Working from Home: Privacy, Security, and Information Management Tips for a Remote Workforce
The COVID-19 pandemic and “shelter-in-place” orders have upended offices across the country, forcing businesses and workers to rapidly adapt to our new remote work reality. Although lockdown restrictions are gradually easing, remote work is likely to remain a common feature of office life for the foreseeable future. But while working from home brings a new set of challenges and risks for employers and workers, it also presents an opportunity to reflect on how we work and find new ways to improve. Employers can help their workers stay productive at home without intruding into their private lives. Employees can still keep vital company data secure even when working from beyond the safety of the office. Organizations can still practice effective information governance even when their records and information reside on employees’ workstations located across the country.
Learn about tips and insights on how businesses and employees can protect their privacy and security while maintaining effective organizational records and information management, both during the current era of the “socially distanced” workforce, and beyond.
Audio-described version
Transcript: Working From Home Privacy, Security, and Information Management Tips For A Remote Workforce
Duration: 0:47:17
Speakers: Frank Fazzio, CIPP-US, IGP, CRM, Analyst and licensed attorney, Zasio Consulting Division (Zasio Enterprises)
Lightly edited machine transcript. Slides are summarized where they carry information not spoken aloud.
Frank Fazzio: Hello, everybody. Thank you all for joining me for today's webinar. Today we're going to be talking about privacy, security and information management tips for today's COVID-19 remote workforce. My name is Frank Fazzio, and I'm an analyst and a licensed attorney with Zasio's Consulting Division. I've been working on designing and updating retention schedules and policies for the past five years.
If you're like about 70% of the world right now, you or somebody that you know is currently working from home as part of lockdown orders that have been issued across the country. Depending on where you live, working from home might be mandatory, or it might just be strongly recommended. For some businesses, working from home or telecommuting has already been a big part of normal, ordinary operations. But for most of us, this is a completely new experience, and for many of us, it's generally involving a rushed scramble to get systems and procedures in place that will get us all up and running smoothly. In some cases, it felt a little bit like a fire drill: everyone out of the office in an orderly fashion, grab the essentials that you need and go.
Consequently, we have people who are working from kitchen countertops and using tiny old laptops with grainy monitors to keep connected with their colleagues and their customers during this time. As the days and the months pass on, we're all generally getting settled in to our new work-from-home circumstances, and we get more comfortable and more at ease with working from home with every day that passes. However, while most of us are pretty hopeful that this will just be a short-lived state of affairs, we don't know for sure how long remote work is going to be a part of our lives moving forward. The lockdown orders that we see are starting to ease across the country and things are opening up, but it's tough to say for certain when exactly we're going to be completely getting back to normal. And it's certainly possible that lockdown orders might get extended, or even after they're taken away, get put back into place again at some point.
So while we watch and wait to see what's going to happen, in the meantime, we can make this state of affairs into an opportunity to change for the better and to improve our working processes, so that working from home is a smooth experience that doesn't pose organizational problems from the perspective of privacy, security and information management. And by mastering work from home this time around, we're inherently preparing ourselves for, God forbid, the next time that something like this might happen.
Let me just start us off by giving an inspirational quote for us all to digest. "Successfully working from home is a skill, just like programming, designing or writing. It takes time and commitment to develop that skill, and the traditional office culture doesn't give us any reason to do that." That's from Alex Turnbull, founder and CEO of Groove, the sales platform. So mastering working from home will take some study, and it will also take some effort, and that's why we're here today.
A work-from-home strategy should really be considered an important part of making sure that a business is successfully managed, not just an inconvenient interruption that we all have to endure and suffer through until it's over. Having good strategy and the processes in place for remote work can make the difference between having this experience be smooth or having it be an ongoing major disruption to your business.
The first thing that I want to talk to you all about is privacy. Working from home means that we're bringing our work files and our customers' personal data into our homes with us, which means that privacy concerns are also going to follow us into the home. Because we're at home, to get the data that we need, we're going to have to have employee and customer personal data channeled and routed across the internet through relay points and connections that we don't have control of. And this situation inherently presents a situation where employee and customer data is being put at heightened risk. So while we can't eliminate the risk completely, to respond to this, we have to adopt some privacy practices that are going to safeguard this data as much as is practical and will minimize the risk wherever we can do so.
