Securely Transition back to the Office from Home
While many companies are today working from home, at some point, the workforce will return to the office. It is not clear what this will look like; it may be a small portion of workers heading back in phases or everyone at once. There is also the possibility that working from home will remain the norm and working in an office becomes a scheduled routine. Regardless of the when, how, or how many, managing cybersecurity risks during an office homecoming after adapting to remote work can be challenging. Establish a post-COVID cyber baseline as devices and people return to the office can minimize cyber threats allowing for a secure transition back to the office from home.
Password Protection
When organizations quickly pivoted to work-from-home, they adapted quickly to facilitate work with new software and tools and reduced availability of people in critical roles. During that period of rapid transition, people could have potentially shared passwords to essential systems of business with co-workers. This could include sharing passwords to laptops and video conferencing services used at home by family members. Resetting passwords on laptops and essential accounts and ensuring multi-factor authentication is enabled are also good measures to protect data during the tradition back to the office
Unmanaged Laptops
In a rush to get people working remotely, not every employee was able to take a company laptop home. In some cases, the company laptop failed during the stay-at-home. This forces employees to use personal devices to connect to the company network. Scan the network to identify new or unknown devices.
Information Insecurity
People across the organization have been tasked with getting things done, sometimes putting aside security because of urgency. Sending emails on mobile devices could result in accidental sends from personal emails, and online storage and USB devices could have been used for downloading or printing documents. These activities mean confidential information or PII data may be everywhere. Use SIEM alerting on common file storage services and personal emails with attachments.
Get Your Equipment Back
Many organizations are susceptible to lost hardware during times of rapid change. Furloughed employees may still have their company-issued laptop, while others took advantage of the swift deployment of working from home to grab a device from the office. Lingering devices put you at risk of data loss or a network breach. Update laptop and mobile device inventory and disable missing devices. This will help ensure no gaps in your device inventory allowing for a secure transition back to the office from home.
Software Check
Working from home likely required software installs, whether for office productivity, video conferencing, PDF-converters, or electronic signatures. Some software even supported virtual happy hours and entertainment to keep teams connected. Some of these new software may not meet company requirements or could have vulnerabilities that put your company at risk. Scan for laptops for unauthorized software and potential shadow IT.
Catching Up on Updates
Application and operating system updates were likely part of your work-from-home cyber strategy. But this may not have included infrastructure devices supporting the physical office and changes to firewall policies, cloud security groups, and other security software that is just as essential to update to keep the organization protected. Scan, prioritize, and update infrastructure devices and policy rules
Security Awareness
As people return to the office, the pace and focus will be on connecting and restoring the workload. People will be busy playing catch-up and not necessarily focused on cyber threats. With six out of 10 people reporting they have fallen victim to a phishing scam before the rise in attacks during the COVID crisis, it stands to reason phishing and ransomware will continue.
Include cybersecurity awareness into the return to office messaging. While another significant shift in the work environment may seem daunting, the investment in work-from-home security sets companies up well for returning to the office. Keeping track of what was done as people shift to work-from-home will give organizations a stable baseline. Track what worked well and use the things that did not work as well to make security modifications and tighten access restrictions. These lessons learned will only enhance your organization’s ability to be agile if any significant disruption happens again.
