COVID-19 Cybersecurity Advice: NCSC, NIST and others issue secure remote working guidance

guest · Mar 17, 2020

Covid-19: NCSC issues secure remote working guidance
...the UK’s NCSC has issued best practice guidance to enable security teams to support them
March 17, 2020
https://www.computerweekly.com/news/252480177/Covid-19-NCSC-issues-secure-remote-working-guidance

The National Cyber Security Centre (NCSC) has published new guidance to support businesses and individuals transitioning to full-time remote working as part of social distancing and quarantine measures – [...]

The NCSC has taken this step in recognition that universal remote working presents cyber security challenges that organisations do not usually have to deal with, and to support its previous warnings that cyber criminal groups are now widely exploiting the coronavirus in phishing, malware and ransomware campaigns.

“While working from home will not be new to many organisations and employees, the coronavirus is forcing organisations to consider home working on a greater scale, and for a longer period of time,” said the NCSC.
Click to expand...

Remote workers will also need to know what to do if the worst happens and their device is lost or stolen.

It’s also important to give remote workers a refresher course in basic security best practice, taking time to make sure they know how to report any security issues; that they understand the importance of, and are empowered to, keep their software and devices up to date and patched; as well as how not to fall victim to many of the threats they may encounter, which is particularly important at a time of heightened stress.
Click to expand...

NCSC: Home working: preparing your organisation and staff

How to make sure your organisation is prepared for an increase in home working, and advice on spotting coronavirus (COVID-19) scam emails
Click to expand...

guest · Mar 17, 2020

Working from home: Cybersecurity tips for remote workers
March 16, 2020
https://www.zdnet.com/article/working-from-home-cybersecurity-tips-for-remote-workers/

With the rapid increase in remote working in mind, European cybersecurity agency ENISA has set out a series of recommendations for companies moving to teleworking as a result of COVID-19.

The agency recommends, as far as possible, that workers try to not mix work and leisure activities on the same device and be particularly careful with any mails referencing the coronavirus. "Attackers are exploiting the situation, so look out for phishing emails and scams," ENISA said.
The agency also warned remote workers to be suspicious of any emails asking them to check or renew their passwords and login credentials, even if they seem to come from a trusted source.

"Please try to verify the authenticity of the request through other means, do not click on suspicious links or open any suspicious attachments," it said.

The UK's National Cyber Security Centre (NCSC) has also issued a similar warning about coronavirus-themed phishing attacks.
Click to expand...

ENISA: Top Tips for Cybersecurity when Working Remotely

Luckily, in this increasingly connected world we can continue our professional and private lives virtually. However, with huge increases in the number of people working remotely, it is vital that we also take care of our cyber hygiene.
Click to expand...

guest · Mar 21, 2020

COVID-19 Cybersecurity Advice: FTC, NIST, and CISA Release Guidance on Secure Teleworking and Critical Infrastructure Jobs
March 20, 2020
https://www.insideprivacy.com/covid...teleworking-and-critical-infrastructure-jobs/

In response to the drastic increase of U.S. employees working remotely, the U.S. Federal Trade Commission (“FTC”) and the U.S. National Institute of Standards and Technology (“NIST”) have both issued guidance for employers and employees on best practices for teleworking securely.
In addition, the Cybersecurity and Infrastructure Security Agency (“CISA”) has provided advice on identifying essential workers, including IT and cybersecurity personnel, in critical infrastructure sectors that should maintain normal work schedules if possible. Each set of guidance is discussed in further detail below.
Click to expand...

NIST Guidance to Enterprises on Secure Telework, Remote Access, and BYOD
NIST has issued a bulletin on Security for Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Solutions to “help organizations mitigate security risks associated with the enterprise technologies used for teleworking.”

The bulletin summarizes key concepts and recommendations from NIST SP 800-46, Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security and recommends that organizations consider the “balance between the benefits of providing remote access to additional resources and the potential impact of a compromise of those resources.”
To mitigate the risks associated with providing remote access, NIST recommends hardening resources against external threats and limiting access to the “minimum necessary.”
Click to expand...

