Hybrid working: six steps to managing cybersecurity and data privacy risks

Hybrid work­ing is set to become stan­dard prac­tice for most organ­i­sa­tions as we slow­ly begin to emerge from the coro­n­avirus pan­dem­ic. Accord­ing to a May 2021 McK­in­sey sur­vey, 90% of organ­i­sa­tions intend to shift to a hybrid-work­ing mod­el, a com­bi­na­tion of onsite and remote work­ing.

Whether your staff are work­ing in the office, at home, in shared work­ing spaces, or any­where else, you face numer­ous addi­tion­al risks to the con­fi­den­tial­i­ty, integri­ty and avail­abil­i­ty of your cor­po­rate infor­ma­tion.

Many organ­i­sa­tions that quick­ly moved to a remote-work­ing mod­el in ear­ly 2020 found there was sim­ply not enough time to car­ry out suit­able risk assess­ments before mak­ing such sweep­ing changes to their work­ing prac­tices.

The focus was on ensur­ing their ser­vices were able to con­tin­ue, rather than con­sid­er­ing the risks asso­ci­at­ed with the change. In par­tic­u­lar, those that had lit­tle or no exist­ing infra­struc­ture to sup­port home work­ing found the sit­u­a­tion chal­leng­ing as they were exposed to cyber­se­cu­ri­ty risks they were unpre­pared for and often didn’t even under­stand.

Cyber­crim­i­nals inevitably took advan­tage, launch­ing phish­ing cam­paigns exploit­ing fear and uncer­tain­ty about the pan­dem­ic, and tar­get­ing vul­ner­a­bil­i­ties in pop­u­lar soft­ware.
Per­haps most dis­rup­tive­ly of all, there was a huge increase in ran­somware attacks. Accord­ing to SonicWall’s 2021 Cyber Threat Report, there was a 65% year-on-year increase glob­al­ly.

Imple­ment­ing suit­able tech­ni­cal and organ­i­sa­tion­al secu­ri­ty mea­sures is espe­cial­ly impor­tant when it comes to main­tain­ing your com­pli­ance with data pro­tec­tion law. If you breach the UK Data Pro­tec­tion Act 2018 or the Euro­pean Union Gen­er­al Data Pro­tec­tion Reg­u­la­tion, you could face fines of up to £17.5m (€20m) or 4% of your annu­al glob­al turnover, whichev­er is greater.

UK reg­u­la­tors such as the Infor­ma­tion Commissioner’s Office made allowances for the pres­sure the pan­dem­ic put organ­i­sa­tions under. Now that restric­tions are being lift­ed, how­ev­er, they will be less lenient, so it is essen­tial to act with­out delay if you are mak­ing hybrid work­ing per­ma­nent.

“The pan­dem­ic has shown organ­i­sa­tions they can oper­ate with staff work­ing from home,” says Alan Calder, founder and exec­u­tive chair­man of IT Gov­er­nance, a lead­ing glob­al provider of IT gov­er­nance, risk man­age­ment and com­pli­ance solu­tions. “Indeed, there are many ben­e­fits. Staff are more pro­duc­tive, over­heads are reduced, it’s eas­i­er to recruit from a wider tal­ent pool and there is less impact on the envi­ron­ment.

“How­ev­er, remote work­ing is not with­out its chal­lenges – one of the biggest is infor­ma­tion secu­ri­ty.”

So how can an organ­i­sa­tion suc­cess­ful­ly imple­ment a hybrid work­ing mod­el? Here is a six-step guide:

Step 1 — Assess your cur­rent organ­i­sa­tion­al state to pin­point any gaps and give you a start­ing point on what needs to be com­plet­ed.

Step 2 — Pre­pare to put your new poli­cies in place, which will pro­vide a roadmap for day-to-day oper­a­tions and ensure com­pli­ance with laws and reg­u­la­tions, give guid­ance for deci­sion-mak­ing and stream­line inter­nal process­es.

Step 3 - Train your staff, as they can often be your weak­est link in the secu­ri­ty chain, and imple­ment an ongo­ing train­ing pro­gramme to ensure they are aware of the emerg­ing risks of work­ing remote­ly.

Step 4 - Put cyber basics in place to stop the most com­mon forms of cyber attack.

Step 5 — Imple­ment pri­va­cy basics to ensure your organ­i­sa­tion con­tin­ues to be com­pli­ant with inter­na­tion­al reg­u­la­tions.

Step 6 — Think ahead and imple­ment an ongo­ing, long-term secu­ri­ty strat­e­gy so your organ­i­sa­tion remains secure and com­pli­ant, even with the ris­ing lev­el of cyber attacks and data breach­es.

If your organ­i­sa­tion is yet to con­sid­er ful­ly the secu­ri­ty prac­ti­cal­i­ties of mix­ing onsite and remote work­ing, IT Gov­er­nance can pro­vide you with all the sup­port you need, every step of the way, with its cost-effec­tive cyber­se­cu­ri­ty-as-a-ser­vice and pri­va­cy-as-a-ser­vice solu­tions.

IT Governance’s cyber­se­cu­ri­ty con­sul­tants, legal experts and inci­dent respon­ders will become an exten­sion of your organisation’s in-house IT depart­ment. They are your pre-pack­aged and com­pre­hen­sive cyber­se­cu­ri­ty and pri­va­cy teams who come with­out the price tag and work 24/7 to make sure you are, and con­tin­ue to remain, cyber­se­cure and com­pli­ant – in the office, at home, wher­ev­er in the world you work.

Please con­tact us at www.itgovernance.co.uk/hybrid-working-solutions

Spon­sored by

IT Gov­er­nance