Que faites-vous si vous souhaitez améliorer la sécurité de l’information tout en travaillant à distance ?

In my extensive experience, a secure remote setup transcends basic tool usage; it demands a holistic approach. While VPNs and dedicated systems are crucial, consider the security of your home network. Start by changing default router settings and using WPA3 security for Wi-Fi. Educate all household members about basic cybersecurity practices to avoid inadvertent breaches. The often-overlooked aspect of physical security, such as locking devices when not in use, also plays a significant role. Remember, security is only as strong as the weakest link.

When it comes to beefing up infosec in remote work scenarios, don't forget about VPNs. They're like your secure tunnel through the wild west of the internet and they're your first line of defense. . Keep your software updated - patches are your armor. And hey, train your team well -

A few basic things: • VPNs are a thing of the past. SASE is the solution for the modern world. • MFA challenges should be daily. Yes, it's a pain. Yes, it is needed. • Physical keys (Yubikey) are a good addition. • Robust ERD/XRD on all endpoints. • Train your staff. No really, no matter how many tools you have, if your employees are careless, none of the tools will matter.

It's also important to be mindful of physical security. Ensure your workspace is private and not easily accessible or viewable by others. Lock your computer when not in use. Be cautious about using public Wi-Fi networks; if you must, always connect through a VPN.

Ensuring that a remote employee's connectivity and device is secure are the first steps to ensuring the organization's security when it comes to remote access. We need to ensure that access is only allowed through trusted devices, with encryption and highly complex keys and using all ZTNA concepts, ensuring compliance of devices that connect to the network.

Strong passwords are essential for online Security. They make it much harder for hackers to guess or crack your password, protecting your accounts and personal information. Strong passwords are typically at least 12 characters long and combine upper and lowercase letters, numbers, and symbols. While they may seem complex, using a password manager can help you create and store unique strong passwords for all your accounts. also make sure not to reuse your passwords!

I van add that Implementing strong password policies and providing employee education is crucial for maintaining a secure remote work environment. Establish minimum requirements for password complexity and length, and enforce regular password changes. Educate your team about the importance of strong passwords and the risks of password reuse. Encourage the use of password managers and provide resources to help employees create and manage secure passwords. Regularly remind staff about password best practices and update policies as needed to stay current with evolving security threats.

Highly complex credentials are and will always be essential resources for the security of any organization. We know that a remote employee has a lower level of restrictions on connectivity and places where they work, and that is why we must indicate and apply compensatory controls to guarantee the optimization and security of this access.

Having seen countless password policy failures, I recommend integrating password management into your broader security awareness training. It's vital to understand why complex passwords are necessary. Engage employees in regular training that demonstrates how easily common passwords can be cracked. Show them the mechanics of attacks like brute force to underscore the importance of password complexity and uniqueness. This practical insight motivates adherence to best practices more effectively than policy alone.

"Strong Passwords," -- I would argue you should avoid using passwords at all and migrate to using passphrases (26+ characters). That said, your passphrase should be applied as "something you know" i.e., part of your MFA solution. Ultimately, passwords/passphrases for remote connections are fairly antiquated, thus I encourage limiting there use to locally/physically controlled devices, and implement MFA / SSO solutions for remote connections.

Although highly complex credentials are key points to guarantee the security of connectivity, we must apply the concepts of multiple authentication factors. Through them, we can guarantee the authenticity of a connection call, mitigating various types of failures that may occur, as seen daily in information leaks from various sources that we often consider to be reliable and safe.

From my viewpoint, MFA should be non-negotiable. However, the real challenge lies in its implementation. User resistance often stems from inconvenience. To combat this, select MFA methods that balance security with ease of use. For instance, push notifications to a smartphone tend to be more user-friendly than entering codes from an authenticator app. Moreover, consider contextual MFA, which adjusts authentication requirements based on risk—reducing the need for MFA steps when the user's risk level is low.

If you do not have MFA/2FA implemented, you will get hacked, no matter how secure your password/passphrases are. ¯\_(ツ)_/¯ Where do you keep those backup tokens? Hopefully, not on a post-it note in your laptop bag, or your wallet, or anywhere easy to find! A good tip here is to use a second password manager just for MFA backup tokens. Unless you know how to use PGP, that is the safest way.

Consider the following points when you decide to implement MFA solution: ##Choose a reliable MFA solution that supports various authentication methods, such as SMS, authenticator apps, and hardware tokens. ##Prioritize protecting critical accounts and systems, such as email, VPN, and sensitive databases. ##Provide clear instructions and support to help employees set up and use MFA effectively. ##Establish policies that mandate the use of MFA for all remote workers and regularly review and update these policies. ##Monitor and analyze MFA usage to identify and address any issues or suspicious activities promptly.