FTC and NIST Guidance on Secure Teleworking for Employees
The FTC’s blog post on Online Security Tips for Working from Home, as well as guidance released by NIST on Telework Security Basics, build on prior guidance from both organizations on key cybersecurity practices.

While both organizations’ secure teleworking guidance are directed to individuals, employers should be prepared to support their employees in following the guidance and use it as a reference point for their own cybersecurity practices for remote work.
A summary of key points from both sets of guidance is provided below.
Click to expand...

CISA Guidance on Critical Infrastructure Workforce
CISA has also released guidance on the identification of essential critical infrastructure workers that have a “special responsibility” to maintain their “normal work schedule” during the COVID-19 response.

The guidance covers workers across all sixteen critical infrastructure sectors and specifically identifies several categories of IT or information security personnel, including workers “supporting [information technology] command centers,” data center operators, client service centers and technicians supporting critical infrastructure, and workers “responding to cyber incidents involving critical infrastructure.”
Click to expand...

guest · Mar 22, 2020

How CIS Can Help Teleworkers Improve their Cyber Defenses
March 19, 2020
https://www.cisecurity.org/blog/how-cis-can-help-teleworkers-improve-their-cyber-defenses/

As the COVID-19 pandemic is forcing more and more companies to adjust their work schedules and move to telework environments, CIS remains committed to keeping our CIS SecureSuite Members secure on the home front. Our commitment to protecting the global IT community is stronger than ever, even amidst concerns that cybercriminals are searching out ways to exploit the disruptions caused by the coronavirus (Cyber Threat Actors Expected to Leverage Coronavirus Outbreak).
Click to expand...

Easing into the telework transition
During these trying times, CIS offers 5 Network Security Remedies for Telework to help ease the transition from on-prem to remote work:

Practice smart password management and enable two-factor authentication

Enable automatic updates for all routers and modems

Turn off WPS and UPnP

Turn on WPA2 or WPA3

Configure the router/modem firewall

Click to expand...

The CIS Controls Telework and Small Office Network Security Guide helps combat security concerns affecting home and personal network equipment use; it provides an easy checklist so employees working from home can assess their networks, and return to their IT department for review.
CIS resources to enhance cyber defenses at home
CIS offers other resources that your organization can use to help with the transition to a remote workforce model: [...]
Click to expand...

guest · Mar 23, 2020

Work-from-Home Security Advice
March 19, 2020
https://www.schneier.com/blog/archives/2020/03/work-from-home_.html

SANS has made freely available its "Work-from-Home Awareness Kit."

When I think about how COVID-19's security measures are affecting organizational networks, I see several interrelated problems:

One, employees are working from their home networks and sometimes from their home computers. These systems are more likely to be out of date, unpatched, and unprotected. They are more vulnerable to attack simply because they are less secure.
Two, sensitive organizational data will likely migrate outside of the network. Employees working from home are going to save data on their own computers, where they aren't protected by the organization's security systems. This makes the data more likely to be hacked and stolen. [...]
Worrying about network security seems almost quaint in the face of the massive health risks from COVID-19, but attacks on infrastructure can have effects far greater than the infrastructure itself. Stay safe, everyone, and help keep your networks safe as well.
Click to expand...

SANS: SANS Security Awareness Work-from-Home Deployment Kit

Everything you need to know to create a secure work-from-home workforce during the COVID-19 pandemic and beyond
Click to expand...

guest · Mar 26, 2020

Amid Coronavirus, CISA and NIST Issue Guidelines to Boost Federal Telecommuting
March 26, 2020
https://www.nextgov.com/ideas/2020/...uidelines-boost-federal-telecommuting/164128/

The federal government continues to refine its teleworking policies in the wake of the coronavirus pandemic, even acting over the weekend to issue guidelines designed to make it easier for federal workers and contractors to perform their jobs from remote locations.

Predictably, this forced rush to telecommuting has caused many problems, with one of the most concerning being a surge in targeted attacks against strained federal networks. Hackers are taking advantage of the telecommuting chaos to launch attacks across the spectrum.
Click to expand...

