Secure Remote Working at Short Notice
?? Amy Stokes-Waters
Esc | Cyber Escape Rooms | Security Education & Awareness | Experiential Learning | Corporate Events | Non Exec Director | Full Time Feminist | Oh FFS...
With a lot of us hibernating for the foreseeable future at home, enabling remote workers to continue working securely has become a top priority for many organisations. Here's the Identity Experts' Top 10 Tips for Secure Remote Working!
1. Set Expectations
Make sure your employees know what is expected of them when working from home. Most organisations employ a more flexible working schedule for remote workers, especially those who have small children to care for at the same time. Giving your workers some clear guidelines about activities you expect them to be able to complete and what working from home means will ensure that you get the best from your team!
2. Standardise your Communication
With mental wellbeing being a big priority, making sure you keep lines of communication open between your team will ensure your employees don't feel isolated in what is currently a stressful situation for a lot of people.
At Identity Experts, we've set up a daily Teams call for everyone to jump on at lunch time to keep communication open across the organisation and make sure we're continuing to collaborate and team build throughout this extended remote working period!
3. Take Advantage of Teams
Having a collaboration platform in place where you can video call, work on documents together, and instant message makes the big wide world feel a little bit smaller! A lot of businesses are already leveraging Teams within their organisation, but if you're not already on the platform, Microsoft are offering a 6 months free trial for businesses. You can get more information on it here: https://bit.ly/TryTeams2020
If you need some guidance on setting up Teams, we are running a webinar on Friday to help businesses of any size get their basic configuration right: https://bit.ly/SetTeamsUp2020
4. Update Operating Systems & Antivirus Software
For those businesses with corporate devices supplied to employees, you'll want to make sure your OS and AV are as up to date as possible! Patching should always be at the top of your list for good security hygiene, but it's more important than ever to have a strong patching process in place for your corporate devices, especially with people working from potentially unsecured networks.
5. Enable BYOD & Corporate Device Management
Allowing employees to use their own devices to access corporate data might seem scary, but it'll keep your business more productive in the long run. Using Microsoft Intune, you can manage devices and applications remotely, forcing specific security configurations on devices accessing corporate data.
There are also capabilities around stopping the copying of corporate data to a non-corporate application e.g. preventing copying your Salesforce information to Apple Notes! Selective remote wipe helps when devices are lost or stolen. The possibilities are many!
For corporate devices, you can leverage Autopilot to automatically configure devices and send them directly from the supplier to your end user, without the need for IT intervention at the office. Great for if a laptop dies while we're in this enforced period of isolation!
6. Provide Data Handling Guidance
Your data is what makes your business valuable. Ensuring your employees know how to properly handle sensitive information is key to avoiding breaches, GDPR fines, and damage to your reputation.
Make sure you have policies in place so people know how to store, share and dispose of corporate data. Implementing a tool like Microsoft Information Protection can help with data classification and stop you from accidentally sharing data outside of your organisation. Microsoft Cloud App Security can block file storage applications outside of those sanctioned by your organisation.
7. Make Internal Apps Available Externally
On-premises applications needn't stay there! You can use Azure AD App Proxy to push internal applications out to the cloud, giving your users access to line of business applications when they're working from home. Using the tools available in Azure AD to implement proper identity security tooling means your data stays secured.
8. Use MFA
For the love of all that is holy, please switch on MFA! With 80% of breaches caused by password leaks, and MFA stopping 99.9% of credential-related attacks, if you haven't got it enabled, now is the time to do it!
Passwordless Multi-Factor Authentication is now available with ALL flavours of Azure AD, meaning those of you with just a consumer Outlook account can switch it on and take advantage of the authenticator app for biometrically authenticating!
9. Azure AD is more than MFA
We know MFA can sometimes be a pain in the arse. To make it easier for your employees, try using Risk Based Conditional Access policies to assign a risk rating to each sign-in session and let machine learning decide on whether MFA is required. High-risk sessions can even require password resets, or can raise an alert for your IT team.
If you want to discuss how to get the best use of your Azure AD subscription, get in touch!
10. Security Awareness Training
With the team holed up at home, now might be the time to get them on some remote security awareness training. The number of phishing emails we've seen where a bad actor is imitating the World Health Organisation, NHS or other health-provider is frankly quite scary! You want to give your team the best chances of spotting these scams... investing in some remote training wouldn't be a bad idea!