How to keep your business safe when staff are working from home

1. Do a phishing simulation

Your staff wouldn't fall for a phishing scam. Would they? With so little personal contact going on, it's a good idea to check by running a phishing simulation. Who's tempted to click a dodgy link and who's more wary? We organise periodic simulations for SMEs that use our CyberSterk service. Both staff working from home and those still in the office are sent a dummy phishing mail, selected from forty templates. The way they respond is logged centrally and the findings summed up in a clear report.

2. Use multi-factor authentication (MFA)

With lots of people using their own equipment, it's important to consider how they access your business applications. Connections need to be secure. One thing that's easily set up but has big security benefits is requiring home-workers to use multi-factor authentication when logging in. So, as well as using a password, for example, they have to enter a code sent by SMS or generated by one of the many popular authentication apps.

3. Be creative with your messaging

In the security chain, the weakest link is often human. So providing information can help. A simple way of boosting security awareness is to build security tips into the screensavers on company laptops. However, experience shows that people are more likely to take advice on board when given the chance to put it to practical use. So get creative! What about hiding ten security issues on a network drive – unprotected personal data, a list of user names, etc – and offering a prize to whoever finds them first? Or use a videoconferencing app to hold a company-wide cybersecurity quiz. With apps such as Kahoot! a quiz can be a fun way of getting people involved.

4. Limit non-essential use of your company network

In the fast-moving present circumstances, it's important that both your company network and the connections with your staff's home networks are used only for their intended purposes. Curtail unnecessary network applications and allow access only to essential services. Your staff don't need to use the company network for downloading torrents or watching Netflix. Provide everyone with guidelines on what they should and shouldn't use the company network for. If necessary, set up your firewall to block non-essential applications. CyberSterk features external connection monitoring and can be configured to alert you in the event of a network user doing anything inappropriate.

5. Beware of IoT devices

IoT devices – 'smart' gadgets for the home or office – connect to the internet of their own accord. That goes for smart speakers, IP cameras, app-controlled lights, intelligent fridges and lots of other things. Handy though such gadgets are, many aren't secure. Weak passwords are commonplace and manufacturers often don't update their firmware promptly (if at all) when security issues come to light. As a result, IoT devices connected to your company network or an employee's home network can be used to gain unauthorised access. We therefore advise connecting them to a separate network, so there's no unlocked back door to critical systems.

6. Limit the number of applications used for home working

Cloud-based file storage, internet videoconferencing, online whiteboards, programs such as Microsoft Teams and Slack: this seems like a great opportunity for trying them out. However, people exploring unfamiliar territory are more easily led astray. An inexperienced user might get tricked by, for example, an e-mail supposedly from a cloud service provider, telling them that a colleague wants to share a document. By limiting the number of applications in use, you make it easier for staff to get to know them and to spot associated scams. Another consideration is that applications aren't all as careful with your data as you might want. It was recently reported, for example, that a popular videoconferencing application was sharing data with Facebook. Another good idea is to make a list of approved applications and share it with your personnel. That way, everyone knows what's allowed and what your company policy is.

7. Keep your software updated

It might sound like a no-brainer, but in practice lots of firms don't get round to updating their software to the latest versions. Maybe the update notice arrives when there's a rush job on, or everyone thinks that someone else has got it covered. Very understandable, but problematic all the same. Because, without a systematic approach to software maintenance, there's a risk of cybercrooks exploiting vulnerabilities in old software to hack your systems.

8. Make sure everyone's got a good virus and malware scanner

For staff to work safely from home, they need to have good virus and malware scanners installed. A lot of home equipment doesn't have a scanner installed, and people often disable the security features they've got. Although most scanners continuously monitor what the user's software is doing, we advise periodically running full scans as well. A full scan can take a while and make a computer run slowly. So maybe consider setting the scanner up to run once a week at the end of a working day. Then, the rest of the time, your staff can get on with their work as normal.