With agencies scrambling to try and make their VPN plow horses run more like thoroughbreds, the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency just released a set of VPN guidelines that might solve, or at least workaround, major chokepoints the government is experiencing.

Some tips in CISA’s AA20-073A Alert include: [...]
The CISA guidelines are good, though agencies should probably also try and stagger the workload by having different groups work at different times.

The problems agencies will face with teleconferencing is not about technology. It’s more so about employees who are used to working in the office every day suddenly having to teleconference without knowing the basic rules, much less how to give calls the appropriate level of security.
For that, NIST’s Jeff Greene has created a guide about how to safely teleconference and keep agency secrets secure. The suggestions in the NIST guide is fairly straightforward, though they might not be obvious to those who don’t regularly join conferences.
Click to expand...

And most critically, know your agency’s policies for virtual meeting security. The paper offers a helpful chart with some good suggestions that increase in severity alongside a call’s importance and classification.
It might seem like a mad scramble toward telecommuting in government right now, but you could almost consider this a practical side effect of the current crisis.
Click to expand...

guest · Mar 27, 2020

COVID-19 cyberattacks: Follow these 8 tips from CERT-In while working from home
March 27, 2020
https://english.manoramaonline.com/...-cuberattacks-surge-work-from-home-india.html

New Delhi: There has been an increase in the number of cyberattacks on personal computer networks and routers since professionals were asked to work from home in the wake of the COVID-19 outbreak in the country, the national cyber security agency said on Friday.

"Cyber criminals are exploiting the COVID-19 outbreak as an opportunity to send phishing emails claiming to have important updates or encouraging donations, impersonating trustworthy organisations," the CERT-In said in its latest advisory to internet users.
The Computer Emergency Response Team of India (CERT-In) said the phenomenon has been witnessed as many organisations have asked their staff to work from home to help stop the spread of the coronavirus that has claimed thousands of live worldwide and infected millions.

"Switching to remote working because of the COVID-19 can create cyber security problems for employers and employees.
Countermeasures and best security practices by CERT-In [...]
Click to expand...

The CERT-In is the country's nodal agency to combat cyberattacks like hacking and phishing and is also mandated to fortify the security of the country's internet domain.
Click to expand...

Dermot7 · Mar 28, 2020

While remote working might have been a feature in some companies before now, many others would have found themselves with days - if not hours - to prepare for the new, restricted reality.

That will have seen a lot of firms cobble together incomplete remote working systems, operated under hurriedly devised practices by ill-prepared - and somewhat disorientated - staff.

A dream come true for a cyber-criminal.
Click to expand...

https://www.rte.ie/news/business/2020/0328/1126938-cyber-crime-remote/

hawki · Apr 1, 2020

"Okta Partners with VMware, CrowdStrike to Boost Log-In Security

Joint products aim to help protect corporate networks as remote work increases during pandemic.

Okta Inc., a maker of identity management software, unveiled three cybersecurity partnerships meant to help safeguard corporate networks while millions of employees have been forced to work remotely.

Okta announced the agreements Wednesday with VMware Inc.’s Carbon Black unit, CrowdStrike Holdings Inc. and Tanium Inc., companies that help protect networks and applications from unsafe software and devices..."

https://www.bloomberg.com/news/arti...ganic&utm_content=business&utm_source=twitter

guest · Apr 9, 2020

Zoom, Microsoft & NTT Data Leaders Share Work-from-Home Security Tips
April 9, 2020
https://www.darkreading.com/operati...e-work-from-home-security-tips/d/d-id/1337532

Many organizations are scaling their remote employee base from a small percentage to nearly 100% and relying on technology to bring workers, clients, and partners together. As they do, tech leaders urge them to put security measures in place to protect corporate information.

"The biggest threat is companies rapidly enabling remote work and lowering security standards," Ross said. "Another big one would be corporate data [that] people are accessing on their own devices, devices that are not managed and protected according to a corporate standard."
Organizations are scrambling to secure remote staff when many haven't had time to plan for it, panelists agreed. Telling people to simply take their workstations home "might work in some cases," Ross explained, "but that almost makes me think of a scenario where an organization is lowering their security standards in order to remain effective and be able to do work."

