Cybersecurity

Cybersecurity for remote workers

Small businesses can’t afford to skimp on security for remote workers. Davey Winder plans out your risk mitigation checklist

Do you have a hybrid workforce? These days almost every business can answer in the affirmative. Unfortunately, the same goes for the follow-up question: do remote workers pose a risk to the security of your organisation?

It doesn’t have to be that way. You may be so small that you think you don’t have the resources to properly secure your data and devices with expensive tools and complex processes, but the truth is that some relatively simple changes can make a huge difference.

Let’s start by acknowledging the elephant in the small-business cybersecurity room: no, you are not invisible to attackers, nor are they only interested in bigger fish. According to penetration testing experts Qualysec (qualysec.com), more than 40% of cyberattacks target small businesses. Sure, some of those will be using your business as a potential stepping stone to a more profitable victim, but that’s no consolation. Being breached for any reason is disruptive, costly and potentially hazardous to your operations and your reputation.

Qualysec also confirmed that 75% of small businesses with a hybrid workforce have at some point experienced a cyber incident. This should come as no shock to anyone, especially in the context of remote work. As the workforce moves beyond the office, new vulnerabilities are exposed – often in environments where IT staff have minimal visibility or control. And yet amazingly, at the same time, 80% of small businesses don’t have a formal cybersecurity policy of any kind.

On these pages I’ll suggest a cybersecurity checklist for small businesses that’s aimed particularly at mitigating the risks associated with remote work. Although without a properly thought-out and regularly audited cybersecurity policy for the whole business you are – and I’m sorry to have to tell you this – screwed anyway. If you need to start drawing up a policy then some of what I’m about to say below can be part of it, but you should also consider granular access to systems and data, passwords and authentication requirements, data protection at rest and in transit, hardware and software updates, security software and/or outsourced services, incident response and reporting. See “Writing a remote work cybersecurity policy” overleaf for more recommendations.