5 Things SMB IT Departments Should do to Survive the Impact of COVID-19

As Featured on TechRepublic.com:

Small companies face an extra set of challenges now that remote work is the norm for most employees due to the coronavirus outbreak. Most large corporations have the basic structure in place for telecommuting, but that is not always the case for small- and medium-sized businesses. These companies have to establish a technical infrastructure and keep employees connected all while bad actors are looking to take advantage of these transitions.

Be alert to security breaches

Paul Lipman, CEO of cybersecurity company BullGuard, said that small- and medium-sized businesses are more vulnerable than ever to security breaches.
"Many companies simply haven't had the time or resources to ensure an adequate security posture for their workforce through this abrupt transition," he said. "They are, by necessity, trading the expediency of continued business operations against inherently lower levels of protection." 

Bullguard recently surveyed more than 3,000 SMB owners on the topic of cybersecurity and found that many are not prepared for a security breach. 

In addition to doing a general security check, SMB leaders should remind employees of security best practices for end users, review and update disaster recovery plans, and establish strong lines of communication among all remote teams.

This advice from security and IT professionals will help SMB leaders strengthen their overall strategy and make sure the transition to telework is smooth and secure.

Securing the VPN

Aaron Zander, head of IT at HackerOne, predicts that in nine months there will be a wave of reports about security breaches during the COVID-19 outbreak because of negligent infrastructure. He recommends triple-checking all network configurations, ACLs, firewall rules, and other security measures.

"A VPN breach is about as bad as you can get, the ability for someone to travel internally from VPN infrastructure into sensitive data is extremely easy," he said. "Worst of all, with the sudden surge of user traffic, malicious behaviour will be difficult to detect, and, much like COVID-19, these hacks, will be lingering around considerably longer than our quarantine."

Heather Paunet, vice president of product management at Untangle, a provider of comprehensive network security for SMBs recommends considering how to best configure a VPN to balance the bandwidth required for the VPN server and the protection given to remote workers. A full tunnel VPN sends all internet traffic over the VPN so that remote workers have the same level of protection against malware and viruses that they do in the office. A split tunnel VPN protects only certain traffic.

"A split tunnel VPN will send only business internet traffic through the tunnel," Paunet said. "This means that less bandwidth is required, but not all network traffic will get the same level of protection."

Best practices for cyber hygiene

Lipman of BullGuard said that every SMB needs a clear security plan that is communicated to employees on a regular basis.\

"This should include standards for security software that should be run on every device on which work is being done, policies and procedures for keeping company data secure, escalation processes when issues arise, and an overall refresh on cybersecurity awareness and training," he said. 

With many people transitioning to remote work, it's the perfect time for a few reminders about security. Zander shared these tips:

• Disconnect from the corporate VPN when not in use 
• Make sure home routers are up to date, secure with strong passwords, and equipped with WPA2 security or higher 
• Encourage employees not to install new apps without approval from IT
• Don't share online meeting IDs and URLs on social media
• Watch for phishing scams that can be spread via text, email, or social media
• Don't use personal laptops for work-related activities

Zander said one of the biggest concerns is that employees will work from a coffee shop instead of their house. 

"It's best to encourage employees to really work from home, and if they need to go out, to leave the computer at home, locked," he said.

Lipman also said that companies with a bring your own device (BYOD) policy should warn remote employees about the risk of identity theft. 

"BYOD is increasingly favored by smaller organizations, making risk to personal accounts and identity a commensurately increased risk as a function of increased efforts by cybercriminals to take advantage of this rapid move to remote work," he said.

Establishing a business continuity plan

Mike McLaughlin, chief information officer and vice president of professional services at Technologent, said that SMBs must take time to develop a plan to sustain critical infrastructure during times of crisis. This could include disaster recovery as a service for companies that can't afford infrastructure redundancy.

McLaughlin said Technologent's customers are also looking for help to handle the increased demand on internal IT teams for emergency operations, including reporting and communication. He recommends using web-based service portals to support these business needs: 

• Exposure management to respond to suspected or confirmed cases of COVID-19 among employees
• Emergency outreach for communicating with the workforce to share updates and status reports
• Emergency response operations to provide a centralized system for requesting, managing, and tracking resources 

Develop strong lines of communication

Peter Jackson, CEO of software company Bluescape, said managers need to over communicate when a team goes completely remote to make up for the lack of in-person interactions. He also recommends making time for human-to-human conversations at the start of each meeting instead of jumping directly to work-related topics.

Jackson said managers should also think about work in terms of productivity instead of time because with an all-remote workforce work hours will start to look different.

"All that matters is getting the job done, not holding employees to a strict time regimen," he said.

"Also, don't forget team culture: Make the best out of these uncertain circumstances by scheduling virtual coffee breaks or remote happy hours within your team and within the whole organization."

Good communication is also important when providing IT support to remote workers. Zander of HackerOne said being patient and considerate is vital as well as asking questions about what an end user is seeing on a screen rather than making assumptions. Zander recommends a good company organization chart with up-to-date photos to make it easy to verify a user's identity before resetting passwords or multi-factor authentication (MFA).

By: Veronica Combs in SMBs 
on March 26, 2020, 4:00 AM PST