Encrypting data is a crucial security measure to enhance information security while working remotely. Encryption scrambles data into an unreadable format, rendering it useless to anyone who doesn't possess the decryption key. Encrypt sensitive work files, emails, and even entire drives to ensure they remain confidential even if your device is compromised. while all data must be transferred encrypted, we need to assure all sensitive/confidential data are encrypted at rest as well. Also make sure you are using the Secure protocols for encryption.

Encryption is a cornerstone of data protection, yet its deployment must be both strategic and transparent. Educate users on how encryption impacts their workflow and ensure they can perform their roles without hindrance. For instance, implementing encryption at rest and in transit for all sensitive data should be a priority, but this must be done with tools that do not overly complicate or slow down day-to-day operations. Additionally, implement access controls to ensure that only authorized individuals can decrypt data.

Both encryption at rest and in transit are not a security feature: they are the bare minimum you should be asking for. Without it, your data is as good as stolen. Encryption of data itself is a complex issue, but the one thing must be clear: who owns the keys? If it's not you, your data is not secure.

Consider the following when you choose and work with encryption: 1. Encryption strength: Use strong encryption algorithms like AES (Advanced Encryption Standard) with at least 256-bit keys. 2. Full-disk encryption: Encrypt your entire hard drive to protect all your data, even if your device is lost or stolen. 3. File-level encryption: Encrypt individual files or folders for more targeted protection and easier sharing. 4. Cloud encryption: Ensure your cloud storage provider offers robust encryption for data both in transit and at rest. 5. Secure key management: Use strong passwords or passphrases for your encryption keys and store them securely.

Data-level encryption is a complement to network connectivity-level encryption. We must always ensure that our data is secure. When an employee works remotely, their device is susceptible to unauthorized access, theft, among other means, due to reduced physical access controls. Therefore, ensuring the complexity of unauthorized access is essential, and encryption is a key point in ensuring this security.

Regular backups are essential. They involve creating copies of your critical data and storing them securely on a separate device or cloud storage service. This acts as a safety net in case your primary device suffers any failure, malfunction, or even a cyberattack like ransomware. By having a recent backup, you can minimize downtime and frustration by restoring your data and getting back to normal operations quickly. The frequency of backups depends on your needs, with some opting for daily backups for constantly changing data and others for weekly or monthly for more static information. Regardless of the schedule, regular backups ensure peace of mind and minimize the risk of permanent data loss. Make sure to test your backups regularly!

I believe that, in addition to performing regular backups of all essential and critical files, we must also validate that the backups performed are functional. In many cases, security and infrastructure teams validate the operation of backups through platform visibility, and this is not always the best way. For many reasons a backup may be unavailable or corrupted, and we cannot allow this view to only be generated in a time of crisis, as this could lead to an extremely high disaster.

Ensure that data is backed up regularly to secure locations. This helps to mitigate the impact of data loss or corruption due to malware attacks, hardware failures, or other incidents.

One of the most forgotten issues with backups is that no one ever checks that they are working and that you can restore from them. So, schedule a data recovery exercise now. Then, repeat is every 3 months. You can thank me later.

Some useful additions to data backups: 1. Keep at least one copy offsite in a secure location. 2. Set up automated backups. Manual backups aren't operationally effective. 3. Test your backups regularly: Periodically restore data from your backups to ensure they are functioning correctly and your data is recoverable. 4. Protect your backups: Encrypt your backup data and store it in a secure location to prevent unauthorized access. 5. Consider cloud backups: Cloud storage services can provide an additional layer of protection and make it easier to access your backups remotely.

My 2 cents : Secure your home Wi-Fi: Change your router's default password and SSID name. Regularly update your router's firmware. Use Privacy Screens: They prevent "shoulder surfing" in public places. Limit Personal Device Use: If possible, use a separate device for work. If not, limit personal use on your work device. Regularly Update Software: Keep all your software and systems updated. Updates often include security patches.

Its important to make sure you're employing the security basics: reasonably hardening assets, good operational resources, and education for staff to overly simplify the requirements. One of the big opportunities here is to evaluate if these steps are being taken in the rest of your organization and if they aren't, then why. This is a massive value add for any remote work change your org makes, and can be a huge selling point for security initiatives your organization has been struggling with getting the political will to move on internally. People who are giving me specifics: VPNs are a way to reasonably hardening network access and encrypting hard drives are reasonably hardening local machines for most critical data access, yes.

Beyond technical measures, consider the psychological aspects of cybersecurity. A significant part of securing assets remotely involves understanding and influencing human behavior. Establishing a robust cybersecurity culture requires not only educating employees about the risks but also engaging them in a way that makes security considerations a natural part of their workflow. Regularly discuss the "why" behind policies to foster a proactive security posture. This approach ensures that security becomes a common thread in every aspect of your organization's operations.

Use Secure Connections: Ensure that all remote connections are secured through Virtual Private Networks (VPNs) or other secure connection tools that encrypt data transmissions. This makes it more difficult for unauthorized individuals to intercept data being transferred between remote workers and the company’s systems.