Educating remote workers on cybersecurity

Issue 2 2021 Information Security

Cybercriminals have shifted their focus to vulnerable employees who now work from home and use personal Internet connections. Business leaders need to educate remote workers on cybersecurity and better computer safety practices or risk having their data compromised.


John Mc Loughlin.

In a recent study by Microsoft, more than 25% of remote workers had personally experienced a cyberattack. This is largely as a result of employers being forced to quickly implement a remote work strategy and still not having the necessary security, privacy and workplace procedures in place to secure this new environment more than a year after hard lockdowns and work from home orders started around the world.

While most businesses can invest in more robust data protection and security measures, it's their remote workers who can cause a potential disaster as a result of poor, inconsistent security policies and a lack of knowledge on what to look out for and how to behave in this online and hyper-connected world. The lack of effective processes or procedures could compromise critical data and cause disruption with serious consequences.

With digital adoption accelerating, cybersecurity has become a key area of focus because many businesses have already suffered attacks infiltrating their networks or systems over the past year. This is largely due to the rapid shift between on-premises and remote working.

It has required businesses to quickly ramp up their digital transformation efforts by adopting cloud computing and many have unfortunately not realised that the security controls they deploy in the office environment are not exactly the same as what is required in the new world of remote working.

Although some still view remote set-ups as temporary, most employees will most likely be allowed to work remotely in future. It is therefore important for businesses to make sure employees have the technology they need to be productive and know what it is that they need to do to remain secure.

Prioritising cybersecurity

Cyber criminals have become increasingly sophisticated over the past few years and businesses must remain cognisant of evolving threats if they want to protect their information assets. They need to design security controls that are not only effective against threats of today, but also provide the ability to adapt and provide protection against the unknown threats of tomorrow.

Having the best firewall in place at the office doesn't provide protection against threats aimed at people working remotely. It is about more than just a mobile phone and laptop, it extends to reliable Internet access, secure access and processes to attend virtual meetings and access data.

More importantly, implementing a user-centric cyber resilience program that covers insider threats and ongoing user cybersecurity awareness training is crucial.

Sometimes prioritising cybersecurity can be difficult if business executives consider it an unnecessary expense. Unfortunately, they often don't always realise the extent of the losses that will come from a security breach. All it takes is one successful simple phishing scam to be the first step in a total breach and end up in data loss, ransomware or other extortion attempts.

Most companies, big or small, cannot afford extended downtime from a cyberattack, especially while trying to determine what sensitive data was stolen and which regulatory body, customer or supplier will need to be notified of the breach. Smaller businesses are even at bigger risk because the effects of a cyberattack could be more devastating for them and a data breach could mean the end for most start-ups.

Educating employees

Businesses just cannot afford to neglect user-based activity monitoring and cybersecurity awareness training, it could be catastrophic. Education is key to ensuring that businesses are protected from cyberattacks. To be effective, the training must be consistent, engaging and provide real examples of what to look out for to make any difference. Engaging training and an easy-to-use platform will get staff talking about cybersecurity issues and discussion provides greater understanding.

Business needs to hold everyone to the same standard for adopting cybersecurity protocols. Nobody should get a ‘free pass’ when it comes to cybersecurity awareness training because of their designation. Executives are ultimately responsible for the secure use of company assets and must ensure that nobody is allowed to break security protocols.

Cybersecurity practices are sometimes seen as a burden and this could entice remote workers to find workarounds because they believe it might increase productivity. Open communication and practical security controls, with increased visibility, will drive good cybersecurity practices into the DNA of one's remote workforce.

Ensuring total visibility will prevent mistakes, allow one to respond immediately to threats and ensure patches, training and other items are properly managed. Visibility allows one to control compliance and cybersecurity issues and will give a view on anybody who may install unverified apps on their work devices, be it sending sensitive or confidential work documents to personal email addresses or even sharing passwords.

