Home Working Can Often Be A Security Threat

The majority of small business owners let their employees work remotely when it’s needed, but often many haven’t trained those employees on cyber-security. It’s a gap that could leave businesses open to a cyber attack, according to the US Nationwide Insurance company.
 
In the company’s latest annual survey of small business owners, it found that one-fifth of small business owners have not provided formal cybersecurity training for their employees. The security lapses employees may have at remote locations represent one of the largest threats to cybersecurity. 
 
An attacker could break into a worker’s computer over a public Wi-Fi network, for example. “What may seem like a harmless public Wi-Fi network could ultimately pose serious troubles for a business,” said Catherine Rudow, Nationwide’s vice president of cyber insurance.
 
While 83 percent of small business owners, and 95 percent of young business owners, allow employees to work remotely, only half have updated their remote security policies in the past year, the survey found.
 
“Many employees may not realise the magnitude of risk associated with a cyberattack as they may not have engaged in a formal training process,” Rudow said..... “The scary truth is that many small business owners, even if they are aware of these risks, have not implemented all the proper measures of protection.”
 
Sixty-five percent of business owners surveyed said they’ve been the victim of a cyberattack. Computer viruses were the most common type of attack, and 7 percent of companies fail to regularly update security software. 
 
Protect Against Ransomware
The Department of Homeland Security (DHS) wants to help small businesses across America protect against ransomware, and the National Cybersecurity and Communications Integration Center (NCCIC) has issued this message:
 
NCCIC has received multiple reports of WannaCry ransomware infections worldwide. Ransomware is a type of malicious software that infects and restricts access to a computer until a ransom is paid. Although there are other methods of delivery, ransomware is frequently delivered through phishing emails and exploits unpatched vulnerabilities in software.
 
Phishing emails are crafted to appear as though they have been sent from a legitimate organization or known individual.
 
These emails often entice users to click on a link or open an attachment containing malicious code. After the code is run, your computer may become infected with malware. A commitment to cyber hygiene and best practices is critical to protecting organisations and users from cyber threats, including malware.
 
How to Protect your Business
Only 4 percent of business owners have implemented all of the cyber-security best practices recommended by the US Small Business Administration, the survey found. 
 
Here’s what the SBA and DHS recommend:
In advice specific to the recent WannaCry ransomware threat, users should:
 
• Be careful when clicking directly on links in emails, even if the sender appears to be known; attempt to verify web addresses independently. For instance, contact your organisation's helpdesk or search the Internet for the main website of the organisation or topic mentioned in the email.
• Exercise caution when opening email attachments. Be particularly wary of compressed or ZIP file attachments.
• Be suspicious of unsolicited phone calls, visits, or email messages from individuals asking about employees or other internal information. If an unknown individual claims to be from a legitimate organization, try to verify his or her identity directly with the company.
• Avoid providing personal information or information about your organisation, including its structure or networks, unless you are certain of a person's authority to have the information. 
• Avoid revealing personal or financial information in email, and do not respond to email solicitations for this information. This includes following links sent in email.
• Be cautious about sending sensitive information over the Internet before checking a website's security.
If you are unsure whether an email request is legitimate, try to verify it by contacting the company directly. Do not use contact information provided on a website connected to the request; instead, check previous statements for contact information. Information about known phishing attacks is also available online from anti-phishing groups such as the APWG.
• Use and update antivirus and anti-spyware software. Most of them can be set to install updates automatically. 
• Secure your networks with a firewall and encrypt information. Keep Wi-Fi networks secure and hidden, and require a password to access the router.
• Set policies for how employees should protect sensitive data like personal information. Also set consequences for violating the policy. 
• Educate employees about cyber threats. Show them how to protect the business’ data and safely use the Internet. Require them to use strong passwords and change them often, ideally with multifactor authentication beyond a password.
• Work with banks and other payment processors to ensure anti-fraud services are in place. See if they offer multi-factor authentication, too.
• Regularly back up data on all computers, including text documents, spreadsheets, databases, financial information, human resources files, etc. 
• Control physical access to computers and other devices that can access the business’ network. Make sure each employee has a separate user account with strong passwords. Give administrative privileges only to those who need them.
• Make a plan for mobile device security. Require users to set passwords, encrypt their data and install security apps to protect information while connected to public networks. 
• Protect all pages on company websites, not just checkout or signup pages.
 
 Fox Business:      US Small Business Administration:        US Small Business Administration
 
You Might Also Read: 
 
How to Ensure Your Remote Employees’ Cybersecurity
 
Creating A  Working Culture Of Computer Security (£):         
 
Half Of UK Businesses Have Fallen For Phishing Attacks:
 
 
« Connected Cars Are The New Attack Vector
Cyberwar Between Nation-States Damages Business »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

NSFOCUS Information Technology

NSFOCUS Information Technology

NSFOCUS is a global service provider and enterprise DDoS mitigation solution provider.

vArmour

vArmour

vArmour is the industry’s first distributed security system that provides insight and control for multi-cloud environments.

Geobridge

Geobridge

Geobridge is a leading information security and compliance provider for retail, financial services, healthcare, manufacturing and government markets

cPacket Networks

cPacket Networks

cPacket’s distributed intelligence enables network operators to proactively identify imminent issues before they negatively impact end-users.

Center for Long-Term Cybersecurity (CLTC)

Center for Long-Term Cybersecurity (CLTC)

The Center for Long-Term Cybersecurity is developing and shaping cybersecurity research and practice based on a long-term vision of the internet and its future.

Crypto Quantique

Crypto Quantique

Crypto Quantique's ground-breaking technology radically simplifies the process of generating a hardware root of trust in an IoT device.

EBRAND Services

EBRAND Services

EBRAND, the European experts for brand protection on the Internet. We offer a full set of services including cybermonitoring, fighting counterfeiting offences and online security.

AdEPT Technology Group

AdEPT Technology Group

AdEPT are a managed services and telecommunications provider offering award-winning, proven and uncomplicated technical solutions for over 12,000 organisations across the UK.

Hybrid Identity Protection Conference (HIP)

Hybrid Identity Protection Conference (HIP)

Hybrid Identity Protection (HIP) is the premier educational forum for identity-centric cybersecurity practitioners charged with defending hybrid cloud environments.

HolistiCyber

HolistiCyber

HolistiCyber provide state-of-the art consulting, services, and solutions to help proactively and holistically defend against a new era of constantly evolving cyber threats.

Xiarch Solutions

Xiarch Solutions

Xiarch Security is an global security firm that educates clients, identifies security risks, informs intelligent business decisions, and enables you to reduce your attack surface.

Kobalt.io

Kobalt.io

Kobalt are bringing the monitoring capabilities of enterprise-class security teams to smaller organizations.

BIRD Cyber

BIRD Cyber

BIRD Cyber is a program to promote collaboration on cybersecurity and emerging technologies aimed at enhancing the cyber resilience of critical infrastructure.

Cyber Legion

Cyber Legion

Cyber Legion Ltd is a UK-based Cyber Security as a Service (CSaaS) start-up that provides IT security testing services to various organizations around the globe.

Siren

Siren

Siren provides the leading Investigative Intelligence Platform to some of the world’s leading Law Enforcement, National Security and Cyber threat investigators.

coc00n

coc00n

coc00n secures the devices of high-value and high-interest individuals against cyber attacks.