Virginia

As companies move to a hybrid working model where employees can work from their offices or from home, high risk data protection strategies need to adjust to this new environment. There is no “network border” and protection strategies move from the device to the data. In first half of this article, I’ll discuss some encryption tools that can be used to protect your organization’s sensitive data when you’re working from home (WFH). I’ll also cover some basic WFH security steps you should take.

The organization should have data classification and protection standards in place. High risk data is usually defined to be any data that is covered by law or regulation and requires the organization to report exposures to an external agency and the individuals affected by the breach. A typical high risk data protection standard usually requires such data to be encrypted at rest and in transit.

Encrypting data in transit has become a straightforward process. Web traffic is encrypted using the HTTPS (Hypertext transfer protocol secure) and newer versions use the TLS (Transport Layer Security) encryption scheme. General network traffic can be encrypted using tools like VPN (Virtual Private Networks), SSH (Secure Shell). WPA (Wi-Fi Protected Access) provides another layer of encryption to general wireless network traffic. All of these methods are very good at protecting network traffic.

"The most important component of a WFH (Work from Home) cybersecurity strategy is you"

Encrypting data at rest is a challenge. There are very good encryption schemes such as PGP (Pretty Good Privacy) and its relative GPG (GNU Privacy Guard) but these schemes are cumbersome to use. There are companies that have nice encryption tools at a cost to you. Here are 3 free or built-in encryption tools that are effective. They are:

1. Microsoft Office Encryption

a. You can encrypt any Office file (Word, PowerPoint, Excel, etc.) with a password if you are using Office desktop. For example, you can encrypt a Word file by selecting “Protect Document”-> “Encrypt with password”.

b. For Office 365, check out the documentation at Microsoft’s web site.

2. Adobe PDF Encryption

a. The newer Adobe PDF tool allows you to encrypt a PDF file with password or personal digital certificate. For example, to encrypt a PDF file with a password, you open the PDF file and choose Tools->Protect->Encrypt->Encrypt with Password. For more info on PDF encryption features, go to Adobe’s www site.

3. VeraCrypt

a. VeraCrypt is an excellent open source tool that can encrypt folders, directories or an entire disk volume. You create a VeraCrypt “volume”, mount it so it appears as a virtual disk and then move your files into it. Everything in the volume is encrypted when you dismount the volume.

Over the past 30 years, there have been lots of names for various cyberattacks such as ILoveYou, Slammer, Ransomware, Trojan Horses, Worms, Malware, botnets. There are some excellent security frameworks such as MITRE’s ATT&CK, D3FEND, DeTT&CT frameworks. I believe hackers have 3 goals:

1. Data theft or disclosure aka data breaches – they want to steal your sensitive data and sell it or threaten to disclose it publicly.

2. Data destruction – they want to disrupt your everyday routines or business practices by destroying your data.

3. Attack other sites – they want to use your assets to attack other sites.

The most important component of a WFH (Work from Home) cybersecurity strategy is you. The SANS Institute noted that “attackers have learned the easiest way to get what they want is to target you, rather than your computer or other devices.” You will be handling organizational sensitive data if you’re working from home. Remember, you are connecting through your local ISP’s network and you should consider the network to be hostile. Hopefully, your employer provides you with a company owned computer to use at home. In any event, here are 5 steps to take to help protect your work assets and data while you are in WFH mode.

1. Does your personal device meet any legal or regulatory requirements imposed on the data you’ll be processing on your home computer? What is the audit process to ensure compliance? If so, you need to ensure your computers and home networks meet those standards.

2. If you’re using your home computer to log into your work systems, create a separate UserID on your home computer and use that to access your work environment. This way you segregate your work browsing history, file protections among other things from your “home” environment. Your browser settings for work can be separated from your personal use.Two Factor Authentication (2FA) works. Just about everyone has been using some form of 2FA for years. If you have an ATM card, you’ve been using 2FA. The card is one factor and the pin code is another. Well, this technology is now a common thing to use to log into systems and computers.

3. Change all default passwords on every device connected to your home network. There are tons of sites that list the default passwords on a ton of home devices ranging from doorbells, network cameras, lighting systems to lawn sprinklers. Google “default password sites” and you’ll see what shows up. You’ll find sites that list the default passwords for thousands of devices. It’s almost guaranteed that your home appliances and devices are listed.

4. Trust your instincts. Think before you click. If something sounds too good to be true, it is. A recent Twitter hack where the tweet said “send me $1000 and I’ll send you $2000” became a new poster meme.

5. Your password is still an important part of 2FA. What’s changed? The Federal government (NIST) drastically revamped their password strength requirements and removed the complexity requirement. Longer passwords are harder to guess. Pick a sentence or a phrase that you’ll remember. For example, I’ll pick “this is a really long password that nobody will guess”. Note that it’s all lower case. Length is the key. If you do have trouble remembering that long phrase, write it down. Writing down a password is NOT a security risk. The security risk is WHERE you put that piece of paper. Write it down and put it in your wallet.

These tools and tips will help you protect your high risk data from unauthorized exposure. Use encryption tools to protect your data at rest. Take some basic precautionary steps to strengthen the security of your computer and home networks.