Now that Covid-19 has been declared a worldwide pandemic businesses everywhere are starting to ask employees to work from home. Last week we shared some advice on how to clean your devices and workspaces. Today, we’re sharing some advice to secure your remote workplace from cybercrime. Here are ten easy steps to secure your home working environment.
Step 1: Use Strong Passwords
One of the single most important things to do when thinking about a secure remote workplace is to make sure you’ve got secure passwords. We get it, you’ve heard this all before but it begs repeating: YOU NEED TO STOP USING BIRTHDAYS, NAMES (KIDS, PET, SPOUSE, YOURS), AND THE WORD PASSWORD AS YOUR PASSWORD!
I’m also aware that you do this because you can’t remember more complex passwords. Here’s a little tip that will help, get a secure password manager application. PC Magazine recently rated the best ones for 2020 here. Make sure it works well on both your mobile phone and desktop as you’ll need both.
Now, back to creating secure passwords. It’s simple, the longer your password is the longer it will take to crack it. Also, the more characters you use (i.e., extended the dictionary beyond ABC to 4#@ etc.) the longer it will take to crack. You’ll end up with passwords that look like this:
DPm%N6rc&rhpmkxLO8zhashHQOWh9y$k0#$Y@rseyO%miGWG8Bg%mpHOfYKDR%QY
You can see why you’re going to need a password manager. I created that password using my password manager. Most offer this as part of the application features. You’ll find some sites will limit the length of the password and may also restrict the character set. Good password managers also have options to create passwords with these restrictions in mind.
Make it long, use a mix of characters, use an extended character set and don’t use words or common keyboard paths.
Step 2: Set-Up Multi-Factor Authentication
Now that you’ve tightened up those passwords the next step to a secure remote workplace is to enable Multi-Factor Authentication. This sounds ominous, but it is really quite simple. First, most apps today require you turn it on. This is usually found in the settings under security. It also requires you provide a phone number (usually mobile number).
Once you set it up, when you go to login you’ll receive a text or phone call with a short number or set of characters that you need to enter as a second step to logging in. This ensures that even if someone breaches your password they still need to possess your phone to enter the app.
There are also apps from Microsoft, Google and many other security providers that do this authentication on your phone. With those you simply get an alert that opens the app and then you verify the person attempting to access it is you. It’s really quite simple.
Step 3: Antivirus Software is key to a Secure Remote Workplace
A computer virus is effectively anything that infects your computer and then uses your computing resources against you. Antivirus software protects your computer from common viruses like: spyware, malware, rootkits, Trojans, phishing attacks, spam attack, and other online cyber threats.
Operating a computer without antivirus software is the equivalent of leaving the front door to your house open when you’re away. Unless you are completely isolated, and if you’re on the internet you aren’t, this is like inviting all the bad actors into your house.
Computer viruses can slow down your computer, delete files, reformat drives, cause a crash or data loss, or might take over your computer and demand a ransom to give it back. These are just a few examples of the bad things that can happen, so get that antivirus software installed today!
Step 4: Use a VPN
VPN stands for Virtual Private Network. With a VPN you are effectively creating a secure tunnel across the internet between a secure remote workplace and your business. This is done by encrypting and decrypting the traffic that flows between the two points.
You can’t do this yourself unless you control both ends, as both ends need to support the VPN. Microsoft Windows provides a Wizard for setting up VPNs and you’ll find most servers support VPNs. If you need help setting up a VPN for your small business feel free to contact us. This is a free service we provide to all of our customers.
Step 5: Set-Up Your Firewalls
Your next line of defense are firewalls. A firewall prevents unauthorized access to and from a computer or private network. That’s right, you can setup a firewall on your computer and you can also set-up another one at your internet access point (usually a home router). Essentially, firewalls perform the following tasks:
- Manage and control network traffic
- Validate access to networks and computers
- Defend resources (i.e., files, application access, computer processing, etc.)