While it's tempting to do just that, Ross noted it's important to maintain practices like security awareness training.
Click to expand...

guest · Apr 17, 2020

Microsoft: Do this to secure your remote desktop users
April 17, 2020
https://www.techrepublic.com/article/microsoft-do-this-to-secure-your-remote-desktop-users/

Microsoft has warned of the risks associated with allowing remote access to desktop services while working from home, publishing guidance on how IT teams can maintain secure working environments when faced with an increase in remote connections.
It said there has been an increase in the number of systems accessible via the traditional Remote Desktop Protocol (RDP) port and a well-known "alternative" port used for RDP.

According to Microsoft, various considerations should be made when offering remote desktop access to employees, including reviewing firewall policies to access whether any systems are directly exposed to public internet; controlling and logging remote access by employees; implementing multi-factor authentication and assessing whether a it would be possible for a hacker to move laterally through a corporate network once they gained access.
Click to expand...

Microsoft: Security guidance for remote desktop adoption

guest · Apr 17, 2020

AHA and AMA Release Joint Cybersecurity Guidance for Telecommuting Physicians
April 17, 2020
https://www.hipaajournal.com/aha-an...curity-guidance-for-telecommuting-physicians/

The American Medical Association (AMA) and the American Hospital Association (AHA) have issued joint cybersecurity guidance for physicians working from home due to the COVID-19 pandemic to help them secure their computers, mobile devices, and home networks to and safely provide remote care to patients.

Physicians are able to use their mobile devices to access patients’ medical records over the internet as if they were in the office, and teleconferencing solutions allow them to conduct virtual visits using video, audio, and text to diagnose and treat patients. However, working from home introduces risks that can jeopardize the privacy and security of patient data.

“For physicians helping patients from their homes and using personal computers and mobile devices, the AMA and AHA have moved quickly to provide a resource with important steps to help keep a home office as resilient to viruses, malware and hackers as a medical practice or hospital,” explained AMA President. Patrice A. Harris.
The guidance includes a checklist for computers, which lists several actions that should be taken to strengthen security and reduce susceptibility to threats such as phishing, malware, and ransomware.
Click to expand...

Guidance: "Working from home during COVID-19 pandemic" (PDF):
https://www.ama-assn.org/system/files/2020-04/cybersecurity-work-from-home-covid-19.pdf

Krusty · Apr 17, 2020

Cyber security is essential when preparing for COVID-19

In light of the COVID-19 pandemic, organisations are developing strategies to protect staff and vulnerable members of our community.

The Australian Signals Directorate (ASD) would like to remind you to incorporate cyber security into your contingency planning. As more staff may work from home, and the use of remote access technology increases, adversaries may attempt to take advantage. ASD's Australian Cyber Security Centre (ACSC) encourages Australians to remain vigilant and ensure sound cyber security practices.
Click to expand...

https://www.cyber.gov.au/news/cyber-security-essential-when-preparing-covid-19

COVID-19 cyber security advice

The Australian Cyber Security Centre (ACSC) has observed an increase in COVID-19 themed malicious cyber activity. Our advice and guidance will help you protect your systems, data and personal information during COVID-19. We will continue to mitigate and disrupt these COVID-19 related scams and we encourage Australians to remain vigilant and maintain strong cyber security practices during this time.
Click to expand...

https://www.cyber.gov.au/COVID-19

Threat update: COVID-19 malicious cyber activity

This update is designed to raise awareness of increasing COVID-19 themed malicious cyber activity, and provide practical cyber security advice that organisations and individuals can follow to reduce the risk of being impacted.

Malicious cyber actors are actively targeting individuals and Australian organisations with COVID-19 related scams and phishing emails. These incidents are likely to increase in frequency and severity over the coming weeks and months. This is due, in part, to the ease in which existing scam emails and texts can be modified with a COVID-19 theme.

