Editorial · March 22, 2020
Remote Work Security: A Checklist for Small Firms
Remote work security starts with a short list of habits that any small firm can follow this week. As more staff move to home offices, the weak points move too. This checklist covers the VPN, updates, logins, the home network and your people.
Why the risk is rising now
On March 13, 2020, the Cybersecurity and Infrastructure Security Agency (CISA) issued Alert AA20-073A on enterprise VPN security. It says remote work requires a virtual private network, or VPN, to connect staff to the office network. It also warns that more flaws in VPNs are being found and targeted by attackers.
The alert gives three reasons. VPNs run all day, so firms tend to skip their updates. Attackers may send more phishing emails to people working from home. And firms that do not use a second login step are easier to trick. Small firms face the same risks as large ones, with fewer people to watch for them.
Sources: CISA Alert AA20-073A, "Enterprise VPN Security," March 13, 2020 (us-cert.cisa.gov/ncas/alerts/aa20-073a).
Step 1: Patch the VPN and every device
CISA asks organizations to update VPNs, network devices and the devices staff use to connect to work with the latest software patches and security settings. A patch is a small update that fixes a known flaw.
- Check your VPN maker's site for new updates today, then each week.
- Update the router or firewall at the office.
- Ask staff to install system and browser updates on laptops and phones.
- Keep a simple list of who uses which device.
Sources: CISA Alert AA20-073A.
Step 2: Add a second login step and strong passwords
CISA recommends multi-factor authentication, or MFA, on all VPN connections. MFA adds a one-time code sent to a phone, or a similar check, on top of the password. A stolen password alone then does not open the door.
If you cannot turn on MFA yet, the alert says to require strong passwords. Make them long. Use a different one for each account. A password manager can help staff keep track without writing them on sticky notes.
Sources: CISA Alert AA20-073A.
Step 3: Prepare staff for phishing
Phishing is a fake message that tries to get a person to share a password or open a bad file. CISA expects more of it aimed at people working from home. Tell your team before it happens.
- Remind staff to look at the sender address and not just the name.
- Tell them not to log in through links in unexpected emails.
- Give them one person or phone number to call when something looks wrong.
- Ask them to report a mistake quickly. A fast report limits the harm.
Sources: CISA Alert AA20-073A.
Step 4: Secure the home network and the device
The National Institute of Standards and Technology (NIST) published Special Publication 800-46 Revision 2 in July 2016. It is a guide to telework, remote access and personal device security. It says every part of a remote access setup should be protected against the threats you expect, including personal devices that staff use for work.
In plain terms, that means a few habits for each person at home:
- Change the default password on the home router.
- Turn on the strongest Wi-Fi encryption the router offers.
- Lock the screen when stepping away.
- Keep work files on approved systems, not on random personal accounts.
Sources: NIST SP 800-46 Rev. 2, "Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security," July 2016 (csrc.nist.gov/publications/detail/sp/800-46/rev-2/final).
Step 5: Plan for load and for problems
A firm may only have a set number of VPN connections. Once they are used, nobody else can log in. CISA suggests testing the limits of your VPN before many people use it at once. Where possible, it suggests settings such as rate limiting to give priority to those who need more bandwidth.
CISA also asks IT staff to get ready for more log review, attack detection and incident response. NIST says these tasks should be written into the configuration management policy. For a small firm, that can be a one-page note. It should say who reads the logs, who to call if something goes wrong, and how you will restore your files.
If you do not have IT staff, ask your outside provider to confirm each step in writing.
Sources: CISA Alert AA20-073A; NIST SP 800-46 Rev. 2.
A one-page summary
- Update the VPN, the router and every laptop.
- Turn on MFA, or require strong, unique passwords.
- Warn staff about phishing and name who to tell.
- Secure home routers and lock screens.
- Test VPN capacity and write down who handles incidents.
None of these steps needs a large budget. Together they cover the main risks that CISA and NIST describe for staff working off site.
Sources: CISA Alert AA20-073A; NIST SP 800-46 Rev. 2.