Most enterprises that work from home were “rushed decisions” Gamania CloudForce proposes 4 major hidden concerns
The COVID-19 epidemic came extremely quickly, and forced many enterprises to let their employees work from home within a very short time;
The general manager of Gamania CloudForce Paul Ding indicated that during this period when employees are allowed to work from home seems to be able to quickly solve the business problems of enterprises, but most of them were rushed decisions; and of course there are 4 major hidden concerns from this decision.
Weak cloud collaboration verification mechanism
Most enterprises currently adopted cloud collaboration software so that their teams can work on projects together, and to perform content control; but in terms of permission control for this type of cloud collaboration software,
it is possible to be attacked by hackers because of human error. Hackers could also acquire control easily because the verification mechanisms of the cloud collaboration software were too weak, and this could lead to leaking of company data.
Insecure network access
Paul Ding stated that the equipment used by most corporate employees who work from home are their personal computers at home or their personal mobile phones; but these personal devices are not very secure and could have previously been intruded by hackers already.
If this already happened and the employee used their personal equipment to remotely connect to the company network, there will be information security concerns.
Where information is saved is also a problem
Besides what was mentioned above, some companies did not allocate computers for their employees to use, so employees can only use their personal equipment when working from home;
Some employees might download company data directly to external hard drives or flash drives to save the files. Even if these types of products have encryption mechanisms, it is still possible for them to have hidden backdoors and loopholes. If hackers cracked the encryption mechanism of the hard drive, it is still possible for information leakage to occur.
Phishing Email
Recently, many interested parties have been benefiting from this epidemic; many hackers might also use phishing Emails and pretend that they were Emails sent by company directors. If employees accidentally clicked into them, backdoor programs might be implanted into their devices to steal company secrets.
This is why Paul Ding suggests to enterprises that even though the epidemic came extremely quickly and forced enterprises to look for tools required within a very short period of time; they should try to search for products while upholding 3 aspects.
Ensure service security: Tools developed by people more or less have loopholes; but when enterprises are searching for services, they should ask clearly whether the services have unified updating mechanisms, or under what circumstances must updates be done? Also, when enterprises are implementing software, they should first have vulnerability assessments done to improve the security for the confidentiality of company information.
Complete service encryption mechanism: These software providers all guarantee that the tools are encrypted, but the truth is encryption might have been done for only a certain segment and not complete encryption. Therefore, before implementation, enterprises should ask the manufacturers to provide complete encryption instructions in order to reduce implementation risks. Also, there must be more than one type of personnel verification; multi-factor authentications should be used to ensure safety.
Long-term thinking for service implementation: Many enterprises currently only think about how to solve short-term problems; but in fact, enterprises should remember that in the future, employees might be working from anywhere. What is involved here is not only the information security issue of a single product; internal and external collaboration mechanisms and security are all long-term challenges. It is recommended that the concept of implementing a digital office should be considered in the future to further improve the information security of the company.