Working From Home: Cyber Hygiene in the COVID Crisis

As corporations and even entire municipalities are increasingly advising or requiring their employees to work from home in light of COVID-19, it is important to remember that doing so it not without its risks. For any organization that has information to protect -- whether customer or employee personal information, financial information, or confidential and proprietary trade secrets -- permitting company data to travel home with or be remotely accessed by employees raises the chances of a cyber incident involving that data. When a “cyber-mishap” occurs, the company may have a duty to report the incident to consumers, regulators and business counterparties. Put simply, cyber criminals are not expected to take a “corona-holiday.” In fact, some might even prey on vulnerabilities created by the situation. Fortunately, there still is time to address the potential privacy and data security risks — and to develop clear guidance for employees to follow. These policies should be tailored to each company’s specific risk profile and communicated clearly to all employees.
While every organization’s information security defenses are unique, some of the most common risks to be addressed concerning remote work include the following: unsecure personal and public WiFi networks; working on unsecure personal devices; transferring corporate data using personal e-mail accounts; synching with personal cloud storage accounts; physical document management and destruction; unsecure connections to employer systems; unsecure conference call lines; and phishing schemes and other frauds. Because many employees are justifiably concerned for the health and safety of themselves and their families, it is understandable if data security is not their first priority. However, with some careful planning, well-defined policies, and transparent communication between employees and management, companies should be able to maintain the security of their data while keeping their employees safe.
Featuring:
-- Nicholas Degani, Senior Counsel, Federal Communications Commission
-- Paul Eisler, Director, Cybersecurity, USTelecom
-- Joseph V. DeMarco, Partner, DeVore & DeMarco LLP