As the pandemic permeates workforces with many employees continuing to work from home, businesses must remain vigilant against heightened cybersecurity risks. Below are 10 important measures and reminders that can help mitigate these substantial risks.

|
  • Encrypt Data and Tightly Control Access to Encrypted Data.

Encrypting data at rest and in transit continues to be essential to information security. Instruct employees to store work on the employer's system (rather than on company-owned or personal devices). When working with third-party vendors, review contract terms to provide ample protection for your data.

|
  • Deploy Secure Devices to Remote Employees.

Most employee-owned personal computers lack important malware and encryptions protections, and hackers capitalize on the vulnerabilities of personal computers. Such vulnerabilities increase the risks to data on these personal computers and data accessed from those computers (including data that resides on company servers accessed remotely). For entities covered by the Health Insurance Portability and Accountability Act (HIPAA), the Gramm-Leach-Bliley Act (GLBA), and other regulatory schemes, this is essential. Given these vulnerabilities, employers can consider requiring employees to keep all work data on company-owned devices and avoid cloud-sharing applications that have not been vetted for privacy and security. Limiting the diversity of storage repositories helps limit the number of potential avenues of attack.

|
  • Enhance VPN Security, Password Strength and Telephone/Video Conference Protections.

Require multi-factor authentication to access the employer's virtual private network (VPN) (especially if employees are using their own devices to obtain such access). The fact that employees cannot interact in-person increases the need for multi-factor authentication and strong passwords. Reiterate the importance of using strong passwords and protecting the security of those passwords. Weak or stolen passwords remain a primary cause of compromise to information security.