With the unprecedented increase in staff now working from home, have you considered if your network is secure enough to keep your data and applications safe? Has your organisation created an unprecedented increase in potential cybersecurity gaps?
You can help to close the gap with multi-factor authentication software that should be enabled to protect all internet-facing applications. Multi-factor authentication is easy to use, a single mobile app to provide a second form of authentication to verify the identity of users connecting to your network.
To help organisations through this challenging time we have prepared a best practice checklist for delivering remote access during the increased demand of COVID-19.
1. Make it Easy
- Make remote access easy for users to get started. Users may need to configure remote access themselves so the process needs to be easy to understand and complete.
2. Use Multi-Factor Authentication
- Secure all internet-facing applications with Multi-Factor Authentication. This includes applications such as Office 365, G Suite, Citrix, Terminal Services and remote access VPNs. Multi-Factor Authentication is the single most important system that can be put in place to secure the organisation's systems. Myrtec offers a simple, yet capable, multi-factor authentication solution for businesses which can protect your entire network and data, all through a simple to use mobile app.
3. Install Antivirus and Updates
- Ensure all connected devices have Antivirus software with real-time protection enabled. Make sure company-approved antivirus software is included on all remote access devices and set to update regularly. Computers should have Windows Updates enabled and all recent updates applied. We recommend that all home users install Sophos Home Free on their Windows or MAC devices which provides significantly higher levels of protection that the includes antivirus in Windows.
4. Encrypt remote devices
- Encrypt remote devices as there is a higher risk of devices being stolen when they are being used remotely. Most devices include native encryption tools such as BitLocker – but they are not enabled by default.
5. Be extra careful of emails
- Communicate to staff to be extra vigilant working with emails from home as there would likely be a significant increase in emails as colleagues cannot speak to each other in person. At the same time there is an increase in phishing and scam emails being sent around the coronavirus that users need to ensure they do not click on.
6. Secure remote connections
- Ensure that all remote access is secure and encrypted. Using a Virtual Private Network ensures that all data transferred between the home user and the office network is encrypted and protected in transit.
7. Limit access to resources
- Only allow access to necessary internal resources. If a department only accesses one application on your internal network only provide them with access to that application. These rules can be configured from any modern firewall.
8. Look for opportunities to migrate data to the cloud
- Confirm if any applications or data can be migrated directly to a cloud-based application. For example, if you already use Office 365 can you migrate your file shares directly into SharePoint in Office 365 or your accounting system into Xero.
9. Check internet bandwidth and limits
- Do staff have internet bandwidth at home to support working remotely? Will they be doing a lot of video conferences in Google Meet, Microsoft Teams or Zoom which can consume large amounts of bandwidth. Do the staff hand caps on their internet usage that will be breached.
10. Check software licenses
- Review your licenses for applications such as Terminal Services which may not have enough licenses available for all staff to work from home. If additional licenses are required service provider licenses can be used which can be charged on a month-by-month basis instead of purchased outright.
11. Have staff self assess their equipment
- Have staff complete a checklist if they are using their personal device, along with the general working from home policy staff should be verifying that their device is secure and that no company data will be saved onto the device. Does this personal device need to be managed by the organisation to ensure compliance while the staff member is working from home?
12. Check out additional equipment
- Do staff need to take additional equipment home with them such as monitors and docking stations. Is there a check-in/out process for this equipment.
13. Manage phone calls
- Can staff access their phone calls when remotely or divert their office number to their mobile device? Using a cloud-based phone system enables organisations to access their phone system from any location.
If you have any questions please contact Myrtec. Myrtec can also provide Microsoft Service Provider Licenses and Citrix Service Provider licenses for Terminal Services/Remote Desktop on a monthly basis and assist with the implementation of any of the above solutions.