Opportunistic malicious actors are exploiting people’s concerns and desire for information about the COVID-19 pandemic by directing them towards websites designed to either install malicious software or steal personal information. In the last few weeks, the Australian Cyber Security Centre (ACSC) has observed thousands of COVID-19-related websites being registered. While the majority of these websites are legitimate, many are being created by malicious cyber actors seeking to exploit Australians during this difficult time.

The malicious COVID-19 websites are designed to look legitimate or impersonate well-known organisations, making it difficult for individuals to detect. Cybercriminals use them to install computer viruses onto people’s devices, such as banking Trojans or different variants of ransomware, in order to generate profit. In other cases, they seek to harvest user credentials, such as personal identification, passwords and bank details, which are then used to gain access to the user’s networks, devices or online financial accounts.

The ACSC, with assistance from our law enforcement and industry partners, is engaged in efforts to disrupt or prevent these malicious COVID-19 themed cyber activities. Ongoing analysis of COVID-19 scams and phishing emails indicates the majority of them are quite sophisticated, often impersonating trusted entities such as the Australian Government. The methods used are constantly evolving, with malicious actors regularly adapting their tradecraft to circumvent attempts to stop them.

Those engaged in cybercrime activity are not constrained by geographic borders and their actions can have far-reaching consequences. The ACSC is aware of reports that malicious actors based in Eastern and Western Europe, Asia and Africa have been responsible for launching COVID-19 themed malicious cyber activity, including against Australians.

The ACSC strongly encourages organisations and individuals to remain vigilant against the threat of COVID-19 themed scams, phishing emails and malicious websites.
Click to expand...

https://www.cyber.gov.au/threats/threat-update-covid-19-malicious-cyber-activity

guest · Apr 18, 2020

New York Department of Financial Services Released New Guidance Addressing COVID-19 Related Cybersecurity Risks
April 17, 2020
https://www.hldataprotection.com/20...ressing-covid-19-related-cybersecurity-risks/

Continuing its focus on COVID-19’s impact on its regulated entities, on April 13, the New York Department of Financial Services (NYDFS) released new cybersecurity guidance in response to the COVID-19 pandemic.

The guidance highlights the heightened cybersecurity risks from the current crisis and NYDFS’ expectations that its regulated entities address those risks as large portions of their workforce have shifted to remote working arrangements.
The new cybersecurity guidance goes further in identifying and elaborating on three areas of risk: remote working, increased phishing and fraud, and the use of third-party vendors.
Remote Working
Many NYDFS regulated entities have had to make an abrupt shift to work from home arrangements to slow the spread of COVID-19. However, this shift has created new cybersecurity vulnerabilities and expanded the endpoints that criminals can target.
Click to expand...

Increased Phishing and Fraud
As employees no longer consistently work face-to-face, NYDFS emphasizes that its regulated entities may need to reevaluate their authentication procedures, remind employees to be alert for phishing and other social engineering schemes, and revisit broader employee phishing training to minimize the risk of falling victim to these new schemes.
Third Party Risk
Third-party vendors may struggle to deal with COVID-19 restrictions. NYDFS notes that its regulated entities should proactively engage critical vendors to determine how they are addressing the heightened cybersecurity risk environment and then reevaluate their own risk exposure accordingly
Click to expand...

Krusty · Apr 21, 2020

Coronavirus-related scams are replicating Government announcements within hours, officials warn

If you receive a text message that appears to be from the Federal Government about coronavirus, you should think twice before clicking on any links.

[...]
Can you spot the difference?
In one case, a text message was sent to thousands of Australians on March 30 from what appeared to be the Federal Government.

It asked recipients to click on a link to learn more about COVID-19 restrictions and how to keep safe during the pandemic.

Authorities destroyed the website, but the criminals quickly issued a new text message which claimed to be from MyGov and included a new link.

While it's not known how many people clicked through, Australians could have easily been duped because it was widely publicised that the Federal Government had issued a legitimate text message about coronavirus.

