[BreachExchange] Enabling a "Secure Summer Mindset" for Employees

[Audrey McNeil]

http://www.securityweek.com/enabling-secure-summer-mindset-employees

As employees spend more time outside the office in the summer months, risk
increases. Most of us bring our work, and the devices that we use to access
it, with us wherever we go, including on our vacations. Keeping up with
work so that we’re not buried when we return is a real temptation, although
not the healthiest way to decompress.

The risk of devices and user access being compromised while traveling is
greater than when employees are in the office. You don’t have to be a
hacker to shoulder-surf someone typing in a passcode and then swipe a
device. Con men can have an easier time plying their trade while someone’s
guard is down on vacation.

Since it is unlikely that we will persuade our users to leave their
laptops, tablets and smart phones at home, it can be helpful to educate
them with some security dos and don’ts that will reduce the risk of them
becoming an unwitting accomplice to a security breach. Consider sharing
these simple tips.

1. Be suspicious of public Wi-Fi hotspots

It’s tempting to connect to public hotspots to download a movie or catch up
on TMZ before jumping on an airplane. But if you connect to a dubious
hotspot like “FREEPUBLICWiFi” or “Jims_Phone,” the provider can intercept
your traffic or even redirect you to alternate websites that will download
malware on your device so they can control it or access it at will.

Best to plan ahead and download that movie or other large data downloads
before you travel. For smaller data usage, your wireless data plan is a far
more secure method of connecting to the internet than unfamiliar hotspots.
If you’re going to use public Wi-Fi, best to check with posted signs at
airports and hotels to make certain that the network you are connecting
with is the officially-provided one. And if you’re connecting to complete
work, use a VPN for optimal security.

2. Keep your device locked

Many organizations use mobile device management software or have policies
that require a pin code to access mobile devices in order to access
business email. If this is not required, add one anyway. To reduce the
inconvenience of typing in your code every time you want to access your
device, use biometric access like a fingerprint scanner or facial
recognition. Or use Smart Lock features that keep your device unlocked when
paired with a wearable like a smart watch.

Devices are lost every day – left at airport security, stolen on a train,
or abandoned in a hotel room. Do you really want to give immediate access
to everything on it?

3. Use Two-Factor Authentication (2FA)

We’re all familiar with passwords. They help to provide authentication,
which is a fancy way of saying that you are who you say you are. Passwords
are an example of one type of factor for authentication – “something you
know.” The other factors are “something you are” and “something you have.”
Something you are is provided through biometrics and something you have can
be the physical device itself or a card, as examples.

2FA means using a combination of factors for more security to authenticate.
We do this all the time when we use a credit card and enter our zip code on
a fuel pump. Access to sensitive or work-related apps, such as Google
accounts, can be made far more secure by taking advantage of 2FA when it is
offered. With 2FA, even if someone steals your password to an account,
unless they have your thumbprint or your device, they can’t use the
password alone to access your accounts.

4. Out of Office messages

We turn on out-of-office notifications to let our colleagues know that we
won’t be responding to that urgent email they just sent. But if you turn on
that notification for those outside of your organization, without limiting
to your contacts, you may be guilty of providing too much information.

A common confidence scam is to send email to many different addresses
(found on social media) to check and see who is on vacation. Attackers then
use that information to contact a work colleague and convince them that
urgent but sensitive information is needed that you promised them, but left
without providing.

It may be unavoidable to use out-of-office notifications externally if you
are in a customer-facing role. But consider sending a pre-emptive
out-of-office notification to specific external parties so you don’t have
to use the indiscriminate version built into your email client.

5. Update your software

The recent “WannaCry” ransomware attack highlighted the need to keep
software updated. Malware such as viruses, worms and ransomware are
possible because of vulnerabilities that exist in software. Software
developers are constantly eliminating these vulnerabilities as they are
found, which means that if you aren’t allowing your updates to proceed, you
are leaving yourself vulnerable to malware.

As travel exposes your devices to more risk, it’s a good idea to check that
your operating systems, anti-virus and web browsers are updated before you
leave the office.

Educating users on security best practices, especially when they’re out of
the office, is an important risk-reduction effort. Leverage the vacation
travel season to remind your users on how to protect themselves, and your
business, from damaging data loss.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.riskbasedsecurity.com/pipermail/breachexchange/attachments/20170629/56b2e964/attachment.html>