So what are some privacy practices we can adopt to protect privacy while we're working as a remote workforce? As I said, your business is being channeled through the web, and we're doing our work on numerous different apps, some of which are new to us. If you think about it, every employee and that employee's home office is a new extension of corporate headquarters. So the first thing we can do is try to limit the amount of personal data that's being put at risk from this remote work situation. This is the principle of least privilege.
When it comes to privacy, less is actually more. The less that we can expose to risk, the better off we are. We achieve this by limiting permissions and limiting access to data. Employees should not access data beyond what they need for the customers that they're working on. For example, somebody on your sales team might need access to data on a variety of customer prospects and leads.
But conversely, somebody who works in HR doesn't need to look at any of that data. They only need data on employees. So IT admins should set out to determine what access to servers and data is necessary. Provide that much access, but no more. Once an account that has high-level access gets compromised, a hacker can move about freely through the company's systems, and most of the damage that gets done actually occurs once a high-level account gets accessed.
So you're going to want to audit the permissions that you currently have to see whether everyone's permissions exceed what's necessary. It sometimes can be helpful to just start from scratch and pull the rug out and start everyone from a low baseline level of permission, and then move upwards from there as needed. Another strategy you might use is role segmentation, where you have a roles-based scheme of permissions where different job functions get different levels of permission, and you have permission templates rather than setting each person up manually. So you might have a standard level of permissions that's good for sales, a standard level that's for HR, a standard level of permissions for accounting, etc. Another thing you can think about doing for permissions is to hand them out on a per-use basis. So if someone needs access to something for a particular project that they're working on, see to it that they're granted access, then withdraw the access once the need has passed.
So that's per-use permission. And these are always good practices, but they're even more important when that data is being sent into employee homes.
The next thing that we can have a look at is managing the data lifecycle. This is the other side of less is more. Having personal data of employees and customers bouncing over the internet is pretty much unavoidable. But the less we're sending over the internet and allowing to actually reside on employee computers, the better off we are. So to that end, we want to try to shorten the lifecycle on personal data as much as we possibly can.
And we can implement systems that will purge data from employee computers automatically. You want to take a look at where customer and employee data is being sent and how long it really needs to stay there once it gets sent, at a bare minimum. So the very best situation of all is if data does not reside on employee personal machines at all. Ideally, you store it on company servers and use a VPN to remote into the office workstation. I'm sure most of us are probably doing this, but for some of us who aren't, it really should be looked into, because VPN is a great strategy for limiting the amount of data that's being put at risk.
An ideal situation is to issue a device to every employee where you can control the data that resides on that device. Again, a lot of us are probably working on our own home computers, and not every office can afford to go out and buy a brand-new laptop for every single employee just for the COVID crisis. But that is an ideal situation. And the nice thing about that is, in the event that a device is lost, you can use a remote kill switch to wipe the data from the device, and that adds an extra layer of privacy protection. You don't want to allow employees to dispose of devices on their own. Make sure that employees will actually take the device back into the company at some point for secure data wiping and disposal of that device once it reaches the end of its useful life.
Another good practice is to keep abreast on privacy guidance from leading international privacy bodies. For instance, the Global Privacy Assembly maintains a data protection and COVID-19 resources library that has resources on unique and country-specific ways that COVID-19 is impacting privacy around the world, depending on the local privacy laws. There's also a lot of other leading privacy bodies that regularly publish updates on best practices. And so you would be well advised to check these sources regularly to look for any updates they post as conditions on the ground change in the weeks and months to come. These can be a great source of pertinent, timely information.
Now, I touched on VPN, which leads me to the next point that I want to make, which is to lean on technology to promote and to protect privacy. VPN is really a cornerstone of privacy, and really can't recommend it enough, because it controls the window into the office server environment, and it lets the enterprise data be cordoned off and hermetically sealed off from employee devices, which dramatically reduces the risk. It's always superior from a privacy perspective to have employees use VPN to access company files rather than letting that occur in their native desktop environment. And part of what makes VPN so powerful is that most VPN are using encryption. So encryption is baked into most every VPN, but you also want to make sure that encryption is a part of the communication systems that we're all using for messaging and video conferencing.
