Another week and the COVID-19 cases in Australia keep rising to force hundreds of businesses to adopt a working-from-home model. While adopting a working-from-home model can be incredibly helpful to reduce typical overhead fees, it can also greatly increase security risks to your business.

In response to the growing home office solution that businesses have been embracing, ASIO has recently published a Security Manager’s Guide: Working from Home to assist business owners and managers in creating a secure environment for staff working at home. ASIO’s document identifies many common home office security risks and provides suggestions on how to mitigate these risks.

So what are the common security risks of working from home?

We’ve broken the common risks down into categories with the guidance of ASIO’s security guide.

Policies and Procedures

When asking staff to work from home, it wouldn’t be unprecedented to assume that common policies and procedures will be forgotten. The shift in environments may distract staff from adapting previous policies to their home offices.

In these cases, where the staff implement their own security measures based on individual risk tolerance, sensitive information such as financial details, customer contact details and supplier lists can easily be accessed by unauthorised persons. Security compromises could be as simple as leaving sensitive information on the table when friends or family come to visit.

To mitigate these types of risks at home, businesses are recommended to ensure that their policies and procedures are implemented during working-from-home periods.

ASIO state that an organisation’s policy and procedures should include clear guidance on the following:

– What is allowed: printing, cameras, microphones, use of social media, bringing your own device, connecting to WiFi networks and accessing websites?

– What is not allowed; for example, financial transactions, processing of sensitive or personal data, or some information technology (IT) roles?

– What is required for the transport and destruction of sensitive material and assets, including mobile devices and removable media?

– Whether maximum storage periods apply for certain information or assets in a residential setting?

The recently published document also encourages organisations to consider:

– A formal employee briefing and agreement that the employee understands and will comply with all procedures and security requirements.

– The organisation’s security, workplace health and safety, and human resources policies and procedures apply when working from home should be followed.

– Any financial expenses, taxation and insurance obligations incurred, either by the organisation and/or the staff member.

– A regime for ongoing, regular compliance audits.

– A process for employees to return information and assets to secure facilities, once the need for extended working from home arrangement has passed.

Security Awareness

The drastic change in environments for staff may result in reduced security awareness. The idea is that a reduction in contact time between security and staff will lead to varying levels of security awareness. Some staff may value security highly while to others, their homes create a false sense of security which can lead to enormous security issues.

As a result of varied security awareness, ASIO has recommended that organisations ensure that their workforce have been given appropriate security awareness training.

Some training tips provided by ASIO include:

– Identifying continued security threats and risks.

– Maintaining the need-to-know principle.

– Being vigilant and reporting any suspicious activity or incidents.

– Continuously seeking to identify and suggest improvements to security.

Mobile Device Security

Mobile devices that store and allow access to sensitive business information are found everywhere. Unfortunately, these devices are mobile and therefore can easily be misplaced, lost or stolen. A combination of reduced security awareness, unimplemented policies/procedures and access to mobile devices can lead to disastrous outcomes for organisations.

The theft or loss of a mobile device such as a laptop with sensitive information could result in further security breaches, lawsuits or financial loss to your organisation.

In response to the importance of mobile device security, ASIO has outlined several mitigations that an organisation can implement to reduce security risks associated with mobile devices.

– Ensure that the organisation systems and applications, including virtual private networks, firewalls and remote desktop clients are up to date with the most recent security patches installed.

– Implement multi-factor authentication for remote access systems and resources (including cloud services).

– Virtual Private Networks (VPNs) allow remote users to securely access an organisation’s IT resources, such as email and file services. VPNs create an encrypted network connection that authenticates the user and/or device, and encrypts data in transit between the user and the organisation’s data. If your organisation is already using a VPN, make sure it is fully patched. Additional licenses, capacity or bandwidth may be required to support increased working-from-home arrangements.

– Ensure that staff are informed and educated in cyber security practices, such as detecting socially engineered messages and not clicking on suspicious links or files.

– Devices used for working outside an office environment are more vulnerable to theft and loss. Whether they are using their own device or the organisations, ensure staff understand the risks of leaving them unattended, especially in public places. When the device is not being used, encourage staff to keep it somewhere safe. Make sure devices encrypt data whilst at rest, which will protect data on the device if it is lost or stolen. Most modern devices have encryption built in, but encryption may still need to be turned on and configured.

– Ensure staff understand the importance of keeping software (and devices) up to date, with regular reminders.

– The majority of devices include tools that can be used to remotely lock access to the device, erase stored data, or retrieve back up data. Organisations should use mobile device management software to set up devices with a standard protection configuration.

– Make sure staff know how to report any mobile device problems. This is especially important in a security context, where this may indicate a compromise to a device.