As businesses scrambled to mobilize a remote workforce, gaps and inefficiencies are likely to be found in the coming days. Businesses will have to focus now on productivity, efficiency and security of their remote team. Below is a 10 step action plan:
1. Implement endpoint protection for remote workers
While you may have the ability to manage all the workstations at your office, you do not have the same control on home computers. For a remote machine, Windows Defender included in Windows 10 is an acceptable antivirus, but endpoint protection solutions are recommended for better management of remote workstations.
► 1 in 10 Mac users have been attacked by the Shlayer Trojan
► Set a policy for all home employees to keep antivirus running at all times
► Deploy cloud-based monitoring of workstations
► Leverage remote support tools such as Splashtop SOS or LogmeinRescue
► Explore cloud based desktop, server and applications
► Evaluate efficacy of your Business Continuity Planning. This may not be the last time you need it
2. Review what tools and software your team needs
To maintain efficiency of your workforce, review your current communication and collaboration capabilities. You can leverage Office 365 for cloud enabled business email and remote collaboration and document sharing from anywhere, any device within your team and across your supply chain. Your IT solutions provider should be able to utilize volume licenses and relationships to find the most cost effective solution for you.
Another critical requirement for productive remote workforce is Unified communication with integrated platform for remote messaging, presence, voice, mobility, audio, web and video conferencing, desktop and data sharing in a secured way. Many VOIP solutions have integrated communication, but not all are equal, especially if you have international remote team. Talk to your IT solution provider and find the solution that works best for you.
3. Multi-factor authentication (MFA)
Remote working substantially increases the attack surface and opportunities for cyber attack. Consider adding MFA when adding more remote access solutions. MFA can be enabled for both VPN access to the network as well as applications like Office 365 and enterprise applications. While your firm may need to move quickly to allow your staff to work remotely, you can still ensure that only valid users and administrators are allowed in and not any attackers. CMIT Secure services integrate MFA as a core feature of all solutions
4. Ensure remote access does not introduce more risk
You may had to suddenly set up remote access servers, virtual desktops, VPN and other remote technologies. For remote access services, remember that cyber attackers scan for open RDP servers, targeting anything responding on port 3389. Moving RDP to another port won’t necessarily help as TSgrinder scans for RDP response on any port.
Do not blindly open remote access ports without thinking of the risks and consequences. Before opening remote access, ensure that the firewall is configured to only respond to certain IP addresses from which your users and IT administrators will be remotely accessing.
5. Use a secured virtual private network (VPN)
As per Department of Homeland Security website, there have been several high-profile vulnerabilities in VPN recently. For example, unpatched Pulse Secure VPN servers continue to be an attractive target for malicious actors.
Older version of VPN is often found on workstations not been updated in years. Also Firewalls being non-user facing devices, often do not receive regular update. So, ensure that your VPN is updated on the server and desktop, and firewall is actively managed and updated.
VPN bandwidth and latency are stressed with sudden increase in remote workload which needs capacity planning. A proactive technology partner would able to guide you through this transition and establish business continuity plan ahead of time, so that in emergencies, you can quickly ramp up and continue your business without losing productivity.
6. Educate employees on COVID-19 scams
The National Cyber Awareness system warned of COVID-19 scams that are circulating. Notify and urge your users to not click on unsolicited emails and to use only official websites. Provide a central online bulletin board for the firm where employees can go to for official communication and notification, especially if anyone in your organization becomes infected.
7. Assess the impact to firewalls, access policies and other logging
Your firm might have a security information and event management (SIEM) logging solution that analyzes the traffic coming from local desktops and laptops to server resources. If your entire workforce traffic suddenly comes in from various IP addresses, your logging platform data will no longer look like “normal”.
Those who use geoblocking in the firewall to restrict access from different locations will need to revise those policies since your remote employees will be coming in from various locations. You may also need to increase internet bandwidth for inbound traffic to your organization. For those who rely on cloud services, you may need to determine if home users have appropriate bandwidth to support work and video conferencing.
You also may find that the security settings of consumer firewalls and internet providers block some of your intended remote access. For example, Comcast’s internet security blocks the use of RDgateway over port 443. You may need to review connection logs, get security logs from your remote users, and add more resources to your help desk to help users connect remotely.
8. Adopt acceptable user policies and engage with employees
Ensure that your firm has acceptable user policies to cover your employees’ home computers and IT . If not already there, you’ll need to quickly get up to speed enabling employee’s personal computers to be used for remote access. You may need to work with your attorneys and tax advisors to see if the use of employees personal computers and phones mandate a need for reimbursement. If your firm deals with highly sensitive or compliance data you may need to provision laptop or remote access to desktop. Once the initial IT infrastructure is set up, retaining longer term productivity requires maintaining employee morale and motivation. Here are some tips for your remote workers to keep them engaged:
► Use video in WebEx wherever possible
► Have a buffer time between meetings, so you can better prepare and adjust for your next meeting
► Ping team members to say “Hi!” in between meetings
► Complete your morning routine and structure your day as If you were going into the office
► Take clear breaks
► Set a definitive finishing time to your day
► Stay organized and keep the supplies you use often within reach
► Stay active!
9. Adapt and explore new opportunities
Every major crisis brings challenges as well as opportunities. Businesses who adapt to the new realities, find new ways to engage with customers and can deliver value among the new realities find new avenues of growth.
Consumer demand has almost entirely shifted digital now. Companies who are ahead in the digital curve are fully positioned to serve that demand. Amazon is hiring 100,000 employees to meet the surge in demand. Business who have invested in digital transformation will likely be clear winner.
Also, as per various industry analysis, some of the changes in the consumer behavior resulting from current environment may be permanent. For example, improvement of digital capabilities and prolonged engagement through digital channel can shift consumer habits for certain categories to mostly online in the long run. So, businesses who would wait and expect a turnaround after the pandemic may never get those consumers back.
So once the immediate shock is settled, businesses may be better off evaluating their digital capabilities, analyze economic and industry trend, benchmark with competition and investment in digital capabilities to prepare for the future.
10. Planning for the future
While this is a stressful time given the uncertainties, it’s also time to evaluate how well your organization is prepared for emergencies like this. The purpose of BCP (Business Continuity Planning) is to prepare for unforeseen situations. So if your IT is scrambling to get your remote team productive, it’s probably time think of the effectiveness of your current IT services. Many of our clients with best practice BCP conduct regular dry runs of remote workflow mobilization. Such clients are operating at with full capacity and exploring how to leverage their strategic advantage to increase market share (while their competitors are struggling just to get up and running).
Adapting to this new reality is difficult, but a strategic IT partner can help your business stay productive in such unforeseen circumstances, and enable you to engage with your customers in new and innovative ways to sustain your business in this challenging time.