There's a couple of different kinds of encryption for communications. There's encryption at rest, encryption in transit. The gold standard is end-to-end encryption. So to the extent you can use a communication system that has end-to-end encryption, that's the best. It's also sometimes overlooked, but it's worthwhile to have encryption on the devices themselves. So if you have an iPhone or an Android, the cell phones come with encryption as a standard feature. But if we're talking about desktop computers and workstations, encryption doesn't come standard, and it has to be installed.
So you can have different software solutions that will encrypt individual folders, or better yet, use whole disk encryption that will encrypt the entire machine and all of its files. That gives you the best level of protection. Now, we're all using chat apps right now to collaborate with our co-workers and also to have video conferences. One thing you might not consider about these apps is that they can route data, sometimes through other countries. And in some cases, they'll be routing them through countries where the privacy laws are not quite as strong.
Previously, Zoom used to route free calls through servers located in China. But after some negative press, they have since stopped that practice. So that's a nice improvement from their end. But when we're talking about crucial apps and platforms that manage critical data or have really sensitive communications, check on how that app is channeling your data across the web, where its servers are located, because where that data is actually going might surprise you. So now that the home is a place where important business occurs, there's a lot more outlets for personal data to leak into the public.
You want to be careful about social media platforms and collaboration tools. Most of these have got a privacy panel. And to be honest, a lot of us have not looked at our privacy panel settings or read through the privacy disclosure documents in a long time. And so if anyone is using Facebook or any other social media platforms to do any work at all, which I wouldn't recommend, but if you do, you want to make sure to open up the privacy panel, change the settings and protect yourself as much as possible, and actually maybe read through those privacy disclosures. Another thing is Internet of Things devices. These are pretty much omnipresent in the homes now. We have smart lights, smart window blinds, smart coffee machines. They're really quite cool, and they make our lives a lot better.
But on the flip side, these do collect a lot of personal information on your daily activities, and each one is another vector into the home. So now that you're having work phone calls at home and discussing important information about clients and co-workers, it's more likely than ever that your smart home speakers and assistants like Alexa, Google and Siri are going to listen in and pick up on information that's important, and that information can end up on company servers like Google and Apple servers. So just to be extra careful, it's a good idea to put these assistant devices outside the room where you're doing your work, or most of them have a mute switch on the back where you can turn it to silent, so it doesn't listen when you're having a business meeting. You can also make these safer by putting them on a guest network rather than your main home network, so they don't occupy the same environment. That adds an extra layer of protection.
And lastly, when privacy is already being built into your systems as privacy by design, it prevents having to reinvent the wheel. It's always best to choose apps that prominently feature privacy in their literature and have privacy by design.
The next thing I want to talk about is security. You really can't protect privacy without having adequate security, and there's necessarily a lot of overlap between these two areas. They really go hand in hand, and you really can't talk about one without talking about the other. And there's just a lot of overlap between these two. So you want to make sure that you're putting enough time into both.
So with security, let's talk about some security practices.
First of all, you're going to want to protect against external threats. The pandemic situation means we've got stress and rapid change and everything is a scramble. And this presents a perfect opportunity for hackers and scammers. Really, COVID-19 is a scammer's paradise. Hackers and scammers are exploiting the circumstances to try to trick you and gain entry into systems and make a quick buck.
We're doing a lot more from our cell phones right now. A lot of people are making video calls from our cell phones and using our cell phones more than ever. And those cell phones do present a significant risk. For example, there's a new Cerberus Trojan going around for Android devices. And this one is able to scrape your email and SMS messages, and it's even able to gain full control of your cell phone. This is pretty scary stuff.
The most common scams are spear phishing scams, where the villain poses as someone trusted or legitimate. For example, a common one is to have an email that poses as an IT admin or as your boss that has a special instruction or request related to COVID-19. Often these look legitimate. So whenever you see a directive that looks extraordinary or out of place, you want to be very careful. The hackers and scammers are remarkably clever and sophisticated. If it looks fishy at all, it probably is.
So it's always a good idea to just send a message or make a phone call to the person who originated the message to verify the request before you take any action. It only takes an extra minute or two, but if that's all it takes to save you, then it's certainly time well spent. And lastly, this is obvious, but think twice before you click anything that you don't recognize.
Aside from external threats, you need to employ tech security as well. When we're working from home, the house is an extension of the office. And really, you should treat the home with the same level of security that you treat the corporate headquarters. The weak point in your armor is the internet connection. The internet connection is the entry point for intruders to gain access.
And what most people don't think about is many homes are using old, outdated modems and routers that are years old and are near the point of obsolescence. And many of these have lots of vulnerabilities. These are not the enterprise-grade routers that you use in your corporate server rooms. These old routers are a lot more dangerous. The smartest move would really be to buy everybody a brand-new router, but in most cases, that's not practical.
So if you want to use the existing routers and modems that people have in their homes, you want to start off by patching those to the latest firmware version. We talked a bit about how end-to-end encryption for communications apps and computer files and devices is very good. But actually, you need to use encryption on your router too. You can modify the settings of the router in the firmware graphical user interface and change the encryption level that your home network is using. The standards you want to look for are WPA2 or WPA3 protocols. These are the gold standard that will give your house the adequate level of protection that it needs.
As you know, you want to have a good password on your network. But what a lot of people overlook is putting a password on the router itself. Even though the Wi-Fi network might have the best password, a lot of routers have their own default password to gain access to that firmware GUI. And in a lot of cases, you'd be surprised, the routers are using "admin" as the default password. It's a little bit trickier to change your router password as opposed to your Wi-Fi password, but you want to make the effort to upgrade your router password in addition to your Wi-Fi password.
So if you can't issue every employee their own laptop and people have to work on their own devices, there's still things you can do to increase security. And one of the things that's an easy fix is providing enterprise-level antivirus and anti-malware to install on those home computers. The work computers that people are using are really a hodgepodge of personal devices, and they need the same level of security as office workstations. So enterprise-grade antivirus and anti-malware should be considered a must.
Setting aside technology, there's just some ordinary practices that are easy to undertake that can make things a lot safer. The home is really perilous for your computers and your data in some ways that the office really isn't, but you can adopt some practices and routines that will help to mitigate the danger. Unfortunately, a major risk that many people do overlook is our loved ones. We all love our kids, and we love our fur kids. But these little guys can accidentally destroy devices, and you can lose the data that those devices contain. So you want to keep those little guys out of your workspace as much as you can.
And a good way to actually enforce that is to have a separate workstation located in a separate part of the house. You can use a guest room, you can use the den, or if you have one, you can use the mother-in-law suite. Or if all else fails, you can even use an extra bathroom. Having a separate workstation that's in a different part of the house can really help you feel like you're in work mode once you sit down and get started, and it's psychologically better than working on the kitchen countertop or on the sofa, where you're full of distractions. A lot of people actually are setting up a collapsible workspace, where you can put it up when you're working and then take it down once you're finished with the day.
This adds an extra layer of safety, and it's also a way of mentally unplugging at the end of the day when you have a routine to put away your office. And also, your family will appreciate it if you put away your workstation at the end of the day. It can help to ease the burden of taking over an entire room of the house. So it helps make everybody happy. Now, most of us are staying home, and obviously everyone should ideally be staying home. It's hard to think of a situation where you're going to need to leave the home.
But if you absolutely must work in a public space because of the nature of your job, there's some things you should also do to deal with that situation, to protect yourself, your data and your privacy. The number one would be to avoid public Wi-Fi. These are really dangerous, and you can be practically certain that they're unprotected and they're going to pose a major risk. A better way to connect is using a cellular hotspot from your phone. The phone's hotspot is a lot safer, and a lot of cell phone carriers right now are doing promotions to offer unlimited data for the duration of the virus crisis.
So take advantage of those offerings and use your cell phone hotspot. Don't use public Wi-Fi. Now, the next one should be obvious, but it should still be said: watch out for lines of sight. Sit in a place where you have your back to the wall. You never really know who might be watching over your shoulder. You might even want to add one of those privacy screens to your laptop.
You should never, ever leave a device unattended, even just to momentarily use the restroom. Don't get up and go to the bathroom with your computer open. Just please don't. Okay. So moving on.