Work devices have now also become personal devices, remote workers also often let family members use their work computer for non-work-related activities. Allowing family members to use a work device could expose the entire corporate network to significant risk and every business needs to assess their policies and measure their risk exposure when personal activity is conducted on work devices.

In certain instances, this might not be allowed at all and clearly explaining this to the users is critical. However, until one has visibility, there is no way of knowing what is really happening at the end-point, it will just be a guess. Guesswork is not a recommended method to ensure data security.

Employers should make sure that they have visibility of what is really taking place with their data and on their systems to reduce their risk exposure. This is bolstered by educating their remote workers on what to look out for and how to identify potential breaches.

While it’s near impossible to stay entirely secure, there are basic rules that remote workers can follow to reduce the risks in this new working environment and total visibility and monitoring gives you the capacity to respond to changes before damage is done.




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Highest increase in global cyberattacks in two years
Information Security News & Events
Check Point Global Research released new data on Q2 2024 cyber-attack trends, noting a 30% global increase in Q2 2024, with Africa experiencing the highest average weekly per organisation.

Read more...
Upgrade your PCs to improve security
Information Security Infrastructure
Truly secure technology today must be designed to detect and address unusual activity as it happens, wherever it happens, right down to the BIOS and silicon levels.

Read more...
Open source code can also be open risk
Information Security Infrastructure
Software development has changed significantly over the years, and today, open-source code increasingly forms the foundation of modern applications, with surveys indicating that 60 – 90% of the average application's code base consists of open-source components.

Read more...
DeepSneak deception
Information Security News & Events
Kaspersky Global Research & Analysis researchers have discovered a new malicious campaign which is distributing a Trojan through a fake DeepSeek-R1 Large Language Model (LLM) app for PCs.

Read more...
SA’s strained, loadshedding-prone grid faces cyberthreats
Power Management Information Security
South Africa’s energy sector, already battered by decades of underinvestment and loadshedding, faces another escalating crisis; a wave of cyberthreats that could turn disruptions into catastrophic failures. Attacks are already happening internationally.

Read more...
Almost 50% of companies choose to pay the ransom
News & Events Information Security
This year’s Sophos State of Ransomware 2025 report found that nearly 50% of companies paid the ransom to get their data back, the second-highest rate of ransom payment for ransom demands in six years.

Read more...
Survey highlights cost of cyberdamage to industrial companies
Kaspersky Information Security News & Events
The majority of industrial organisations estimate their financial losses caused by cyberattacks to be over $1 million, while almost one in four report losses exceeding $5 million, and for some, it surpasses $10 million.

Read more...
Digital economy needs an agile approach to cybersecurity
Information Security News & Events
South Africa is the most targeted country in Africa when it comes to infostealer and ransomware attacks. Being at the forefront of the continent’s digital transformation puts South Africa in the crosshairs for sophisticated cyberattacks

Read more...
SIEM rule threat coverage validation
Information Security News & Events
New AI-detection engineering assistant from Cymulate automates SIEM rule validation for SecOps and blue teams by streamlining threat detection engineering with automated testing, control integrations and enhanced detections.

Read more...
Cybersecurity a challenge in digitalising OT
Kaspersky Information Security Industrial (Industry)
According to a study by Kaspersky and VDC Research on securing operational technology environments, the primary risks are inadequate security measures, insufficient resources allocated to OT cybersecurity, challenges surrounding regulatory compliance, and the complexities of IT/OT integration.

Read more...










While every effort has been made to ensure the accuracy of the information contained herein, the publisher and its agents cannot be held responsible for any errors contained, or any loss incurred as a result. Articles published do not necessarily reflect the views of the publishers. The editor reserves the right to alter or cut copy. Articles submitted are deemed to have been cleared for publication. Advertisements and company contact details are published as provided by the advertiser. Technews Publishing (Pty) Ltd cannot be held responsible for the accuracy or veracity of supplied material.




© Technews Publishing (Pty) Ltd. | All Rights Reserved.