For business owners who have decided to make their organization mobile and let people work remotely from home or on the road, security is an issue that must not be forgotten. Unless they think carefully about protecting data, they could land themselves in a whole heap of trouble.
Security increasingly is becoming a difficult problem for small businesses in Canada, many of which do not realize how quickly attacks are mounting. Years ago, the main security threat was from mischievous virus writers that wanted to wipe your hard drive or make your computer do odd things for fun. These days, attackers are much more focused on harvesting the data on your hard drive, hopefully without you noticing.
“That information is the holy grail for attackers, because they can profit from it,” says Michael Murphy, vice-president and general manager for Symantec Canada. “The landscape has changed. The computer is not the target. The attacks are exploiting vulnerabilities and lack of awareness, through methods including good old-fashioned social engineering.”
Social engineering attacks exploit a lack of user education to pilfer data. In the United States, for example, phishers – criminals who lure victims to fake websites using spoofed emails – pretended to be from the Internal Revenue Service, asking for peoples’ financial credentials. More recently, scammers have been sending emails from Facebook asking victims to install software to confirm a password change. The software then logs passwords entered for websites and remotely relays it back to the criminals.
For mobile workers, one of the biggest problems is that their information is spread across multiple physical boundaries. Some of it may reside at home. Other data might be on a mobile device or laptop on the road, while the rest is back at the office, but needs to be accessed remotely.
Trying to secure all this information in multiple places rather than keeping it all under lock and key at the office is a concept known as deperimeterization, and it is harder than it looks. For example, many small businesspeople who take their laptops on the road fail to encrypt the data stored on them. The inevitable sinking feeling when they realize they have left their laptop in the back of a cab is then followed by anguish when they realize the customer records on the hard drive will be accessible by anyone with a modicum of technical knowledge. If you think your Windows password is enough to protect your data, forget it. Unless the actual data on a hard drive is encrypted, it simply prevents system logons. Instead, invest in a full disc encryption product that protects data from criminals who could otherwise scan the hard drive using readily available tools.
However, this still leaves the problem of accessing remote data securely across public networks when out of the office. Many security professionals will recommend a simple virtual private network, which encrypts data in transit. Brian Bourne, founder of the Toronto-based security conference SecTor, issues a cautionary note.
“One problem with VPNs is that users simply copy information on to their desktop to work on it,” he says. That may not be a problem if the local hard drive is encrypted, but could be a security risk otherwise. Or, they could use the VPN to try and email sensitive data to themselves using a personal webmail account, which is even worse.
Instead, Mr. Bourne recommends using a remote access service (such as the type covered in the previous article, or Microsoft’s Remote Desktop Services), that gives users access to a representation of their desktop, and that can be configured not to allow, say, the copying of information to a local desktop.
Maintaining up-to-date antivirus software also is crucial, as is regularly applying security patches to your mobile and office-based systems. Ensure passwords are strong (combinations of letters, numbers and symbols are best, and store them in encrypted password management software on mobile computers). Identify where your most valuable data lies, and concentrate on protecting it – and, above all, backup that data to an encrypted store.
In a world full of online threats, complete security is never guaranteed – but you can at least make your company secure enough that online criminals will go elsewhere.
Source:http://www.financialpost.com/small-business/business-solutions/story.html?id=2749124
