Security Factsheet: Keeping Your Workplace Safe Online

For many of us the Internet is a staple in our day-to-day lives – especially at our jobs. But did you know that by simply connecting your device to WiFi or delaying computer and software updates can put you and your workplace at risk of a cyberattack?

Any time you go online you’re using a gateway to the Internet. At work, this is usually either a WiFi or ethernet connection. When you connect a device to that gateway, it has a path to all other devices using that same gateway. That’s why your mobile phone can sync with your smart watch. However, if gateways and devices are not secure, bad actors could also get access to your laptop and other devices using the same connection.

Don’t put yourself or your coworkers at risk!

If you work for a company or agency that has sensitive or private information stored on its devices (especially in government or related services), it is critical to make sure that only secure, trusted devices have access to that network.

Here are 8 easy ways to help keep you, your colleagues, and your workplace network safe online.

Example: A fish tank thermometer was used by hackers^[1] to steal a casino’s database!

Fix: Leave your smart devices at home. If you need them for work, either connect them to a guest network or one that doesn’t have access to the same devices where sensitive information is stored.

Example: Amazon Alexa employees may be listening to your conversations.^[2]

Fix: Leave personal assistant devices at home. If you need to bring a smart assistant to work, disable the listening mode or make sure your colleagues are aware and place it in a place where conversations are public like a lobby.

Example: Millions of passwords and corresponding usernames (email addresses) have already been hacked^[5] and can be used to unlock the owners’ accounts.

Fix: Use a password manager to create strong and unique passwords for your accounts. The system will save them for you and can auto input them when you log in to your accounts. To access the database of passwords, you only need to remember one master password that you create yourself. This way, you stay safe without having to keep a rolodex of passwords in your brain! Where possible, you should also use two-factor authentication^[6] (e.g. password plus a code from an app like Google Authenticator).

Example: Check out this guide^[7] on how to avoid phishing schemes from the Federal Communications Commission.

Fix: Turn off automatically loaded remote content. Only click on links (in messages, emails, or even social media) if you’re absolutely confident that the person that sent it actually sent it. If the URL looks suspicious, that’s a red flag. When in doubt, don’t click on the link. Use bookmarked URLs to log on to your bank, medical practices and other sensitive sites instead of links within an email.

Example: In 2014 Sony was hacked^[8] and all of its employees unencrypted private emails, passwords, and in some cases Social Security Numbers were publicly released.

Fix: Use services that promote their use of strong encryption, especially end-to-end encryption. When transferring or beginning your use of a new service or software, be sure to check if they automatically encrypt your data and messages, or if you can turn on that feature. If not, consider using another service.

Example: Every day there are reports of security vulnerabilities that need to be patched. Take Microsoft for example.^[9]

Fix: Set aside time for updates – they are important. Use the time to organize your desk or get some face time with colleagues.

Example: A 2018 ransomware attack^[10] in Atlanta, Georgia impacted City Hall and law enforcement departments for nearly five days. In 2019, three hospitals^[11] in Alabama had to turn away patients.

Fix: Regularly back up your files, preferably with both a cloud provider and an external physical storage device. Disconnect the backups from the computer and the network, and remember to check that your systems can recover from those backups. This is especially important for those working with irreplaceable, private, or time-sensitive information in places like government offices, medical professions, and critical infrastructure.