Working from home a cybersecurity headache for employers

Bloomberg

As companies and government agencies send their employees home to avoid contact with the coronavirus, many cybersecurity teams are facing the unenviable challenge of securing sprawling, vulnerable networks.
Every time an employee connects to their corporate network from home, they’re creating possible access points for hackers to exploit. When this happens 1,000 times on a single network almost overnight, as it has amid orders for regional lockdowns, it’s increasingly difficult to ensure every connection is secure.
The specific security challenges are wide ranging. While those using company-provided laptops are likely protected by internal safety measures, they could still be vulnerable if their security software isn’t updated or their remote network connection isn’t perfectly configured. The bigger problem is employees using their own equipment that security teams can’t monitor for malicious traffic. For all they know, these devices may already be infected with malware.
The challenge can overwhelm security personnel, especially for those companies that have previously discouraged employees from working from home. Pivoting from office desktops to laptops at home are projects that security teams at large companies
execute over months.
Instead, the shift to working at home has happened in days. And with so much emphasis placed on simply making sure company operations don’t come to a grinding halt, network
security can be an afterthought.
A major power utility in southern Europe, for instance, sent home hundreds of employees last week. In a matter of three days, the company increased remote accessibility from just 9% of their machines to 53%, said Andrea Carcano, founder and chief product officer at Nozomi Networks Inc., an industrial security company in San Francisco.
The huge influx of people working at home has expanded the places hackers can exploit. As companies across Europe and the Americas come to grips with this new normal, hackers are tweaking their attacks — sending phishing emails that claim to be about the coronavirus or purport to be from a trusted health agency — to leverage fear of the global pandemic.
Hackers appear to be targeting the most vulnerable. Data analysis from Italy indicates that companies that have quarantined workers or instructed them to work from home are prime targets for attackers, according to Cynet, a New York-based cybersecurity company.
With a daily onslaught of scary news about the virus, people who are working at home may be more likely to click on bogus misinformation links spread on social networks, cybersecurity experts said. And because they expect to get out-of-the-ordinary emails from their IT staff, they may be more likely to click on phishing messages.
Employees can do their part at home. Updating passwords and using paid virtual private networks and multi-factor authentication are a good start, experts said. Keeping kids off your personal computer, if you use it for work, is a good idea, too, because they could download games or other material infected with malware.
If you want to go the extra mile, buy a home router kit that lets users segregate their networks, said Aaron Zander, head of IT for San Francisco-based HackerOne Inc., a vulnerability detection and coordination platform. He warned that allowing “internet of things” devices — such as Amazon’s Echo speakers and security cameras — to live on the same network as corporate data further expands the attack surface.
“Everyone needs to be more diligent,” Zander said. “If you get an email asking you to make payment, it’s important to verify who that message is coming from.”