Our work environments have been turned upside down. We are all in a place of creating new work routines. Having left the cyber safety net of a central office designed to protect company cybersecurity, IT departments are juggling a dispersed workforce while maintaining cybersecurity standards that protect private data.

Before COVID-19 forced a remote workforce, anywhere from 60 – 90% of breaches were caused by human error. We are seeing cyber criminals take advantage of extra vulnerabilities created with employees working from home. Cybersecurity is no longer just an IT thing. Protecting your company and their private data has never been closer to home, literally. Mistakes that could hurt the company start on your own network, which could also affect your personal security. Your business, IT department and your family are relying on your vigilance to be cyber safe.

Cyber safety habits to put into practice

1. Separate work and personal devices
   If your company provides you a device, use it only for work purposes. Have a separate device for family and personal use. If separate devices are not a possibility, create separate profiles with different security settings. Use your work profile only for work purposes. If you have children who need to use the same computer, create separate profiles with parental controls that limit their ability to access and/or download content that could infect your computer.

2. Lockdown your device
   You may feel that your device is physically safe in your home office, but you still need to protect data safety. Set a unique password for your device and lock it every time you walk away. If you are using one device for multiple profiles, have a private, unique password for your work profile that no one in your household can access. This is good practice for after quarantine as well.

3. Be wary of add-ons and downloads
   There are many add-ons and extensions that promise to make your work run faster, smoother and better. Be cautious of downloading these onto your device. Many contain malware that give hackers access to the data on your computer. If you then link to your company network, they could gain access there as well. A good cyber safety practice is to research on trusted sites before downloading a new program or add-on.

4. Use company approved sharing sites
   With your entire team working remotely, there is a greater need to communicate digitally. It may be more comfortable to use data sharing platforms you are used to, they may not be the most secure. Only send private data through company approved sharing sites.

Know signs of a breach

Preventative measures are important to cyber safety, but breaches are still possible. It’s important to know what signs to look for in the event of a breach.

1. Increase in unwanted pop-ups
   Pop-ups are a widely seen by-product of malware. If advertisements or system pop-ups begin appearing outside of any program, you may have been infected.

2. Processing slows down
   Is it taking longer than usual for your computer to boot up or for programs to load? Viruses and malware run in the background, slowing down the programs you are attempting to run.

3. New programs appear
   Computers do not add content on their own. If a new program, app or internet add-on appears on your computer, you may have a virus that inserted content onto your computer.

How do you handle a potential breach?

1. Report it!
   Inform your IT department of what you are experiencing. Send screen shots of error messages, pop-ups and other unwanted content. Be specific about when it started happening and what is going on.

2. Don’t click
   Never click on suspicious content, even to try and close pop-up windows. Malware is the gateway for a virus. Clicking on the content can give them access to the data they are looking for.

3. Scan with anti-virus software
   Company devices should be equipped with anti-virus software. If your company does not provide a device, get with your IT department about them providing access to anti-virus software. While it should do scans in the background, if you notice any of the above issues, tell it to run a full system diagnosis.

4. Don’t access private data
   Until your issue has been resolved, do not attempt to access the company network or open any private data. If a hacker is monitoring your computer through malware, you run the risk of giving them access to that information.

While human error will never be eliminated, we can all take steps to increase our awareness and cyber safety to lower our risk.

Cyber Safety Tips for Businesses When Employees Work from Home

With the threat of the Coronavirus, many companies are allowing or requiring employees to work from home. If your company deals with protected information such as healthcare, financial, consumer or personal, you should have policies and procedures in place to protect that data within your normal work environment. However, having your work force suddenly need to access this information from home may not be normal. Systems may be overloaded, sensitive information distributed in a way that you never anticipated and lines of communication disrupted. Do your policies and procedures cover such a situation, like a pandemic? Here are 6 tips to best protect your business and your clients.

Train Your Employees

We are not talking about the once a year standard, boring videos people half heartedly watch so they can print off a certificate proving they did it. Your employees must know key elements of cyber safety that they are regularly reminded of. If nothing else, make sure they know these 3 things.

1. Anticipate phishing and spear phishing attacks. Word will travel fast that everyone is working from home. Hackers will recognize you are vulnerable and try to take advantage of it. Tell your workforce to anticipate phishing and spear phishing attacks that will attempt to take advantage of pandemic fears. Give visual examples, have your IT on high alert searching for phishing attempts and contact employees immediately when one gets through your firewall.
2. Do not access sensitive information on unauthorized devices. The biggest culprit: cell phones. Have policies about what devices they are allowed to use to remotely access information and make sure they know. Never store sensitive information unencrypted on a portable device.
3. Do not access sensitive information on unsecure networks. Like working from Starbucks because they have free WiFi? That may be fine for personal use, but not when you’re accessing sensitive information. Public WiFi makes it easy for a hacker to infiltrate your computer, stealing the information you accessed.

