[ad_1]
Bbusinesses are used to being prepared for a disaster and most will have had a well-rehearsed continuity plan in place in case one struck. But even the best plan couldn’t have effectively anticipated the wholesale overnight shift to home working that Covid-19 has caused.
“As a result,” Morgan Wright, chief security adviser at cybersecurity firm SentinelOne says, “issues of privacy, collaboration, access and compliance have highlighted weakness in policies and gaps in security.” One of the problems is that even at many larger companies, being caught on the hop by the lockdown has meant that individual departments have been left to find their own ways to work collaboratively.
Videoconferencing applications such as Zoom have made the headlines not only for the unprecedented increase in user numbers – Zoom saw daily traffic to its official download site increase by 535% and the number of daily meeting participants hit 200 million in March – but also for privacy and security concerns. Although Zoom itself has tried to address those concerns, the question remains: do you have to sacrifice security at the altar of collaborative apps when working from home?
Cybersecurity gaps
The very act of working from home introduces cybersecurity gaps. Remove that person in the next cubicle or at the desk opposite and you remove part of the human-error buffer. Human nature is such that we are more likely to ask that person for reassurance if we aren’t sure about a configuration option than risk looking stupid by calling tech support or even emailing a departmental manager. This has played into the “zoombombing” problems that have plagued Zoom as millions of users new not only to the app itself but videoconferencing itself have rushed to connect.
“Videoconferencing systems often come with default settings which are open in nature and vulnerable to being compromised,” says Mark Rodseth, technical director at digital transformation agency Somo. Default settings such as passwords are not being enabled. Although Zoom rectified this on 4 April and added a waiting-room feature so that you can only join a meeting when the host lets you in, it’s a setting that needs to be checked no matter what collaboration app you are using.
Ensure that you are using a different strong password for each application, as password reuse enables attackers to walk into several accounts if just one gets compromised elsewhere. I used to password manager. Not only will this enable you to set different passwords for every app, but their built-in password generator functions will ensure it’s a strong one.
Adam Palmer, at cyber exposure specialist Tenable, has some more configuration advice for your videoconferencing tool of choice. “When creating virtual meeting rooms, do not make them public,” he says. “When configuring a meeting, opt to create a randomly generated ID rather than checking the personal meeting ID option and set meetings to private.” Palmer also suggests disabling any “join before host” option to prevent potential trouble before a host arrives. “Additional precautions include disabling the option to allow removed participants to rejoin and share files,” Palmer adds.
Do not overlook the privacy and security implications of what’s on view when you’re making a video call. File sharing is another problem area. Many videoconferencing tools, along with collaborative messaging apps, are vulnerable to the threat of malicious links and attached documents sent by someone masquerading as a work colleague or customer. These attacks will be highly targeted “spear phishing” ones, unlike the spam email variety. But the safeguarding rules you would apply to email still apply to your work-from-home collaboration apps, says Oz Alashe, chief executive of cybersecurity awareness company CybSafe. “Ask yourself if you were expecting the message, ask yourself if the message conveys an undue sense of urgency, check the sender details.”. Of course, it’s not just incoming links and file sharing that’s an issue – outgoing ones can be just as problematic.
Data sharing
Mark Rodbert, boss of identity analytics company Idax, says his biggest concern right now is with data-sharing tools such as Dropbox and Google Drive. “There has been a sudden and unprecedented need for people to share data over, above and around the ways they have in the past,” he warns, “and that’s where you lose control.” To regain control, you need to follow a few relatively simple guidelines. As we are talking specifically about collaboration here, you’ll be giving other users editing rights to your Google Drive document. That’s a problem, as they can then share it on as well, something you’ll need to prevent. To do this, click on “share” and select “advanced”. From here, you can opt to “prevent editors from changing access and adding new people”.
Do not overlook the privacy and security implications of what’s on view when you’re making a video call
You’ll need to do this for the files inside a folder rather than the folder itself, by the way. You should also choose who you are sharing the data with, which may sound obvious, but if you use the “shareable link” option, your document will be available to anyone with that link, including people without Google accounts and hackers. Far better to be more specific by using the “people” share option where you specify the email address of those who can get access. To make this easier for larger teams, if you don’t have access to workgroups through a corporate G Suite account, you can create a “collaborative inbox” Google Group and specify access to that instead. Add everyone who needs access to the document with different groups for different projects; it makes collaborative sharing easy enough. Be sure to set group visibility to members only, though, and make joining any group invite only.
Two-step authentication
As far as any app is concerned, enabling two-step authentication should be a priority. That way, even if a hacker gets access to your login credentials, there’s an extra layer of protection stopping them from accessing files. Use the mobile app option for code delivery, though – it’s safer than using SMS text delivery. Authenticator apps such as Google Authenticator and Authy are free and easy to set up. Two-step options are found by clicking your username, then settings / security. From here, you can check to see which web browsers and devices are signed in or connected to your account. Unlink any devices you don’t recognize or haven’t used for a while, and if you don’t recognize a web session, you can simply delete it to boot them off (and then change your password to be on the safe side) . Both Google and Dropbox offer security audits, or check-ups, that will guide you through all these processes and are well worth spending a few minutes on.
Do not overlook the privacy and security implications of what’s on view when you’re making a video call. Many people will forget they have sticky notes with login credentials stuck on a noticeboard behind them – don’t do that. “A useful feature we recommend using for any video meetings with external parties in Microsoft Teams is the‘ blur my background ’feature,” says Bruce Penson, managing director of Pro Drive IT, “which protects against this happening.” Zoom users can also apply a virtual background.
