Organizing security in the face of containment
Millions of French people now work from their homes.
This has been the case following the general containment imposed since mid-March by the government to combat the spread of coronavirus. If this seems to have become a standard for a month, such a situation presents a lot of risks. Indeed, the IT security of companies is impacted. Above all, for all companies that did not have a protocol working remotely in case such a situation arises. That's why for some time, IT security specialists have continued to provide advice and mentor companies to ensure good digital hygiene, the very basis of security.
This article will also interest you: Is telecommuting safe, is it possible?
In such a situation, the experts revealed the first threat to companies and the threat that comes directly from telecommuting employees. Indeed, the latter, outside the professional framework of companies, are much more exposed to cyberattacks. Indeed, home-based employees are often inclined to download programs on their terminals. Terminals that are also used for work. These programs and files that are likely to download are not always reliable or even corrupt to some. This makes them a good gateway for malicious cybers but to break into the information system of the companies they target. In such a context for employees, "This is not malice (…) It's more about a lack of knowledge or a D-system," said David Grout, a security expert at FireEye.
Another risk looms for teleworkers and businesses. That of the president's fraud or "business email compromised" among the English. It is a technique that consists, simply, for cyber-prisoners, of impersonating certain executives of the company or even an ordinary employee, with the aim of accessing the company's information system. Inevitably, this kind of action is possible thanks to a breach caused by an internal person at the company. And through this, several problems can arise. "Fake bank transfers and bank transfer redirects are also commonplace," says the FireEye expert.
On the other hand, it should be noted that companies have opted for telework a little in a hurry. They had to develop access that was not possible before confinement to allow some of their employees to continue working remotely. Yet, "On the corporate side, haste is the enemy of security," grout noted. "With limited time and strong business constraints, many have put aside data encryption, the vulnerability of certain tools and their visibility on who does what."
However, it is never too late to do the right thing. In terms of cybersecurity, it all starts with practices. if the person adopts good practices and strictly correct digital hygiene, it goes without saying that cyber threats will greatly diminish. That's why one of the first tips to implement is to train your employees in a company. Because many cyberattacks were caused by a clumsy gesture from someone who didn't know he was making a mistake.
"The user is not inherently malicious. He's just looking for tools that will help him work. If Ms. Michu needs to edit a PDF, the first thing she's going to do is go to Google," says Grout. In addition, fake computer attacks should be organized in order to develop good reflexes. In addition, avoid the use of software or terminals that are not approved or controlled by the company. Because, usually this is another gateway for cyber-prisoners. Focus on multi-factor authentication, which are shields in the event of loss or exposure of identification elements. and finally control all connections, both in and out of the company's information system. It is important to know who logged in, when it did, why and for how long, and finally security solutions. The company must have a cybersecurity strategy ranging from hardware to specialist. As far as possible, as this is essential today, a company must have a dedicated cybersecurity directorate.
Now access an unlimited number of passwords:
