10 teleworking security tips from Maryland cyber CEOs

Thousands of Maryland employees are still logging into their companies’ work systems each day, but due to the impacts of the novel coronavirus, they must do so from inside their homes.

Local cybersecurity CEOs warn that the mass teleworking migration has created a prime opportunity for cyber hackers to pounce.

“It’s kind of like how a virus attacks a human body,” said John Murchison, CEO of Columbia’s Blackpoint Cyber. “When an ‘immune system’ is weakened — in this case when companies are distracted and are not watching as closely for security issues — it leaves you more vulnerable to the bad guys.”

Chris Sachse of Baltimore’s Think|Stack said many businesses were likely ill prepared for the rapid shift to work-from-home models. Some companies may not have the right tools or practices in place to help their companies remain secure while an entire workforce is logging in from offsite. And some companies may have even cut some security “corners” in the mad dash to enable teleworking, he said.

“Now is the time to go back and take a hard look, to make sure you are protected,” Sachse said.

Murchison and Sachse recently joined a handful of other local cyber experts to conduct a webinar aimed at offering some tips for Maryland companies that have all of their employees, including their IT teams, working remotely during the pandemic.

Here’s what they recommend companies do in order to prevent a damaging hack:

Don’t use personal computers for work — The things people do or search for on their personal tablets and laptops are generally more “risky.” Companies do not want employees engaging in those risky behaviors on the devices they are using to do their work, Murchison said. Employees should have access to devices they can use specifically for work, and should be able to log into their work servers through a virtual private network, or VPN.

Don’t click on risky links or attachments in emails — Hackers are sending more and more phishing and spam emails during this time — you know, the ones that ask you to click on a link or download a .docx file, and end up infecting your computer with some kind of malware or virus. Sachse said people should be especially vigilant about risky links and attachments, and should never click on a file from an unknown sender or a on a link to an unfamiliar site. And when in doubt, he said the best option is to “pick up the phone,” and call the sender to verify whatever file or link has been sent.

Be smart about passwords — If they don’t already, Murchison said companies should implement two-factor authentication for online work functions, meaning there should some extra layer of security in place in addition to asking employees for their usernames and passwords upon logins. He also advised that workers should not be using the same usernames and passwords for their work accounts as their personal email or social media accounts.

Utilize the security training tools available — Many cyber firms and industry groups are putting out educational advisories and special trainings related to remaining cybersecure during COVID-19 workplace interruptions, Sachse said. He advised that businesses circulate those kinds of tools among their executive teams and employees.

And if after all those steps, you company still experiences a breach, Brian Dykstra of Elkridge’s Atlantic Data Forensics Inc. offered some additional advice.

1. First and foremost, “remain calm,” Dysktra advised.
2. Have a plan in place for what your executive team will do in the event of a breach, and be ready to execute on that plan. Be sure you have cyber-specific insurance and legal counsel in place, as well as plans for contacting experts who can help solve the problem, and for sharing necessary information about the breach with employees and clients.
3. Unless you are a cybersecurity expert yourself, don’t try to address the issue on your own. Dykstra said companies can waste time, money and energy trying to figure out cyber solutions internally, and can end up actually making the problem worse. Instead, companies should seek help and advice of cyber experts, like those working with the Cybersecurity Association of Maryland Inc.’s new Cyber SWAT Team initiative.
4. And make sure all of your company’s critical data is backed up regularly, so that if a hack does occur and some data is lost, you can get your business back up and running as quickly as possible.