Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Management & Strategy

Enabling a “Secure Summer Mindset” for Employees 

As employees spend more time outside the office in the summer months, risk increases. Most of us bring our work, and the devices that we use to access it, with us wherever we go, including on our vacations. Keeping up with work so that we’re not buried when we return is a real temptation, although not the healthiest way to decompress. 

As employees spend more time outside the office in the summer months, risk increases. Most of us bring our work, and the devices that we use to access it, with us wherever we go, including on our vacations. Keeping up with work so that we’re not buried when we return is a real temptation, although not the healthiest way to decompress. 

The risk of devices and user access being compromised while traveling is greater than when employees are in the office. You don’t have to be a hacker to shoulder-surf someone typing in a passcode and then swipe a device. Con men can have an easier time plying their trade while someone’s guard is down on vacation.

Since it is unlikely that we will persuade our users to leave their laptops, tablets and smart phones at home, it can be helpful to educate them with some security dos and don’ts that will reduce the risk of them becoming an unwitting accomplice to a security breach. Consider sharing these simple tips.

1. Be suspicious of public Wi-Fi hotspots

It’s tempting to connect to public hotspots to download a movie or catch up on TMZ before jumping on an airplane. But if you connect to a dubious hotspot like “FREEPUBLICWiFi” or “Jims_Phone,” the provider can intercept your traffic or even redirect you to alternate websites that will download malware on your device so they can control it or access it at will.

Best to plan ahead and download that movie or other large data downloads before you travel. For smaller data usage, your wireless data plan is a far more secure method of connecting to the internet than unfamiliar hotspots. If you’re going to use public Wi-Fi, best to check with posted signs at airports and hotels to make certain that the network you are connecting with is the officially-provided one. And if you’re connecting to complete work, use a VPN for optimal security.

2. Keep your device locked

Many organizations use mobile device management software or have policies that require a pin code to access mobile devices in order to access business email. If this is not required, add one anyway. To reduce the inconvenience of typing in your code every time you want to access your device, use biometric access like a fingerprint scanner or facial recognition. Or use Smart Lock features that keep your device unlocked when paired with a wearable like a smart watch. 

Advertisement. Scroll to continue reading.

Devices are lost every day – left at airport security, stolen on a train, or abandoned in a hotel room. Do you really want to give immediate access to everything on it?

3. Use Two-Factor Authentication (2FA)

We’re all familiar with passwords. They help to provide authentication, which is a fancy way of saying that you are who you say you are. Passwords are an example of one type of factor for authentication – “something you know.” The other factors are “something you are” and “something you have.” Something you are is provided through biometrics and something you have can be the physical device itself or a card, as examples. 

2FA means using a combination of factors for more security to authenticate. We do this all the time when we use a credit card and enter our zip code on a fuel pump. Access to sensitive or work-related apps, such as Google accounts, can be made far more secure by taking advantage of 2FA when it is offered. With 2FA, even if someone steals your password to an account, unless they have your thumbprint or your device, they can’t use the password alone to access your accounts.

4. Out of Office messages

We turn on out-of-office notifications to let our colleagues know that we won’t be responding to that urgent email they just sent. But if you turn on that notification for those outside of your organization, without limiting to your contacts, you may be guilty of providing too much information. 

A common confidence scam is to send email to many different addresses (found on social media) to check and see who is on vacation. Attackers then use that information to contact a work colleague and convince them that urgent but sensitive information is needed that you promised them, but left without providing. 

It may be unavoidable to use out-of-office notifications externally if you are in a customer-facing role. But consider sending a pre-emptive out-of-office notification to specific external parties so you don’t have to use the indiscriminate version built into your email client.

5. Update your software

The recent “WannaCry” ransomware attack highlighted the need to keep software updated. Malware such as viruses, worms and ransomware are possible because of vulnerabilities that exist in software. Software developers are constantly eliminating these vulnerabilities as they are found, which means that if you aren’t allowing your updates to proceed, you are leaving yourself vulnerable to malware.

As travel exposes your devices to more risk, it’s a good idea to check that your operating systems, anti-virus and web browsers are updated before you leave the office. 

Educating users on security best practices, especially when they’re out of the office, is an important risk-reduction effort. Leverage the vacation travel season to remind your users on how to protect themselves, and your business, from damaging data loss. 

Written By

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

People on the Move

Former DoD CISO Jack Wilmer has been named CEO of defensive and offensive cyber solutions provider SIXGEN.

Certificate lifecycle management firm Sectigo has hired Jason Scott as its CISO.

The State of Vermont has appointed John Toney as the state’s new CISO.

More People On The Move

Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

CISO Strategy

SecurityWeek spoke with more than 300 cybersecurity experts to see what is bubbling beneath the surface, and examine how those evolving threats will present...

CISO Conversations

Joanna Burkey, CISO at HP, and Kevin Cross, CISO at Dell, discuss how the role of a CISO is different for a multinational corporation...

CISO Conversations

In this issue of CISO Conversations we talk to two CISOs about solving the CISO/CIO conflict by combining the roles under one person.

CISO Strategy

Security professionals understand the need for resilience in their company’s security posture, but often fail to build their own psychological resilience to stress.

Management & Strategy

SecurityWeek examines how a layoff-induced influx of experienced professionals into the job seeker market is affecting or might affect, the skills gap and recruitment...

Cybersecurity Funding

2022 Cybersecurity Year in Review: Top news headlines and trends that impacted the security ecosystem