Security Experts:

Enabling a "Secure Summer Mindset" for Employees 

As employees spend more time outside the office in the summer months, risk increases. Most of us bring our work, and the devices that we use to access it, with us wherever we go, including on our vacations. Keeping up with work so that we’re not buried when we return is a real temptation, although not the healthiest way to decompress. 

The risk of devices and user access being compromised while traveling is greater than when employees are in the office. You don’t have to be a hacker to shoulder-surf someone typing in a passcode and then swipe a device. Con men can have an easier time plying their trade while someone’s guard is down on vacation.

Since it is unlikely that we will persuade our users to leave their laptops, tablets and smart phones at home, it can be helpful to educate them with some security dos and don’ts that will reduce the risk of them becoming an unwitting accomplice to a security breach. Consider sharing these simple tips.

1. Be suspicious of public Wi-Fi hotspots

It’s tempting to connect to public hotspots to download a movie or catch up on TMZ before jumping on an airplane. But if you connect to a dubious hotspot like “FREEPUBLICWiFi” or “Jims_Phone,” the provider can intercept your traffic or even redirect you to alternate websites that will download malware on your device so they can control it or access it at will.

Best to plan ahead and download that movie or other large data downloads before you travel. For smaller data usage, your wireless data plan is a far more secure method of connecting to the internet than unfamiliar hotspots. If you’re going to use public Wi-Fi, best to check with posted signs at airports and hotels to make certain that the network you are connecting with is the officially-provided one. And if you’re connecting to complete work, use a VPN for optimal security.

2. Keep your device locked

Many organizations use mobile device management software or have policies that require a pin code to access mobile devices in order to access business email. If this is not required, add one anyway. To reduce the inconvenience of typing in your code every time you want to access your device, use biometric access like a fingerprint scanner or facial recognition. Or use Smart Lock features that keep your device unlocked when paired with a wearable like a smart watch. 

Devices are lost every day – left at airport security, stolen on a train, or abandoned in a hotel room. Do you really want to give immediate access to everything on it?

3. Use Two-Factor Authentication (2FA)

We’re all familiar with passwords. They help to provide authentication, which is a fancy way of saying that you are who you say you are. Passwords are an example of one type of factor for authentication – “something you know.” The other factors are “something you are” and “something you have.” Something you are is provided through biometrics and something you have can be the physical device itself or a card, as examples. 

2FA means using a combination of factors for more security to authenticate. We do this all the time when we use a credit card and enter our zip code on a fuel pump. Access to sensitive or work-related apps, such as Google accounts, can be made far more secure by taking advantage of 2FA when it is offered. With 2FA, even if someone steals your password to an account, unless they have your thumbprint or your device, they can’t use the password alone to access your accounts.

4. Out of Office messages

We turn on out-of-office notifications to let our colleagues know that we won’t be responding to that urgent email they just sent. But if you turn on that notification for those outside of your organization, without limiting to your contacts, you may be guilty of providing too much information. 

A common confidence scam is to send email to many different addresses (found on social media) to check and see who is on vacation. Attackers then use that information to contact a work colleague and convince them that urgent but sensitive information is needed that you promised them, but left without providing. 

It may be unavoidable to use out-of-office notifications externally if you are in a customer-facing role. But consider sending a pre-emptive out-of-office notification to specific external parties so you don’t have to use the indiscriminate version built into your email client.

5. Update your software

The recent “WannaCry” ransomware attack highlighted the need to keep software updated. Malware such as viruses, worms and ransomware are possible because of vulnerabilities that exist in software. Software developers are constantly eliminating these vulnerabilities as they are found, which means that if you aren’t allowing your updates to proceed, you are leaving yourself vulnerable to malware.

As travel exposes your devices to more risk, it’s a good idea to check that your operating systems, anti-virus and web browsers are updated before you leave the office. 

Educating users on security best practices, especially when they’re out of the office, is an important risk-reduction effort. Leverage the vacation travel season to remind your users on how to protect themselves, and your business, from damaging data loss. 

view counter
Travis Greene, Identity Solutions Strategist at Micro Focus, possesses a blend of IT operations and security experience, process design, organizational leadership and technical skills. After a 10-year career as a US Naval Officer, he started in IT as a Data Center Manager for a hosting company. In early 2002, Travis joined a Managed Service Provider as the leader of the service level and continuous improvement team. Today, Travis conducts research with NetIQ customers, industry analysts, and partners to understand current Identity and Access Management challenges, with a focus on provisioning, governance and user activity monitoring solutions. Travis is Expert Certified in ITIL and holds a BS in Computer Science from the US Naval Academy.