by Jeff Harris, Client Systems Architect, Cornerstone.IT
The following post is the first in a series of blog posts by Jeff Harris that address critical “work from home” topics.
The “New Normal” – New Risks
As a trusted partner to law firms of varying sizes, we at Cornerstone.IT have seen many different responses to the COVID-19 pandemic. They had one common result: within days, all our customers had most (in many cases all) staff working from home. We applaud IT personnel for getting users up and running so quickly, allowing their firms to continue operating as normally as possible. Now that people are working regularly outside the office, and often outside the network, what new risks have emerged?
In this post we will discuss a few new vulnerabilities that have emerged with the “new normal.”
Working From Home the Right Way
First, the obvious question: Is your data secure? As law firms adjust to working from home, there is a risk that firm policies will be ignored in favor of convenience. Are people continuing to use their firm email, store documents exclusively in the firm DMS, and share with outside parties using approved secure methods? Or have they been conducting business using personal email accounts; storing documents on their desktops, personal clouds, or flash drives; or using unapproved personal file sharing programs? Most of these activities are not trackable outside of the firm network, so a refresher on firm policies and procedures may be needed. Firms using a secure virtual desktop solution like Citrix VDI are likely in a better position than those that sent attorneys home with laptops. But all firms should do a thorough risk assessment, focusing on security and data loss. Cornerstone is offering a no-charge Citrix Health Check for many firms – please contact us if you’re interested.
Staff Changes
The global economic impact of the pandemic is well-known. Unfortunately, many firms have had to make the difficult decision to downsize. It’s never easy when coworkers and often friends leave the firm, especially in large numbers under the current circumstances. However, IT and HR need to ensure employee termination procedures are still followed. Accounts should be disabled, and passwords changed, even if the firm is still in communication with a furloughed worker. The obvious risk is a disgruntled former employee attempting to access the network with malicious intent. Less obvious is the risk of furloughed (or even active) workers taking firm data off the network. We recommend looking at data loss prevention tools including iManage Threat Manager.
Social Media Security
The last risk we’ll discuss for this post is one you likely see every day but don’t think much of. With most of the world working remotely, hackers and other bad actors have significantly increased their efforts. Malware and phishing attempts are up, as are social engineering attacks. Facebook users are scrolling through “quizzes” daily. These appear to be harmless attempts to get to know your online friends better. However, questions like “What was your high school mascot?” and “Where did you meet your spouse?” are attempts to collect your answers to common security questions and password hints. There has never been a better time for a security awareness training refresher – contact us to learn how we can help.
In next week’s post, we’ll discuss unexpected challenges that emerged over the past few weeks. If you have any questions or comments, please feel free to email me at [email protected] or visit our website at www.cornerstone.it.
Stay safe.