- Record what happens across the network
Having a personal firewall in place is important when you access the internet from anywhere. It is particularly important when you connect to a public WiFi. Firewalls help you limit access to your computer and its resources.
Step 6: Secure Your Home Router
If you don’t have a router and are connecting directly to the modem provided by your internet provider, shame on you! You don’t pass GO, don’t collect the money and expect to land in jail (just kidding), but you are extremely vulnerable. GET A ROUTER IMMEDIATELY! Try Amazon or your local Walmart or office supply store.
The first step in securing any home router is to change the password it came with. Make sure the new password is strong (see above). Trust me, every cyber criminal out there knows the password your router came with, so it’s just like the open house door discussed above.
All routers have a network address which is a series of numbers that look like this 192.168.1.1. That’s call an IP address, and you’ll need it to communicate with the device. If you don’t have it simply get the model number off the back and go to the manufacturer’s website to get it and the default user name and password. Yes, they are there for everyone to see so you’ll need to change them.
Connect your PC to the router using an ethernet cable, put the IP address into your browser where you normally put web addresses, and you’ll be prompted for the user-name and password. Once you’ve logged in you can begin configuring the router. Here are some of the basics:
- Create a router name (use something not easily associated with you)
- Change the password using the advice above on creating strong passwords
- Select the encryption method, when in doubt select AES or if your router doesn’t support that select WPA2. If you don’t see either, your router is out of date and you need a new router.
- Plugin the cable from your internet provider in the port labeled internet.
- Update your router’s firmware.
That’s the basics for securing your router against roaming cyber criminals and it is critical to a secure remote workplace. Don’t forget to store the information in a safe place.
Step 7: Install Updates on Devices Regularly
Installing Windows, Apple and Android security updates on your devices is critical to protecting them. Cyber criminals are constantly finding new holes in operating systems and those updates are the vendors closing down those vulnerabilities.
Out-dated operating systems make you susceptible to cyber attack, so when you see a new update is available don’t put it off. Also, cyber criminals look for outdated systems as they are more easily attacked. If you don’t update you are making yourself a target.
Step 8: Backup Your Files
Imagine if your computer hard drive stopped working today, what would you lose? For many small businesses, it is pretty much everything important. This is why you need a backup. You device might fail tomorrow, you might get sloppy and delete something important or god forbid you might have your computer taken over and held for ransom.
You can backup your most important data to an external drive or you can use a cloud back-up services. There are many cost effective backup options on the market. Not keeping a backup is really not an option in today’s environment and it is critical to a secure remote workplace.
Step 9: Encrypt Communications
This sounds like it comes right out of James Bond, but in today’s cyber age it is important. Encrypting communications prevents unwanted third parties from listening in on what you’re saying. Most small businesses think this is unnecessary, but the moment you take a name, number, credit card, license number or social security card you’ll wish the line was secure.
Securing communications isn’t really that hard and it is important to working securely. If you’re using a hosted phone system it is likely just a configuration switch. There are also mobile apps for both Apple and Android phones that encrypt calls. It’s only a matter of time before you discuss something that needs to stay private over the phone. Don’t wait until it is too late, encrypt communications and your one step closer to a secure remote workplace.
Step 10: Lock Your Devices
I have no simple way to say this so here it is: don’t be a dummy – lock your phones and computers when you walk away. The easiest way to gain access to your devices is to walk right up to them when you step away for a moment. Also, putting a virtual lock on your devices makes those trying to access them remotely have to login.
Don’t be lazy, keep timeouts short (no more than a minute) and require a password to re-enter devices. This is easy to setup and one of the most important things to do.
Conclusion
Some of the steps above are harder for computer novices than others. CIT recognizes that you might not feel comfortable doing them all yourself and we’re here to help. Much of what is listed above is provided in our standard service agreements. Even if you aren’t a customer, feel free to contact us and we’ll see what we can work out.
Be smart and be safe as we all hunker down to ride out the Covid-19 storm. We hope you find our 10 steps useful in creating a secure remote workplace.
