As employees spend more time outside the office in the summer months, our cybersecurity risks increase. Most of us bring our work, and the devices that we use to access it, with us wherever we go, including on vacations.
It is a real temptation to keep up with work so that we’re not buried when we return from vacation and it is a normal activity; but it is not the healthiest way to decompress.
There is a significantly greater risk of our devices and our user access being compromised while we are traveling than when employees are in the office. The criminal doesn’t have to be a shoulder-surfer to capture you typing in a passcode and then swiping your device. Con men have an easier time plying their trade while someone’s guard is down on vacation.
Since it is unlikely that I will persuade users to leave your laptops, tablets, and smart phones at home, I want to offer some security dos and don’ts that will reduce the risk of you becoming an unwitting accomplice to a security breach. Consider sharing these simple tips with your family and friends.
- Be suspicious of public Wi-Fi hotspots
It’s tempting to connect to public hotspots to download a movie or catch up on your favorite soap before jumping on an airplane. But if you connect to a dubious Wi-Fi hotspot like “FREEPUBLICWiFi” or “Jims_Phone,” the provider can intercept your traffic or even redirect you to alternate websites that will download malware on your device so they can control it or access it at will.
Best to plan ahead and download that movie or other large data downloads before you travel. For smaller data usage, your wireless cellular data plan is a far more secure method of connecting to the internet than unfamiliar Wi-Fi hotspots. If you’re going to use public Wi-Fi, check with posted signs at airports and hotels to make certain that the network you are connecting with is the officially-provided one. And if you are connecting to conduct work-related tasks, use a VPN for optimal security.
- Keep your device secured
Many organizations use mobile device management software or have policies that require a pin code to access mobile devices to access business email. If this is not required, add a personal pin code to your device anyway. To reduce the inconvenience of typing in your code every time you want to access your device, use biometric access like a fingerprint scanner or facial recognition.
Devices are lost every day – left at airport security, stolen on a train, or abandoned in a hotel room. Do you really want to give immediate access to everything on it? Always know where your device is. Lock your devices in the hotel safe provided in your room when you are going to be away, even for short periods, like going to lunch or dinner.
- Use Multi-Factor Authentication (MFA or 2FA)
We’re all familiar with passwords. They help to provide authentication, which is a fancy way of saying that you are who you say you are. Passwords are an example of one type of factor for authentication – “something you know.” The other factors are “something you are” and “something you have.” Something you are is provided through biometrics and something you have can be the physical device itself or a card, as examples.
2FA means using a combination of factors for more security to authenticate. We do this all the time when we use a credit card and enter our zip code on a fuel pump. Access to sensitive or work-related apps, such as Google accounts, can be made far more secure by taking advantage of 2FA when it is offered. With 2FA, even if someone steals your password to an account, unless they have your thumbprint or your device, they can’t use the password alone to access your accounts.
- Out of Office messages
Many of us turn on out-of-office notifications to let our colleagues know that we won’t be responding to that urgent email they just sent. But if you turn on that notification for those outside of your organization, without limiting it to your contacts, you may be guilty of providing too much information.
A common confidence scam is to send email to many different addresses (found on social media) to check and see who is on vacation. Attackers then use that information to contact a work colleague and convince them that the absent employee is requesting urgent but sensitive information that is needed that you promised them, but that you failed to provide before they left.
It may be unavoidable to use out-of-office notifications externally if you are in a customer-facing role. But consider sending a pre-emptive out-of-office notification to specific external parties so you don’t have to use the indiscriminate version built into your email client.
- Update your software
The recent ransomware attacks have highlighted the need to keep software updated. Malware such as viruses, worms and ransomware are possible because of vulnerabilities that exist in software. Software developers are constantly eliminating these vulnerabilities as they are found, which means that if you aren’t allowing your updates to proceed, you are leaving yourself vulnerable to malware.
As travel exposes your devices to more risk, it’s a good idea to check that your operating systems, anti-virus and web browsers are updated before you leave the office.
Enjoy your time off, and be safe!
To learn more about TCC’s IT Managed Services, please visit our website https://e-tcc.com/managed-services.
Technology, Process and Expertise 