5 Ways to Secure Your Remote Workforce

### Overview Presented by independent information security consultant Kevin Beaver of Principle Logic, this talk addresses the sudden transition to remote work spurred by the COVID-19 / SARS-CoV-2 pandemic. Beaver emphasizes that the crisis expands the organizational attack surface and tests IT and security teams. The presentation outlines five immediate, practical recommendations to secure a newly distributed workforce, reduce business risks, and manage security incidents effectively.

### Key Topics Beaver structures the discussion around five primary areas: 1. **Acknowledging Threats**: Identifying both traditional and emerging social engineering and operational threats facing remote staff. 2. **Setting Security Standards**: Defining specific technical baselines before attempting to formalize and enforce policies. 3. **Prioritizing Immediate Attention & Continuous Testing**: Evaluating current controls, defensibility, and maintaining ongoing vulnerability assessments. 4. **Updating Documentation**: Refreshing incident response plans, business continuity plans, and acceptable use policies to eliminate mismatched expectations. 5. **Empathetic Communication and User Training**: Communicating with employees without excessive technical jargon, framing security around enabling work, and viewing users as core members of the security team.

### Technical Details - **Threat Vectors**: Attack vectors include traditional phishing, conversation hijacking (email account takeover mimicking victim communication styles), smishing (SMS phishing), vishing (voice phishing), and deep fake audio mimicking executive management or business partners (noting the Jamie Dupree 2.0 example). Organizations also face identity fraud involving RFPs, invoices, and business documents stemming from unconfigured or misconfigured SPF records and DMARC configurations, as well as ransomware and DDoS attacks against hospitals and government agencies. - **Meeting Security (Zoom-bombing)**: To prevent unauthorized party crashing on platforms like Zoom, configurations should include generating random meeting IDs instead of personal meeting IDs for public events, requiring authentication or multi-factor authentication (MFA), enabling encrypted chat, disabling participant screen sharing, and turning off video annotation. - **Technical Standards**: Baseline standards must address user authentication and passwords, workstation/mobile patching, data backups, cloud file sharing, separating corporate and personal email accounts, VPN/remote connectivity, secure computer acquisition and disposal (including secure drive wiping), and remote monitoring/alerting (leveraging tools like DLP, CASB, or managed services). - **Testing and Verification**: Organizations must continue IT controls audits, vulnerability scans, and penetration tests (such as demonstrating exploit impacts with tools like Metasploit to educate staff) to find new misconfigurations and avoid leaving low-hanging fruit. - **Resources**: Beaver highlights external work-from-home education resources, including Lucy Security's workfromhome.education and SANS work-from-home deployment kits.

### Takeaways - **Standards Before Policy**: Policies are ineffective without clear technical standards rooted in formal risk assessments, as unbacked documents only provide a false sense of security. - **Align Expectations**: Many security breaches result from mismatched expectations where remote workers make isolated decisions without guidance. - **Enable Work**: IT and security teams must frame security messaging around the mindset of 'we enable work' rather than issuing restrictions with dense jargon. - **Focus on the Basics**: Common sense security fundamentals—patching, encryption, strong credentials, and backups—provide the highest return on investment because they remain the most frequently overlooked and exploited areas.