Remote Work Security Risks in a Hybrid Workforce

Remote work security risks are what a firm leaves exposed when the quiet protections of an office stay behind. An office floor does five protective jobs without anyone asking for them. IT runs the network, and IT can see the machines on it. A colleague sits within earshot, and a door locks at night. Anyone can also lean across a desk with a question. When staff split the week, the five jobs are in place on office days and may be missing on home days. Ways to close those gaps belong to the use case on securing a distributed workforce. This page stays with the exposure itself.

Remote Work Security Risks Start With What the Office Did Unasked

Before the five jobs come two terms used throughout.

Reading the office as five jobs is this page’s own approach. It can tell new risks from risks that only moved. For example, a doubtful email reached the office as well. On a home day, what is new is that the reader has no one nearby to ask. In hybrid work the question to ask is which job goes missing on which day.

The example here is invented, and it follows the claims team of a mid-size insurer. Before, the team worked on one office floor; now it splits its week between that floor and home. The team has no link to Signisys, and its handlers deal with policyholders’ claims and the papers behind them.

A public guide covers related ground. A guide from NIST on telework, remote access and bring-your-own-device security was published in July 2016. Its abstract says that all components of such technologies, whether the devices are issued by the organisation or brought by the worker, should be secured against expected threats identified through threat models. The five jobs below are this page’s reading, not the guide’s.

The Network IT Controlled

The first job was the network. On the office floor, IT set up the network and chose which traffic it let through. It could also see what crossed it. At home a claims handler connects through a router the firm did not choose. IT has not seen its settings, and the rest of the household shares the same connection.

What goes uncovered is the route that company work takes. Claim files, emails and chat messages now travel over a connection the firm does not manage. Whatever else the household runs shares that route as well. If the firm gives staff a secure connection into the office for that route, the gaps that remain are set out in why a tunnel alone leaves home traffic unchecked.

There is an honest limit here: the staff member sets up the router, and the firm decides which work may be done on it. The owner chooses which claims tasks may happen from home, while other tasks stay on the office network. How staff connect to the firm’s software on home days is a separate subject. The use case on safe sign-in to business apps from anywhere sets it out.

Until someone asks, the answer to one plain question may sit only with each handler. Does the firm know which home connections carry company work today?

The Machines IT Could See

The second job was sight of the machines. In the office, IT could see each machine on its network and check that updates were in place, and it could also take a lost one out of use. On home days in the claims team, some handlers carry a firm laptop while others log in from their own. IT has no view of the personal machines.

What goes uncovered follows from that. IT does not update, check or wipe a machine it does not see, including a lost one. The firm may not know on which personal machines staff have saved company files. Nor may it know who else in the family uses them in the evening. Once such machines are allowed, the route they take into company systems is compared in whether home laptops connect through a tunnel or through checks at each app.

Here, though, the decision sits with the owner of the firm. Whether personal machines may reach work at all, and on what terms, is a choice the firm makes. Still, the machine itself stays the handler’s property either way.

If the owner checked the firm’s own list of machines, which of those that reach company data would be missing from it?

The Colleague Within Earshot

The third job sat in the next chair. In the office, a colleague hears an odd phone call or sees an unusual payment request on a neighbour’s screen, and that colleague may say that something does not sound right. But at home the claims handler decides alone.

What goes uncovered is that pause. A message may press a person to pay, share a file or reset a password. On a home day, it reaches someone with no one beside them. Phishing, a message written to look as if a trusted sender wrote it, is one form of this.

Team leads can change this part. They can agree a plain rule for confirming odd requests by a second route. For instance, a handler could call a number already on the team’s contact sheet. While that rule stays unwritten, each handler works out an answer alone.

The Door That Locked

The fourth job was physical. In the office, doors locked at night, screens faced walls and paper went into a bin the firm emptied. At home, a screen may face a window, a child or a visitor, and claim papers sit on a table. Later, a bag with a laptop in it rides a train between office days and home days.

What goes uncovered is what can be seen, overheard or left behind. A device lost on the way belongs here too. This job is about habits and storage more than technology. Claim papers name policyholders. Data-protection rules are for the firm’s legal adviser to read. Nothing on this page is legal advice.

The firm can change this part. It can tell staff plainly what happens to printed claims papers on home days. It can also say whom to call about a lost bag. The handler then has a name to ring, not a worry to carry. Turning that into a one-page note, and the other decisions beside it, is covered in an order of five for a small firm from which devices reach work to a dated review.

Do the handlers know whom to ring if a laptop bag is lost on the journey home?

The Desk Where Anyone Could Ask

The fifth job was the easiest to overlook. In the office, a handler could lean over and ask whether an email was real, and the answer could come in seconds. On a home day, the same handler types the question into a chat, waits or guesses. A doubtful event may then go unreported.

Here the gap is time, more than anything else. The firm hears about a problem late, or not at all. The handler may also feel they should have spotted it alone. A quiet staff member may reflect distance, not a fault in that person.

The firm can change this by naming one place to ask. It can also say plainly that questions are welcome, including after a mistake. In the claims team, for example, that place could be a named colleague on each home day.

Remote Work Security Risks, Job by Job

The table pulls the five jobs together. It is a Signisys working description of those jobs, not a standard. Read across, its rows turn remote work security risks into five decisions with a person beside each.

Asking the Claims Team About Its Home Days

For the claims team, a next step could be one team meeting. There, the team’s lead takes the five jobs and notes which ones the team still has on home days. The lead also notes which ones it has lost. After that meeting, the firm can see which gaps are its own to close. It can also see which stay with staff, such as the router in each handler’s home. Similarly, a firm with no claims team can hold the same meeting with any group that splits its week. Signisys can sit with the reader’s IT lead over that note. It can then point to where a rule, a managed device or a place to ask fits.

Signisys provides digital workplace and endpoint management and end-user computing services, and is an interested party on this topic. The box below offers a conversation with its team and promises no result.

Remote Work Security Risks FAQ: Doubts Worth Settling