Home Working Can Often Be A Security Threat

The majority of small business owners let their employees work remotely when it’s needed, but often many haven’t trained those employees on cyber-security. It’s a gap that could leave businesses open to a cyber attack, according to the US Nationwide Insurance company.
 
In the company’s latest annual survey of small business owners, it found that one-fifth of small business owners have not provided formal cybersecurity training for their employees. The security lapses employees may have at remote locations represent one of the largest threats to cybersecurity. 
 
An attacker could break into a worker’s computer over a public Wi-Fi network, for example. “What may seem like a harmless public Wi-Fi network could ultimately pose serious troubles for a business,” said Catherine Rudow, Nationwide’s vice president of cyber insurance.
 
While 83 percent of small business owners, and 95 percent of young business owners, allow employees to work remotely, only half have updated their remote security policies in the past year, the survey found.
 
“Many employees may not realise the magnitude of risk associated with a cyberattack as they may not have engaged in a formal training process,” Rudow said..... “The scary truth is that many small business owners, even if they are aware of these risks, have not implemented all the proper measures of protection.”
 
Sixty-five percent of business owners surveyed said they’ve been the victim of a cyberattack. Computer viruses were the most common type of attack, and 7 percent of companies fail to regularly update security software. 
 
Protect Against Ransomware
The Department of Homeland Security (DHS) wants to help small businesses across America protect against ransomware, and the National Cybersecurity and Communications Integration Center (NCCIC) has issued this message:
 
NCCIC has received multiple reports of WannaCry ransomware infections worldwide. Ransomware is a type of malicious software that infects and restricts access to a computer until a ransom is paid. Although there are other methods of delivery, ransomware is frequently delivered through phishing emails and exploits unpatched vulnerabilities in software.
 
Phishing emails are crafted to appear as though they have been sent from a legitimate organization or known individual.
 
These emails often entice users to click on a link or open an attachment containing malicious code. After the code is run, your computer may become infected with malware. A commitment to cyber hygiene and best practices is critical to protecting organisations and users from cyber threats, including malware.
 
How to Protect your Business
Only 4 percent of business owners have implemented all of the cyber-security best practices recommended by the US Small Business Administration, the survey found. 
 
Here’s what the SBA and DHS recommend:
In advice specific to the recent WannaCry ransomware threat, users should:
 
• Be careful when clicking directly on links in emails, even if the sender appears to be known; attempt to verify web addresses independently. For instance, contact your organisation's helpdesk or search the Internet for the main website of the organisation or topic mentioned in the email.
• Exercise caution when opening email attachments. Be particularly wary of compressed or ZIP file attachments.
• Be suspicious of unsolicited phone calls, visits, or email messages from individuals asking about employees or other internal information. If an unknown individual claims to be from a legitimate organization, try to verify his or her identity directly with the company.
• Avoid providing personal information or information about your organisation, including its structure or networks, unless you are certain of a person's authority to have the information. 
• Avoid revealing personal or financial information in email, and do not respond to email solicitations for this information. This includes following links sent in email.
• Be cautious about sending sensitive information over the Internet before checking a website's security.
If you are unsure whether an email request is legitimate, try to verify it by contacting the company directly. Do not use contact information provided on a website connected to the request; instead, check previous statements for contact information. Information about known phishing attacks is also available online from anti-phishing groups such as the APWG.
• Use and update antivirus and anti-spyware software. Most of them can be set to install updates automatically. 
• Secure your networks with a firewall and encrypt information. Keep Wi-Fi networks secure and hidden, and require a password to access the router.
• Set policies for how employees should protect sensitive data like personal information. Also set consequences for violating the policy. 
• Educate employees about cyber threats. Show them how to protect the business’ data and safely use the Internet. Require them to use strong passwords and change them often, ideally with multifactor authentication beyond a password.
• Work with banks and other payment processors to ensure anti-fraud services are in place. See if they offer multi-factor authentication, too.
• Regularly back up data on all computers, including text documents, spreadsheets, databases, financial information, human resources files, etc. 
• Control physical access to computers and other devices that can access the business’ network. Make sure each employee has a separate user account with strong passwords. Give administrative privileges only to those who need them.
• Make a plan for mobile device security. Require users to set passwords, encrypt their data and install security apps to protect information while connected to public networks. 
• Protect all pages on company websites, not just checkout or signup pages.
 
 Fox Business:      US Small Business Administration:        US Small Business Administration
 
You Might Also Read: 
 
How to Ensure Your Remote Employees’ Cybersecurity
 
Creating A  Working Culture Of Computer Security (£):         
 
Half Of UK Businesses Have Fallen For Phishing Attacks:
 
 
« Connected Cars Are The New Attack Vector
Cyberwar Between Nation-States Damages Business »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Telspace Systems

Telspace Systems

Telspace Systems provides penetration testing, vulnerability assessment and training services.

Rhebo

Rhebo

Rhebo Industrial Protector monitors and ensures the continuous, correct, and predictable operation of real-time Industrial Control Systems to prevent outages and reduce downtimes.

Cynterra

Cynterra

Cynterra is a next generation cloud cyber security and data analytical service provider offering cloud security compliance, data protection, visibility and threat protection services.

Prolimax

Prolimax

Prolimax deliver innovative solutions to IT Manufacturers, Distributors, Resellers and End-users including Data Erasure and secure IT Asset Disposition (ITAD)

Innovasec

Innovasec

Innovasec provide information security consulting and training services.

Sharktech

Sharktech

Sharktech designs, develops, and supports advanced DDoS protection and web technologies.

Focal Point

Focal Point

We aspire to be the focal point for Medium and Small size companies providing 24/7 cyber security advice, services and solutions.

Dutch Institute for Vulnerability Disclosure (DIVD)

Dutch Institute for Vulnerability Disclosure (DIVD)

DIVD's aim is to make the digital world safer by reporting vulnerabilities we find in digital systems to the people who can fix them.

Quantum Star Technologies

Quantum Star Technologies

Quantum Star Technologies has developed Starpoint to be a next-next-generation solution to cyber security threats. Our mission is to secure the online world through our patented technology.

Cyber Legion

Cyber Legion

Cyber Legion Ltd is a UK-based Cyber Security as a Service (CSaaS) start-up that provides IT security testing services to various organizations around the globe.

SilverEdge Government Solutions

SilverEdge Government Solutions

SilverEdge is a next generation provider of innovative and proprietary cybersecurity, software, and intelligence solutions for the Defense and Intelligence Communities.

NetScout Systems

NetScout Systems

NetScout assures digital business services against disruptions in availability, performance, and security.

Cynical Technology

Cynical Technology

Cynical Technology is a Nepalese cybersecurity company with expertise in security consulting, auditing, testing and compliance.

Cyber Octet

Cyber Octet

Cyber Octet is an IT Solution, Security, Training and Services company. We provide training and services from Web Application Security to ISO 27001 implementation.

Databarracks

Databarracks

Databarracks deliver award winning IT resilience and continuity services. We help organisations get the most out of the cloud and protect their data, wherever it lives.

Dedagroup (Deda)

Dedagroup (Deda)

Dedagroup provide application solutions and IT services to bring innovation at the core of business processes.