Staying safe while the world works from home

Working from home used to seem something of a luxury, reserved for those whose work might not rely on customer interaction or face to face meetings. But since April of this year, the number of people working from home has dramatically increased, due to the risks associated with COVID-19. This trend has spanned most major sectors of the industry—education, healthcare, public works, finance—and it’s happened fast—maybe too fast.

The Adjustment Period

People want to keep working, and businesses want to keep trading; so, as we all moved indoors, and frantically rearranged our living room to have an appropriate video conferencing background, the priority was to continue operations as usual. Unfortunately, the urgency to keep things moving meant that cybersecurity around employees working from home was thoroughly neglected.

Every time an employee connects to a corporate network from home, it’s a new access point that can be targeted by bad actors. Most people working at home—many of whom who will be doing so for the foreseeable future—are still adjusting to their new set up. Employees may need to access files, accounts, and applications, and Windows for Active Directory (AD) is still the most commonly used platform for doing so.

However, Active Directory offers inadequate protection even within normally-functioning businesses; as companies and schools were forced to transition to at-home systems, they rushed to allow Remote Desktop (RDP) access. Remote desktop access allows employees to tap into resources they need, without having to be on-site, at a specific computer. Again, the need for business to continue as usual overtook the pressing need for cybersecurity.

The single best thing companies and individuals could do to improve security would be to protect the remote use of their Active Directory credentials.

Gone Phishing

The other threat that is thriving in the new COVID-world is a new onslaught of Phishing emails, many related to the coronavirus itself, or exploiting the reactions in some way. Bad actors are, as per usual, interested in targeting the most vulnerable: and now they have a population of newly-remote workers to focus on. Especially in a time of psychological vulnerability, the temptation to click-and-connect is intense; employees who are working at home alone, day after day, are yearning for distraction and are more likely to click a bad link.

By targeting remote desktop access points with weak security systems, bad actors/hackers can steal employee credentials. This is much more dangerous than it might sound to people who are merely accessing personal files, or low-security applications, to begin with. But attackers want to then escalate privileges, and move laterally within a corporate or scholastic network, looking for any data of value.

It’s also highly likely that if an individual has been hacked, or a whole system breached, no one will know about it. It often will take over six months for a company to even discover data breach – saying nothing about how long it might take to contain.

So, how can a business protect itself?

The most important thing a company could do is protect remote AD login credentials. While strong user passwords, the use of Virtual Private Networks (VPNs), and enabling multifactor authentication are the basic guidelines for security, most businesses are out of time, and employees have already been working from home for a few months.

4 tips to reduce the risk, right now:

1. Strengthen your password management policy:
   Instead of arbitrary password requirements like a capital letter, five special characters, and two numerical digits, NIST guidelines point users in the direction of using lockout policies and checking credentials against a blacklist of the latest data breaches.
   
   
2. Keep a close eye on external access:
   Supervising remote desktop connections and checking up on who is accessing which files, when, is a great way stay alert to cyber attacks. Do you know who should be accessing the system and when? Hold your employees accountable if suspicious activity is detected.
   
   
3. Stay flexible and promote an open line of communication:
   Many employees are new to the remote/at home way of working. It benefits everyone to provide clear instructions on what they are allowed to access, as well as promote an awareness of the security risks linked to remote set-ups. Managers who are well-informed can lead by example, and maintaining good communication about security issues will decrease the fear and nervousness many remote workers harbor.
   
   
4. It’s not too late to implement an equipment policy:
   Though guidelines and regulations are changing constantly, it’s certain that the world has learned to what extent employees can actually work at home. But it’s important to stay safe by keeping home and work separate, especially when it comes to equipment: establish a policy that requires employees to use job-related computers and devices strictly for job-related work. When this is not possible, give security guidelines to employees, and require employees to use a VPN.

Enzoic tools are the most efficient way to up system-wide credential security.

Enzoic for Active Directory enables password policy enforcement and daily exposed password screening to secure passwords in AD. With a fully automated compromised password detection, custom password dictionary, blocking of username derivatives, fuzzy matching with common character substitutions, and continuous ongoing monitoring, enterprises can easily adopt NIST password requirements and eliminate vulnerable passwords.

Our threat researchers continuously scour the public Internet and Dark Web to find credential leaks and immediately report details on any compromised username for a business’s customers, employees or partners. An enterprise can subscribe by domain or named account and receive exposure alerts about compromised accounts.

 

By: Bronwen Hudson