You’re an information security professional. How can you keep your data safe while working remotely?

VPN is one of the most important layers to have in place. However, with the advancement in technology, it might be possible that this layer becomes obsolete at one point in time. It will be replaced with other tunneling services that do not require us to maintain the VPN appliance, but we use cloud-based ones.

Para manter meus dados seguros enquanto trabalho remotamente como profissional de seguran?a da informa??o, adoto várias medidas de seguran?a. Isso inclui o uso de uma VPN segura para criptografar minhas comunica??es, a implementa??o de autentica??o de dois fatores para proteger minhas contas, a atualiza??o regular de software, a utiliza??o de criptografia para proteger dados sensíveis, o cuidado ao se conectar a redes Wi-Fi públicas, o backup regular de dados e o investimento em conscientiza??o em seguran?a para me manter atualizado sobre amea?as cibernéticas e melhores práticas de seguran?a. Essas medidas garantem que meus dados e os dados da organiza??o permane?am protegidos contra amea?as cibernéticas enquanto trabalho remotamente.

Using a VPN (Virtual Private Network) is a great way of protecting your network while you work remotely as it encrypts your connection, preventing third parties from snooping on your activity. However, it's important to choose a reputable VPN provider. This is because when you connect to a VPN, you are ultimately entrusting the service provider with your data. VPNs which use secure VPN protocols (such as Wireguard or OpenVPN), have strong encryption (AES-256 and above) and a no-logs policy are a good place to start. Generally speaking, it's also good to avoid free VPNs as many are unsafe and could put your privacy and security at risk.

Encryption is an important measure to maintain the security of data when data is in a rest state. By enforcing strong encryption, you can prevent unauthorized access to your data. Backups are also crucial to ensure business continuity, especially with the advent of cloud storage. It's important to protect such data by using strong encryption algorithms, which can make it difficult for bad actors to decrypt it.

It is advisable to test software in a lower-production environment before updating it to avoid any disruptions. To maintain security and prevent ransomware/malware attacks, it is crucial to frequently update software and firmware. It is important to make updating your software and firmware a continuous process without end.

Multi factor authentication (MFA) can be of different types: 1) Something you know (passwords,pins) 2) Something you have (ID card, badge) 3) Something you are (fingerprints, retina scan) 4) Something you do (behaviour based authentication) 5) Somewhere you are (geolocation security) The combination of these types not only strengthens your security, but also provides defence in depth. The use of multiple authentication controls the access to secure critical system and applications.

In my opinion, it's always best to use a Two-Factor Authenticator on all your accounts. For example, if one of your passwords is compromised, using an application like Microsoft or Google Authenticator adds a layer of security and gives you extra protection. However, remain vigilant as there are various techniques to bypass 2FA...

Every organization should adopt a great action plan, involving a proactive approach to prevention and implementing a continuous employee training program. A great example is the Cybersecurity & Infrastructure Security Agency, they have developed a Cybersecurity Awareness toolkit that you can share monthly within your network or organization, where prevention is at the forefront.

Ensure that the endpoint device and your network are secure. To secure the endpoint device, make sure to use disk encryption, anti-malware, apply the latest patches, enable 2FA, and practice the clear desk policy. Disable USB and CD read/write access, etc. (If possible try not to copy the sensitive data into the local hard drives). To secure the network, use a VPN to connect to the corporate network and avoid using public/insecure cloud storage for saving or sharing data.