Determine Critical Processes and Access Control

This is a key component to any Pandemic plan. Who is authorized to access sensitive information, and how do you ensure they can actually access sensitive information in a highly distributed environment? Minimize your exposure by controlling access to data. Not everyone working from home needs access to sensitive information. Make sure you lock down access to only essential employees. Follow through by monitoring who is accessing data, what they are accessing and why.

Multifactor Authentication

For those employees who need to access sensitive information, require multifactor authentication every time they remotely access a private server. This is an easy step to implement that can have a big impact on keeping cyber criminals out.  Explain to your employees why the two-factor authentication is an important safety capability.

Network Access Control

While you should train your employees not to access sensitive information on unsecure networks (see tip #1), you can implement access controls that actually block a user if they do not meet a certain level of security. You should implement a Virtual Private Network (VPN) which provides higher security for your workers using their home and/or public internet that are not secure.   It’s fairly easy and inexpensive to implement. For more information on VPNs, click here.

Encrypt Data

If information is stored locally on a device, make sure it is encrypted. Portable devices are often stolen that contain sensitive information. A simple step of encryption protects your clients’ information and protects you from hefty breach costs and fines.

Provide Company Devices

Laptops and cell phones should always be running the most up to date version of an operating system available (i.e. Windows 10 vs Windows 8). They should also have up to date firewall protections and antivirus software. If employees are permitted to use personal devices, it is difficult to ensure these protections stay up to date. Providing company devices that are properly configured and regularly updated help strengthen the barrier against cyber criminals.

Protection doesn’t have to be complicated, but it does have to be intentional. Simple steps taken by the company and the employees can go a long way. While we want to stay physically safe through this wave of the Coronavirus, let’s make sure we stay cyber safe too.

 Concerned if you have the right precautions and planning in place? Contact Third Rock at info@thirdrock.

The holidays get busy. Traveling is stressful and we aren’t always as vigilant as we should be. In today’s world of data breaches, identity theft and cybercrime, there are many things we know to be cautious about. You wouldn’t give away your credit card number or let a stranger have access to your driver’s license. But are cyber safe with your phone? We have become so dependent on our phones to store sensitive and private data. Sometimes forget that we need to protect it too.

Let’s take a look at a scenario that could happen to any of us:

The morning was a rush and you made it to the airport on time, thankfully. After getting through security, there is a little time to breath. You grab some coffee, check your phone and realize you forgot to charge it. Ugh. Your phone needs to be charged to last the whole flight and still have juice when you land. You notice a charging station near your gate. There are even cords already plugged in, so you don’t have to dig yours out of your mess of a bag. Score!

You may not be as lucky as you feel. Cyber criminals are taking advantage of how dependent we are on our devices and their need to be charged. This new scam, known as “juice jacking” takes advantage of your connection to your phone.

How does it work?

Phone cords are designed for 2-way communication. Data can come in, but data also goes out. This can be seen every time you attach an iPhone to your computer and iTunes wants to download your data. Convenient when you want it, but bad when the criminals want it. Criminals download malware into the charging station or physically alter the charging station installing a cable connected to a virus laden device, and wait until you connect. They then have access to everything on your phone. What do you keep saved?

• Passwords?
• Credit card information?
• Communications?
• Photos?

Depending on the malware, they could download your data or install malware on your phone that will continue to monitor your usage. They might even lock you out of your phone completely. The biggest concern; you may never know. A week later you’re seeing fraudulent charges on an account and trying to figure out what happened. This is very similar to the card skimmers installed at gas stations.

What can you do?

Thankfully there are easy ways to avoid this scam.

• Use your own AC adapter and cord
• Plug into a wall outlet, not a charging station
• Use a “charge only” cord at a charging station
• Use personal car chargers
• Use a portable charger

 Be cyber safe this holiday season

Physical security is important and easy to remember. We see our wallet; we protect our wallet. This holiday season, let’s also remember our cyber safety. 

Meet Hayden. He was born at 7:23 am on May 3. He started breathing too soon and swallowed liquid which caused him to struggle to breath.  Within an hour of being born, he was taken to the NICU. For 2 days he received amazing care from the doctors and nurses. He was discharged, happy and healthy, ready to take on the world. His future is bright and open to all possibilities.  Or is it? While the hospital protected his body, are they protecting his personal information? Can someone steal his identity, potentially jeopardizing his future? Children are a common target of identity theft because there is a false belief they are too young to have any “valuable” credentials.  What are you doing to make sure the Hayden’s in your hospital are protected? Be cyber confident so your patients (and their parents) can be confident in you.

Protect your Patients. Protect your Organization. Protect Yourself.™