Home Working Can Often Be A Security Threat

The majority of small business owners let their employees work remotely when it’s needed, but often many haven’t trained those employees on cyber-security. It’s a gap that could leave businesses open to a cyber attack, according to the US Nationwide Insurance company.
 
In the company’s latest annual survey of small business owners, it found that one-fifth of small business owners have not provided formal cybersecurity training for their employees. The security lapses employees may have at remote locations represent one of the largest threats to cybersecurity. 
 
An attacker could break into a worker’s computer over a public Wi-Fi network, for example. “What may seem like a harmless public Wi-Fi network could ultimately pose serious troubles for a business,” said Catherine Rudow, Nationwide’s vice president of cyber insurance.
 
While 83 percent of small business owners, and 95 percent of young business owners, allow employees to work remotely, only half have updated their remote security policies in the past year, the survey found.
 
“Many employees may not realise the magnitude of risk associated with a cyberattack as they may not have engaged in a formal training process,” Rudow said..... “The scary truth is that many small business owners, even if they are aware of these risks, have not implemented all the proper measures of protection.”
 
Sixty-five percent of business owners surveyed said they’ve been the victim of a cyberattack. Computer viruses were the most common type of attack, and 7 percent of companies fail to regularly update security software. 
 
Protect Against Ransomware
The Department of Homeland Security (DHS) wants to help small businesses across America protect against ransomware, and the National Cybersecurity and Communications Integration Center (NCCIC) has issued this message:
 
NCCIC has received multiple reports of WannaCry ransomware infections worldwide. Ransomware is a type of malicious software that infects and restricts access to a computer until a ransom is paid. Although there are other methods of delivery, ransomware is frequently delivered through phishing emails and exploits unpatched vulnerabilities in software.
 
Phishing emails are crafted to appear as though they have been sent from a legitimate organization or known individual.
 
These emails often entice users to click on a link or open an attachment containing malicious code. After the code is run, your computer may become infected with malware. A commitment to cyber hygiene and best practices is critical to protecting organisations and users from cyber threats, including malware.
 
How to Protect your Business
Only 4 percent of business owners have implemented all of the cyber-security best practices recommended by the US Small Business Administration, the survey found. 
 
Here’s what the SBA and DHS recommend:
In advice specific to the recent WannaCry ransomware threat, users should:
 
• Be careful when clicking directly on links in emails, even if the sender appears to be known; attempt to verify web addresses independently. For instance, contact your organisation's helpdesk or search the Internet for the main website of the organisation or topic mentioned in the email.
• Exercise caution when opening email attachments. Be particularly wary of compressed or ZIP file attachments.
• Be suspicious of unsolicited phone calls, visits, or email messages from individuals asking about employees or other internal information. If an unknown individual claims to be from a legitimate organization, try to verify his or her identity directly with the company.
• Avoid providing personal information or information about your organisation, including its structure or networks, unless you are certain of a person's authority to have the information. 
• Avoid revealing personal or financial information in email, and do not respond to email solicitations for this information. This includes following links sent in email.
• Be cautious about sending sensitive information over the Internet before checking a website's security.
If you are unsure whether an email request is legitimate, try to verify it by contacting the company directly. Do not use contact information provided on a website connected to the request; instead, check previous statements for contact information. Information about known phishing attacks is also available online from anti-phishing groups such as the APWG.
• Use and update antivirus and anti-spyware software. Most of them can be set to install updates automatically. 
• Secure your networks with a firewall and encrypt information. Keep Wi-Fi networks secure and hidden, and require a password to access the router.
• Set policies for how employees should protect sensitive data like personal information. Also set consequences for violating the policy. 
• Educate employees about cyber threats. Show them how to protect the business’ data and safely use the Internet. Require them to use strong passwords and change them often, ideally with multifactor authentication beyond a password.
• Work with banks and other payment processors to ensure anti-fraud services are in place. See if they offer multi-factor authentication, too.
• Regularly back up data on all computers, including text documents, spreadsheets, databases, financial information, human resources files, etc. 
• Control physical access to computers and other devices that can access the business’ network. Make sure each employee has a separate user account with strong passwords. Give administrative privileges only to those who need them.
• Make a plan for mobile device security. Require users to set passwords, encrypt their data and install security apps to protect information while connected to public networks. 
• Protect all pages on company websites, not just checkout or signup pages.
 
 Fox Business:      US Small Business Administration:        US Small Business Administration
 
You Might Also Read: 
 
How to Ensure Your Remote Employees’ Cybersecurity
 
Creating A  Working Culture Of Computer Security (£):         
 
Half Of UK Businesses Have Fallen For Phishing Attacks:
 
 
« Connected Cars Are The New Attack Vector
Cyberwar Between Nation-States Damages Business »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Brookings Institution

Brookings Institution

The Brookings Institution is a nonprofit public policy organization. Cyber security is covered within the various study areas.

Norton Rose Fulbright

Norton Rose Fulbright

Norton Rose Fulbright is a global business law firm. Practice areas include Data protection, Privacy and Cybersecurity.

Pathway Forensics

Pathway Forensics

Pathway Forensics is a leading provider of computer forensics, e-discovery services and digital investigations.

Data Eliminate

Data Eliminate

Data Eliminate provide data destruction, secure end-of-life IT asset disposal, and data protection consultancy services.

Basque Digital Innovation Hub (BDIH)

Basque Digital Innovation Hub (BDIH)

The aim of the BDIH initiative is to provide industrial enterprises, especially SMEs, with the technological capabilities needed to meet the challenges of industry 4.0.

FifthDomain

FifthDomain

We are a specialist cyber security education and training company tackling the global cyber security skills shortage.

Tactical Network Systems (TNS)

Tactical Network Systems (TNS)

Tactical Network Solutions helps you discover hidden attack vectors in IoT and connected devices before someone else does.

Internet 2.0

Internet 2.0

Internet 2.0 is a Cyber Security technology company with a core focus on developing affordable but sophisticated cyber security solutions.

Sprint Networks

Sprint Networks

Sprint Networks is a trusted compliance and risk program advisor which deliver cost-effective technology to reduce enterprise-wide risk.

Ridge Canada Cyber Solutions

Ridge Canada Cyber Solutions

Ridge Canada helps insurance brokers and insurance buyers understand, evaluate, and secure cyber coverage that is tailored to their business.

Venari Security

Venari Security

Venari is an award-winning cybersecurity SaaS provider that has developed an ETA (Encrypted Traffic Analysis) platform which fundamentally changes the way encrypted traffic is analysed.

Oivan

Oivan

Oivan harnesses the strengths of the web, mobile, cloud, cybersecurity, and blockchain technologies to help our clients to launch transformative digital services.

Protectt.ai Labs

Protectt.ai Labs

Protectt.ai Labs is India’s first mobile security start up building awareness & providing solutions for mobile app, device & transaction security.

ECIT

ECIT

ECIT is your preferred provider of finance and IT services. We believe in the value of combining financial and IT services to streamline and improve the operation of your business.

Allstate Identity Protection

Allstate Identity Protection

Allstate make it easy to provide complete identity protection, so everyone can live more confidently online.

NuKuDo

NuKuDo

NukuDo redefine the boundaries of cybersecurity talent development. We are dedicated to cultivating top-tier professionals equipped to tackle the complex challenges of cybersecurity.