How to Talk to Remote Employees About Cybersecurity

Remote work is becoming more popular than ever. Employers realize the cost-saving and productivity-boosting benefits of having their teams out of the office and working from their homes, and things seem to be going well. However, one issue that continues to plague remote teams is the possibility of cybercrime and data breaches. Hackers know that remote employees are often not as equipped to thwart attacks and target them with a vengeance. 

The solution is for management and administration to train and educate their teams on cybersecurity. Talk to your employees about what they can do to protect their company and the customers' data from the machinations of cybercriminals. 

Let’s get specific on how you will make this happen.

Cybersecurity Training Is Key

To start your team off on the right foot, your company should incorporate an extensive cybersecurity training program into your employee orientation schedule. This will give them the training they need from day one. Wizer is a great tool that provides effective and thorough cybersecurity training for teams. 

Explain the Consequences of a Cyberattack

Remote employees have the best of intentions but may not realize the stakes of a breach at your organization. When working from the comfort of home, cyberthreats seem distant and it’s easy to forget that anyone can be the weak link that allows a cyberattack to succeed.

During instruction, give the team a clear picture of what your organization and the individuals on your team will face if a breach does occur. Common consequences resulting from a breach are:

• Reputational damage to the corporation that leads to job loss
• Corporate responsibility for millions of dollars of damages and fines resulting in lay-offs
• Legal repercussions that force the company to close its doors

The point is that cybersecurity is the responsibility of every employee, from the CEO to the mailroom clerk, and it’s in everyone’s best interest to protect the company and its future. 

Confirm Employees’ Understanding

Once their cybersecurity training is complete, every employee should sign off on a memo stating that they understand the crucial nature of what they learned and may be held responsible if they fail to report a potential threat.

Revisit and Refresh Cybersecurity Training

Cybersecurity training is not one-and-done. As vulnerabilities get patched and people become wiser to common scams, cybercriminals adapt accordingly with ever more sophisticated attacks. When your IT team learns of a new cyber threat, management should require all employees to undergo supplemental training that prepares them to handle it appropriately.

Report Attempted Attacks

Every organization should have a designated cybersecurity point of contact. Ideally, this will be someone who has a background in cybersecurity or has at least taken additional training in cybersecurity best practices. When an employee receives a suspicious email or other suspected cyberattack, they should let the internal point of contact know immediately. 

Employees can also help make the internet safer by reporting phishing attacks to organizations like the Anti-Phishing Working Group (APWG) by forwarding phishing attack emails to [email protected]. APWG, and groups like them, analyze and share data from reports to help stop cybercriminals before they can victimize others. 

Talk About Sharing Data

Now that your remote team members understand the big picture, teach them where their data is shared and how to properly access, share, and use it to minimize risk. 

Sharing Data on the Cloud

Almost all companies now use some form of cloud storage or service. A common example for most of us is our email account. Take Gmail: Google has floor space for servers and hardware and maintains all the software that allows you to log into your account from anywhere. Gmail is an example of a public cloud. 

Your team should know the differences between public, private, and hybrid clouds and the associated risks in using each. Your IT department may have different policies for each type of service.

Public accounts are generally the least expensive but are also the least secure. A third party such as Google, Amazon, or Microsoft handles maintenance which frees up your IT team’s time. In return, you sacrifice security and control.

Private servers are owned and maintained by a private organization. They offer your team greater security and flexibility, but the price can be prohibitive. 

Hybrid cloud accounts are a combination of both public and private. An organization may use a public cloud for email but restrict sensitive data to a private cloud. 

It is important to inform your teams that even with some protection on the cloud, they still need to keep watch for scams and inform management if they see anything suspicious. 

User Access 

Remote employees should know that not everyone in the organization is entitled to see and use the same data. Every employee should only have access to what they need to do their jobs and should not share information unless they are given the approval to do so. 

To make this process easier to understand, consider creating an organizational chart that includes the title and clearance level of every employee. That way, when in doubt, your team can refer to the organizational chart and see what sensitive information can be passed to which team members. 

Create and Follow Smart Security Practices

Off-Board Employees Properly

Note to management: when an employee leaves your organization, you must revoke their system access so an upset former worker can’t get in and steal or manipulate your data. Having strong off-boarding procedures will simplify this process, while tools like a password manager can make it even easier. 

Make Training Best Practices into Company Policy

When your team works remotely, it is difficult to monitor all of their computers for potential threats. Management should advise their teams of the strategies they must implement to protect their devices and their data at all times. Use the cybersecurity training you provide to establish clear policies and procedures everyone can follow. And revisit these regularly.

Use the Right Tools

Save Data on Backup Servers

In addition to keeping all corporate information on the main server, you should also have backup servers so that you can restore your information immediately in the event of a virus or ransomware attack. Don’t forget to inform your team that the company’s information is backed up; it can help put their mind at ease.

Invest in a Password Manager

Give your team a password manager to make it easy for everyone to use complex passwords that include a combination of upper and lower case letters, numbers, and special characters. Building a strong passphrase can also give them extra protection. Also, let them know the importance of responsible password management, including keeping passwords in encrypted environments and never sharing them via unsecured platforms such as email. 

Managing passwords and logins can be a big hassle for busy companies with remote workers. At TeamPassword, we believe that passwords should be secure, easy to access, and, most importantly, reliable. Our easy-to-use, encrypted environment allows you to create, update, and access passwords anywhere. Your passwords are divided into different folders called Groups, so employees only see what they need. 

Managing permissions for individual team members is a breeze. Should the time come that you need to revoke a user’s access to all of your passwords, you can do so with the click of a button. Then, use the built-in password generator to create new strong passwords for every login.

Use a Virtual Private Network (VPN)

Employees who leave their homes to work at public places like coffee shops or restaurants need to be advised about the importance of not misplacing their devices and not logging onto public Wi-Fi unless they know it is a legitimate connection and not a fake network set up by a hacker. The best way to be sure is to ask an employee at the establishment. They should also install a virtual private network on their device; the VPN will automatically encrypt their information so it cannot be used even if it is stolen.

Install Anti-Virus Software

Finally, express the importance of installing and using up-to-date antivirus software on their systems. Employees should run scans multiple times weekly to catch an issue before it ravages their system. Your IT team should always ensure that your teams are updated to the newest version of their antivirus program, so they can be protected against the latest threats.

Conclusion

In the end, protecting the company against cyber threats is a team effort. Educating your remote employees about good cybersecurity is in everyone’s best interest. Implement these tools and training, and keep your organization secure against cyberattacks.