Now let's talk a little bit about information management. With the new remote work reality, the landscape of information management also needs to change and adapt. Information on employee computers is getting beamed over the internet, as we talked about, but that means that different processes are going to be needed to keep control over the records and information. It's intrinsically harder to control data when it's residing in hundreds of employee homes across the country instead of centrally at your company headquarters. How do we make sure that policies and procedures are actually going to be properly followed in every office, now that employee homes are acting as hundreds or thousands of new offices?
The fact of the matter is that employees are a lot more likely to copy information haphazardly, put things on their desktop and other folders, and just generally be lax in information management when they're working from home. It's kind of tough to eliminate this completely, but you can adopt some strategies that will help mitigate the information management chaos and get things better under control.
The first information management issue is the logistics that come from working from home and working with records remotely. Things are changing so that every home is an extension of the office, and so consequently you have a lot more offices. This means that the location and structure of records is likely going to change as well. The new remote work reality is also probably generating new records and new information that we weren't actually even creating before. So we're going to have new records. We're going to have records of Zoom meetings, virtual conferences, a lot more emails than before, probably, and maybe some other new records that haven't been considered until now.
It's likely as well that information is getting stored in new locations, like those employee computers or on new shared drives. So one thing you might consider doing right now would be conducting a data mapping exercise. This will help to give you an inventory of what data you have and where it's located. And it's a prudent step, particularly right now, to get a handle on how the crisis has changed the contours of data management and what other new records are being created that are in need of control, also where they're located. You really can't manage what you don't know you have. And this is why doing a data mapping exercise in response to COVID is a worthwhile investment of time right now.
Now, employees are usually accustomed to working with electronic records, and most of us are using electronic records, but in some businesses that are still using a lot of physical records and paper records, being able to access those physical paper records might be a serious issue. So you'll need a strategy for how to deal with employees that need to keep working with paper records and boxes where necessary. Some things to figure out about this: how is it going to work? Will these records get delivered to employees' homes and shipped in the mail, or will employees be allowed to come into the office to pick up a box and take it home with them? Will you have just a limited number of employees that'll put boxes in the lobby or wherever else they need to go to be picked up securely?
There's a lot of different ways to manage that. But for businesses that are reliant on physical records, you'll need a logistical system to make sure that keeps working.
Okay, the next information management issue is collaboration and cloud software. We talked about how you should ideally be using a VPN. Can't stress that enough, but this isn't always an option for everybody. So if your circumstances are such that you do need files to reside on employee devices, you want to exercise as much control as possible. Short of a VPN, a cloud folder is a good way to keep data synced and backed up. A cloud folder also lets you use an administrator and manage retention and disposition rules centrally and automatically, without having to rely on employees to actually do it.
So if you're going to be using employee computers and actually allow any business records to reside on those computers, you want to compartmentalize: set up those cloud share folders, centrally manage those folders, sync the data with company servers and then apply retention rules. This is also an opportunity to experiment a bit with new collaboration and file-sharing tech, and maybe also try some new pilot programs and initiatives. Some of these are going to be handy right now in a pinch, but some are going to improve your efficiency and business processes long after work from home ends. You might discover a completely new way of doing things that you hadn't considered before, and you might just keep doing it once COVID is over, in a way that will add value in the long term. So take a risk and give some things a chance.
Lastly, you have to keep in mind that convenience sometimes comes at the expense of control, and there's an inherent trade-off between the two of them. Collaboration platforms can make sharing documents and data very easy, but the documents will often go to places you didn't expect: third-party servers, other locations, SharePoint, OneDrive, for instance. And this means that now the data is located in additional places. Those additional places present a risk, and they require controls and management, which makes things a little bit more complicated. So you have to strike the right balance between the competing interests of convenience and governance to find a proportional solution.
And some records management policies are going to necessarily need to be updated during this time just to account for the work-from-home reality. In some cases, you can use a temporary policy that will expire after a certain period of time. But in other cases, you might want to make a permanent change that you'll use moving forward, even after this is over, so that you're covered for the future and you're future-proofed. Another thing might be putting a hold or a freeze on a particular policy, and assessing whether there's a long-term need or short-term need for that freeze. Retention periods actually might need to be shortened, as we discussed earlier, just to minimize the risk, particularly in the case of the volume of records that contain personal information that are being generated and now being kept by employees in less secure areas like their homes.
