Work from Home Security Essentials

As work from home becomes the new normal, organizations are rushing to keep up with data privacy and compliance regulations. This is the first post in a three-part series about how HDLP (Host Data Loss Prevention) can help your organization for remote working employees.

Employee Safety should not compromise data security

The healthcare crisis has made remote work the new normal for almost all organizations around the world. While work-from-home is not new to the software sector, having the entire organization to do so is unprecedented. Work from home security is still not as robust as it should be. Imagine the security requirements for organizations that prioritize data security and compliance for their clients and have hundreds of controls in place even while employees are working within the office network that is equipped with their own firewalls and other security measures.

The crisis that has been unfolding in front of us requires social distancing and isolation which has necessitated employees work remotely from their homes. Organizations are placing employee health as a priority so they can work from home. But this means weaker security for data that would normally be secure within the organizational environment. Employees are connecting, collaborating, and chatting in new ways to maintain productivity and business continuity even in the face of such challenges. Though commendable, we do have to prioritize work from home security.

There is a complete lockdown in many countries, which may be extended as necessary in the future too. The uncomfortable but a true fact is that most organizations will not be prepared for their endpoints security with regards to data protection, data integrity and data compliance regulations.

There are additional risks that can aggravated in these trying times such as:

Data theft by a disgruntled employee
Data breach by a long term employee
Sensitive corporate data shared on public domain
Sensitive corporate data shared with third parties

It is not just a question of trust with employees but also ensuring that client data entrusted to your organization is uncompromised for any reasons such as data leakages, IP theft, or even data harassment.

What is Data Loss Prevention (DLP) and Host-DLP?

Data Loss Prevention (DLP) solutions are designed to eliminate the risk of sensitive information leaving the organization. DLP protects data use, data in motion on your employee network, and also data at rest in the data storage devices such as office laptops, mobile phones, and tablets. DLP monitors all the data to protect it through thorough inspection and a contextual security analysis to ensure complete compliance with organizational data security policies. DLP identifies business critical data that is confidential and recognizes any violation of organizational and regulatory policies. It provides a centralized framework to not only prevent unauthorized use and transmission of your sensitive client data by external threats but also against inadvertent employee mistakes that can put your organization at risk. Host Data Loss Prevention is the use of tools to stop intentional and unintentional removal of organizational data by employees or third parties through host systems. Work from home security can be compromised in any of the following ways:

Employees sharing data via their personal email
Employees sharing data via their personal drives like Google Drive and Dropbox
Employees performing data transfers through SSH, FTP and RDP outside the organization’s purview
Employees storing the confidential data such as customer details on USB drives
Employees sharing the information like access credentials with third parties with malicious intents
Employees deleting the data by accident
Employees storing the details via Screenshots
Employees sharing the details with third parties like freelancers and agencies without understanding security implications
Employees giving their mail access to third party platform (like OAuth Logins)
Employees using social media to share information with other parties

Whether intentionally or inadvertently, any of the above scenarios can have serious implications for your organizational security and reputation. That is why, in the context of work from home security, it is imperative for organizations to have Zero Trust policy.

Most organizations have sensitive data that should never leave the organization. But their data protection strategies are mainly focused on organizational network level, further enforced by preventing employees from accessing data outside their strictly regulated environment.

The truth is that most organizations are not prepared for all their employees working remotely. This has been the most efficient way to handle cybersecurity for data-sensitive organizations to ensure zero compromise. But this data is at serious risk in the chaos of adopting new procedures and policies on the go.

Employees across all levels are logging into company sites, participating in online meetings, and interacting with sensitive computer data through their home networks and mobile phones. Away from the scrutiny of the office network, employees may use new software to make it easy to work that may not be authorized. Moreover, malintent too is always a threat in organizations of any size. Here are some of the types of data categories that can be leaked by or through employees:

Corporate Data	Transaction Data	Customer Data	Personally Identifiable Data
Price/ cost lists	Bank payments	Customer list	Full name
Target customer lists	B2B orders	Spending habits	Birthday, birthplace
New designs	Vendor data	Contact details	Biometric data
Source code	Sales volume	User preferences	Genetic information
Formulae	Purchase power	Product customer profile	Credit card numbers
Process advantages	Revenue potential	Payment status	National Identification/ passport numbers
Pending patents	Sales projections	Contact history	Driver’s license number, vehicle registration number
Intellectual property	Discount ratios	Account balances	Associated demographics
Unreleased merger/ acquisition plans and financial reports		Purchase/ transaction history	Preferences
Legal documents		Payment/ contract terms
Employee personal data