United States: Privacy And Cybersecurity Issues Relating To Remote Work
To print this article, all you need is to be registered or login on Mondaq.com.
COVID-19 has brought concerns about remote work into sharp relief and has forced employers to confront myriad challenges relating to privacy and cybersecurity. As businesses scrambled to find new ways to communicate and to safeguard data, cybercriminals wasted no time trying to take advantage of the pandemic. As soon as most states began requiring non-essential employees to work from home last spring, ransomware attacks increased by 148%. Google counted more than 18 million malware and phishing emails each day in April and, by May, the FBI's complaints regarding cybercrime had doubled.
Many people have been wanting to work remotely — full or part time — for years. Work-from-home requirements issued in response to this year's pandemic have helped overcome the preconceived notion held by many that a remote workforce would not be as productive as a more traditional, on-premises workforce. Indeed, data tells us that most employers plan to offer remote work options even after it is safe to have all employees on premises full time. Such employers will need to overcome obstacles relating to cybersecurity and privacy.
Security vs. Simplicity
Employers should have policies governing where and how employers' information is stored and accessed, particularly when storing and accessing this information from outside of a secure office network. Policies relating to employers' data, and customers' data, should balance security and simplicity. The harder employers make it for employees to work, the more motivated employees will be to find simpler workarounds. Those simpler workarounds often are less secure than commercial services and can place the data at risk. By having — and enforcing — policies requiring employees to only use certain services, and by making those services user-friendly, employers can keep their data and their customers' data as safe as possible.
Securing Home Networks & Environment
Just as commercial file storage services often offer more robust security than consumer-grade services, the same is true for home networks. When we're in our offices, our data and devices are often protected by more robust hardware, such as firewalls and policies governing access to various components of our network. Many companies have full-time IT staff or outside consultants, or both, who are constantly updating the business' network security. Most home networks don't have anything close to the same level of security. In addition, home networks have an increasing number of devices connected to them, which cybercriminals can use to gain access to other devices on the network.
It's very difficult to require employees to maintain a certain level of security on their home networks. A more effective approach, in terms of enforceability and compliance, is to have recommendations on home network security settings and requirements regarding computers, tablets, and phones used to access work data. For example, an employer can recommend that home networks have:
- Guest networks that do not permit file transfers.
- Devices that are manually approved before gaining access to the network.
- Passwords that contain a certain number of characters, etc.
An employer can require that computers used to access work data disable file sharing and various incoming connections, contain certain security mechanisms, and be accessed solely by the employee.
Home environments also pose challenges. For example, always-on cameras and microphones can detect and record what are supposed to be confidential meetings. Visitors can also overhear what should be private conversations. Employers can't mandate who is and isn't in a home where an employee is working, but it can help for employees to be more situationally aware and have a dedicated workspace, which may be free of smart devices, nanny cams, and other threats to privacy or confidentiality.
Video Conferencing
In 2020, we've heard toilets flush during a Supreme Court argument, we've learned a new term — "Zoombombing"; and we've celebrated birthdays, holidays, and lifecycle events on Zoom. While a number of concerns about videoconferencing are related to productivity and professionalism, there are also several privacy concerns regarding meeting attendees, file sharing, and screen sharing.
Employers should make sure their policies around videoconferencing include ensuring that users have to register for a videoconference; that meetings require passwords and, where possible, waiting rooms; that screen sharing/recording and file sharing are controlled by the meeting organizer; and that the meeting organizer has the ability to remove participants who aren't invited or cooperating from a meeting.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
POPULAR ARTICLES ON: Privacy from United States
November 01, 2020 at 06:30PM
https://ift.tt/3mHTFYI
Privacy And Cybersecurity Issues Relating To Remote Work - Privacy - United States - Mondaq News Alerts
https://ift.tt/2VuKK1x
Work
No comments:
Post a Comment