So the crisis is really an opportunity to revamp your enterprise records retention schedule and make adjustments to retention periods accordingly. A thorny issue is going to be destruction of records. You might be implementing destruction routinely with destruction days, or your company might have an automatic process that will automatically purge data once it reaches the end of its retention period. But working from home can throw a wrench in that. In some cases, it might be feasible to just delay the destruction until the COVID situation is over.
But if that's not practical, then it might be necessary to implement destruction at home. You might have to ask employees to delete files and shred papers. The best would be, as we discussed, using a cloud file sharing or ERMS software on employee computers that will actually implement the destruction automatically. And you want to think this through carefully, because, depending on the criticality of destroying records on time, you want to find a proportional solution that works for your business. And another policy that we're almost certainly going to need right now is a bring your own device policy. Most companies have some sort of bring your own device policy, but if you don't currently have one, you're going to need one. And even if you do already have one, it likely will need an update. So you want to update the bring your own device policy to cover issues that we talked about, like requiring encryption software to be installed, requiring antivirus and anti-malware of a certain kind be installed, and also asking employees to take some other precautions that we discussed earlier. So to the extent that your bring your own device policy doesn't already have those [inaudible] off, bake those into your bring your own device policy.
Another thing you can do from an information management perspective right now is training. Really, quarantine is an excellent opportunity for training, especially if you are going to be updating some of those information management policies. You can take this time to brush up on retention rules and how you're expecting employees to follow those rules. This includes everything: retention periods, retention procedures, disposition rules, and how and where to store the data. You're probably using new technologies and apps and software for collaboration, like we talked about. But these have a lot of hidden features. Some of them are really good, and they can be really useful, but to get the most mileage out of them, employees need to understand how they work, and that requires training. So you can get the most value added from these new apps and technology we're using if everyone takes the time to explore what they can really do. So look at the features and the uses.
If any of them have training materials, have a look at those, because there may be things you didn't realize you can do that will be very useful. And we talked about how important security is right now, with all the scammers and hackers out there trying to gain access to your systems. A security refresher course is a particularly good idea right now, including some of those critical security dos and don'ts that we covered earlier in the presentation. And really, there's never been a more easy or natural time to ask people to watch a tutorial video from the comfort of home. Perfect time.
So we find ourselves at a crossroads right now. We're facing a fork in the road. The future is a bit uncertain, and we're not exactly sure what's going to happen. Hopefully things will be getting back to normal in very short order, but we just have to prepare for the possibility that this could be going on for much longer than we think and hope. There's still maybe some curves and bends in the road, and we might even have a bumpy ride in store for us. So we just have to prepare for the worst, and we can't just assume that we're going to forget about remote work a couple of weeks from now. I think even after the COVID-19 pandemic recedes from us, hopefully in short order, even after it's done, remote work, telecommuting, these are going to remain an important business tool moving forward.
And as technology marches onward, you can really count on this becoming a growing feature of ordinary work life in the years ahead. In fact, the entire experience probably has changed the nature of business work and office life in ways that may not be fully clear to us right now. And it might only become clear in the months and years ahead what the full impact of this is going to be. So that's why it's worthwhile, if you put in the effort now and invest the time to master this skill for you and for your colleagues, to future-proof yourself against the current COVID crisis and for the next one that lies ahead. We do have a very bright future in store for us. So worth the time.
Okay, that brings me to the end of the presentation. Thank you all very much for your kind attention. I'm going to open the floor now for questions. If anyone has them, you can type them in the questions window. You can also feel free to send me comments or questions to my email. It's frank.fazzio@zasio.com.
And if you're interested in records management and information governance software or consulting services, make sure to reach out to our sales team. Our sales folks will be delighted to walk you through our product and service offerings and find something that works for what your business needs. We'll actually be sending out one other thing: we're sending out a survey via email once this is over. It should come within 30 minutes or so after we're finished, and we would appreciate your feedback and comments. So if you'd like to take the time to respond to the survey, we would be grateful. And that concludes my presentation. All right, thank you all very much for coming.
Right. And that'll do it for us. I don't see any questions posted at the moment, but if anyone has one, make sure to email it to me. I'll be happy to respond.