"Cybercriminals will look at existing and legitimate content that's out there and will model the criminal scams on what's already out there," Mr Hanmore explains.

"So, it's a bit challenging for people to detect."

While many of the scams look legitimate, Mr Hanmore says there is one simple way to protect yourself.
Click to expand...

https://www.abc.net.au/news/2020-04...threat-to-australians-cyber-security/12168060

guest · Apr 21, 2020

Resource Guide for Cybersecurity During the COVID-19 Pandemic
April 19, 2020
https://www.cisecurity.org/blog/resource-guide-for-cybersecurity-during-the-covid-19-pandemic/

According to the results of the CSO Pandemic Impact Survey, 61% of the security and IT leader respondents are concerned about an increase in cyber-attacks targeting their employees who are working from home. They’re right to be concerned; according to the survey, 26% have seen an increase in the volume, severity, and/or scope of cyber-attacks since mid-March.

The Center for Internet Security's (CIS) Security Operations Center (SOC) has seen a marked increase in remote desktop protocol (RDP) exploitation, likely due to malicious attempts to exploit teleworking capabilities. There has also been a significant shift to using COVID-19 styled phishing and malspam campaigns.
This resource guide from CIS provides information about common cyber-attacks that are currently being reported. It also provides resources for improving cyber hygiene to enhance cyber defenses, both for organizations and their employees.
Click to expand...

It's crucial to provide continuous support for remote employees. Don’t wait to provide guidance or reminders for cybersecurity. This guide contains actionable recommendations for your employees.
Click to expand...

Minimalist · Apr 29, 2020

Remote spring: the rise of RDP bruteforce attacks

With the spread of COVID-19, organizations worldwide have introduced remote working, which is having a direct impact on cybersecurity and the threat landscape.

Alongside the higher volume of corporate traffic, the use of third-party services for data exchange, and employees working on home computers (and potentially insecure Wi-Fi networks), another headache for infosec teams is the increased number of people using remote-access tools.
Click to expand...

https://securelist.com/remote-spring-the-rise-of-rdp-bruteforce-attacks/

guest · May 2, 2020

DHS CISA Launches Site for Teleworking Security
...one-stop source for information on securing teleworkers and their employers
May 1, 2020
https://www.darkreading.com/operati...-site-for-teleworking-security/d/d-id/1337718

The Cybersecurity and Infrastructure Security Agency (CISA), an agency of the Department of Homeland Security, has launched a product line dedicated to the needs of companies and individuals who have adopted teleworking. At a new website designed to pull together information from a variety of government and private sector sources, CISA provides tips, best practices, and guidance on topics ranging from secure video conferencing to new threats facing teleworking employees.

In a prepared statement on the launch, CISA Director Christopher Krebs said, "We are working with our federal and private sector partners to understand the threat landscape and provide a central point of the latest and most up-to-date information for organizations to keep their networks and employees safe."
CISA anticipates that the information on the site will change as the conditions surrounding the coronavirus pandemic and other business conditions evolve.
Click to expand...

CISA: Telework Guidance and Resources

guest · May 14, 2020

NSA issues cybersecurity guidelines for remote desktop users
May 14, 2020
https://www.techradar.com/uk/news/nsa-issues-cybersecurity-guidelines-for-remote-desktop-users

The number of cyber attacks has steadily risen in recent months, as more and more businesses adopt work-from-home procedures in an attempt to maintain productivity while respecting quarantine orders and social distancing.

In response to this threat, the US National Security Agency (NSA) has released a series of telework guidelines, emphasizing the importance of end-to-end encryption and other security measures.
The NSA is not the first to give guidance on dealing with security risks when using remote desktop software. In April, Microsoft posted instructions for protecting against cyber attacks when using its Remote Desktop Protocol (RDP), one of the most popular remote access solutions worldwide.

