages.
 
 Fox Business:      US Small Business Administration:        US Small Business Administration
 
You Might Also Read: 
 
How to Ensure Your Remote Employees’ Cybersecurity
 
Creating A  Working Culture Of Computer Security (£):         
 
Half Of UK Businesses Have Fallen For Phishing Attacks:
 
 
« Connected Cars Are The New Attack Vector
Cyberwar Between Nation-States Damages Business »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

ZenGRC

ZenGRC

ZenGRC (formerly Reciprocity) is a leader in the GRC SaaS landscape, offering robust and intuitive products designed to make compliance straightforward and efficient.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Splunk

Splunk

Splunk provide real-time Security Information & Event Management solutions for Enterprise Networks, Cloud and small-scale IT environments

Tukan IT

Tukan IT

Tukan IT provides a data classification and protection solution.

TechCERT

TechCERT

TechCERT is Sri Lanka’s first and largest Computer Emergency Readiness Team (CERT).

Cog Systems

Cog Systems

Cog Systems offer an embedded solution built on modularity, proactive security, trustworthiness, and adaptability to enable highly secure connected devices.

Extreme Protocol Solutions (EPS)

Extreme Protocol Solutions (EPS)

Extreme Protocol Solutions is an industry leading Data Sanitization Software, Hardware and Onsite Service Provider.

aDolus Technology

aDolus Technology

aDolus delivers a robust solution for safeguarding against counterfeit or malicious software and firmware in mission-critical systems.

Option3

Option3

Option3 (formerly Option3Ventures - O3V) primarily seek control investments in the growing cybersecurity mid-market, seeking to build champions with the scale to bring cutting-edge products to market.

Rede Nacional CSIRT

Rede Nacional CSIRT

Rede Nacional CSIRT is a national network of CSIRTs in Portugal aimed at cooperation and mutual assistance in the handling of incidents and in the sharing of good security practices.

Cymptom

Cymptom

At Cymptom our purpose is to enable security managers to see at a glance all urgently risky gaps  in their organizations’ security posture at any given moment.

Data#3 Limited (DTL)

Data#3 Limited (DTL)

Data#3 Limited (DTL) is a leading Australian IT services and solutions provider.

Fibernet

Fibernet

Fibernet's innovative solutions in the fields of cybersecurity and fiber optics range from telecommunications infrastructure to small business cybersecurity.

Mitigo Group

Mitigo Group

Mitigo offers a well considered and effective approach to keeping businesses completely secure from any digital attacks.

Secure Halo

Secure Halo

Secure Halo has been protecting the intellectual assets and sensitive information of the federal government and private sector for 20+ years, through our proactive approach to risk and cybersecurity.

Francisco Partners

Francisco Partners

Francisco Partners provide capital, expertise, and support for growth-aspiring technology companies.

eGyanamTech (EGT)

eGyanamTech (EGT)

eGyanamTech provides robust security solutions tailored for Operational Technology (OT) and Supervisory Control and Data Acquisition (SCADA) systems used in critical infrastructure systems.

Darwinium

Darwinium

Darwinium is a Cyberfraud Prevention Platform that provides scalable customer journey protection without complexity.