We offer some practical advice on securing your remote working set-up
Working from home during the COVID-19 lockdown may well be vital if your charity is to continue delivering its services to those in need. But there’s no doubt that your home computer, or a laptop borrowed from the office, is less secure than one running in your workplace under the watchful eye of dedicated IT staff.
There are plenty of steps you can take to beef up your computer cyber security. Here are ten tips to help you keep your computer – and your charity’s data – secure from cyber threats during the lockdown.
All internet routers ship with default usernames and passwords (often both "admin") that allow you to configure your internet settings such as whether a Wi-Fi password is required.
Cyber criminals know these defaults, making it much easier for them to hack into your home network and intercept your communications or even lock you out of your own broadband service.
To prevent this, use your web browser to log on to your router (often using the address 192.168.0.1 or 192.168.1.1), find the option to change the router password, and choose something difficult to guess.
Using an open Wi-Fi connection which requires no password means anyone can connect to your internet service, and all the data traveling between your router and your computer will be unencrypted. This is an open invitation for cyber criminals.
That’s why it is important to configure your Wi-Fi to use WPA or WPA2 encryption and to set a strong password with a minimum of 13 characters.
Cyber criminals often exploit known vulnerabilities in computer operating system to hack into the system before the operating system is updated to remove the vulnerability. By setting Windows to install updates automatically as soon as they are available you reduce the window of opportunity for these cyber criminals.
In Windows 10 you can configure auto-updating by following these instructions.
In addition to your computer’s operating system, it is also important to keep all the applications you use up-to-date to ensure that any bugs that are discovered are fixed promptly. This will prevent cyber criminals from exploiting them. A program updater such as Patch My PC can update many applications automatically.
Make sure that your computer is set to require a username and password to log on to your account when it is turned on or after it is idle for a few minutes. Although this is normal for office computers, your home computer may not be set up like this.
To configure a Windows 10 computer to require a username and password at login follow these instructions.
If a thief steals your computer they could remove the disk drive and attempt to steal data from it by connecting it to another computer. The easiest way to prevent this is to encrypt the data on the drive so that it is inaccessible without a password.
Some versions of Windows include Microsoft’s BitLocker encryption program which you should activate if you have not already done so. If you do not have BitLocker you can also use the free VeraCrypt encryption application to secure your hard drive. VeraCrypt works with Windows, MacOS, and Linux operating systems.
Endpoint security software protects your computer against viruses, ransomware, and other malware, and can also detect emails or pages containing malicious links or phishing content.
It is a good idea to run a full anti-malware scan before you start working from home for the first time to minimise the chances that your computer is already infected with malware.
It is important to use a different password for every service that you log on to over the internet. It is also essential that all your passwords are a long series of random upper and lower case characters, digits, and special characters such as $ or &.
In practice these passwords are impossible to remember, but you can use a password manager program to remember them for you. A good password manager like LastPass or Dashlane requires you to enter a single long master password (which you have to remember). It will then enter your passwords automatically.
An additional benefit of password managers is that they are not fooled by phishing sites, offering you an additional level of security.
If you do not back up your data then there is a risk that important information could be lost. Backups are often performed automatically in an office environment, but this may not be the case when working from home.
You can back up data to the cloud automatically using apps like Backup and Sync from Google or MSP360, or you can perform backups manually to an encrypted USB drive such as Kingston Technology’s IronKey, which requires a password before data can be accessed.
Finally, don’t forget physical security, which involves taking steps to prevent your computer from being stolen. A simple measure is to ensure that your computer is not visible from a window at street level.
Laptops can also be physically locked to a desk or anchor point using the Kensington security slot found in many laptops.