Additionally, users should take into consideration the privacy policy and transparency of any remote access tool being used.
Ultimately, businesses will have to decide for themselves which security features are most important, using the NSA guidelines as a starting point.
Click to expand...

guest · Jun 18, 2020

NSA Revises Guidance on Teleworking Services for Government Users
June 18, 2020
https://www.nextgov.com/cybersecuri...teleworking-services-government-users/166266/

The National Security Agency updated guidance to help federal agencies choose secure collaboration services, changing its determination of whether a number of products offered end-to-end encryption and other security features.

Changes to the NSA’s guidance, along with comments from some of the vendors, highlight the big-picture political fight over end-to-end encryption and an enduring disconnect among various government officials, industry representatives and privacy advocates on what the term means.
Click to expand...

NSA examined the policies of 15 companies in the June 4 version of its guidance, including Zoom, Microsoft Teams, Google G Suite, Slack, Skype for Business and Wickr, all of which NSA changed its designations for regarding factors such as whether the service offered certain kinds of encryption, or allowed users to control invitations to virtual meetings.

As the coronavirus pandemic forced government employees to choose conferencing services to enable remote work, the NSA listed nine decision-making criteria against five functions—text chat, voice conferencing, video conferencing, file sharing, and screen sharing—for prioritizing security.
Here are the criteria NSA recommended considering: [...]
Click to expand...

guest · Jun 22, 2020

Employees Say They're Working From Home Without Security Guidance
June 22, 2020
https://www.darkreading.com/endpoin...home-without-security-guidance/d/d-id/1338149

The sudden rush to work from home has left companies scrambling to secure millions of enterprise logins. While a new study reports that 93% of now-remote employees are confident their employers are securing their work, the workers also cite significant shortcomings in the technology and training providing that security.

The study, by IBM Security and Morning Consult, finds 53% of work-from-home employees are using their personal computers to do their jobs. Yet 61% say they haven't been given new technology to secure those machines, and 43% say they haven't received new training on secure remote-enterprise computing.
And while 75% report they now hold at least one meeting weekly via videoconferencing, 54% say there are no new security policies to deal with those remote meetings.
Click to expand...

Minimalist · Jun 29, 2020

Over 100k daily brute-force attacks on RDP in pandemic lockdown

The number of daily brute-force attacks against Windows remote desktop service has almost doubled during the pandemic lockdown, telemetry data shows.

With the increase of remote workers during the COVID-19 period, many users no longer relied on the infrastructure monitored by the company to access sensitive information on the network.
Click to expand...

https://www.bleepingcomputer.com/ne...te-force-attacks-on-rdp-in-pandemic-lockdown/

guest · Aug 15, 2020

How to Provide a Secure Cloud Environment for Remote Workers
August 13, 2020
https://www.cisecurity.org/blog/how-to-provide-a-secure-cloud-environment-for-remote-workers/

The shift to a global remote workforce is demonstrating just how difficult securing a cloud environment can be. This is especially true for organizations that host their infrastructure on-premises.

To address these challenges, many companies are migrating to the cloud, leveraging cloud service providers (CSPs) such as Amazon Web Services, Microsoft Azure, Google Cloud Platform, and Oracle Cloud. These public cloud providers offer cost-effective, scalable cloud computing solutions.
Shared Responsibility Model Characteristics
Based on the type of cloud environment required by an organization, the delineation of security responsibilities will differ. [...]
Click to expand...

Ultimately however, the protection of an organization’s data lies with the organization itself. And that's where the Center for Internet Security (CIS) can help. CIS strives to make the connected world a safer place by developing, validating, and promoting best practice solutions that help people, businesses, and governments protect themselves against pervasive cyber threats.
Click to expand...

Log in or Sign up

COVID-19 Cybersecurity Advice: NCSC, NIST and others issue secure remote working guidance

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Dermot7 Registered Member

hawki Registered Member

guest Guest

guest Guest

guest Guest

Krusty Registered Member

guest Guest

Krusty Registered Member

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

Log in or Sign up

COVID-19 Cybersecurity Advice: NCSC, NIST and others issue secure remote working guidance

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Dermot7 Registered Member

hawki Registered Member

guest Guest

guest Guest

guest Guest

Krusty Registered Member

guest Guest

Krusty Registered Member

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

Useful Searches