Privacy

Secure a Telework PC

• Teleworkers who use their own desktop or laptop PCs for telework should secure their operating systems and primary applications.
• Use a combination of security software, such as antivirus and antispyware software, personal firewalls, spam and Web content filtering, and popup blocking, to stop most attacks, particularly malware.
• Restrict who can use the PC by having a separate standard user account for each person, assigning a password to each user account, using the standard user accounts for daily use, and protecting user sessions from unauthorized physical access.
• Ensure that updates and patches are regularly applied to the operating system and primary applications, such as Web browsers, email clients, instant messaging clients, and security software.
• Disable unneeded networking features on the PC and configure wireless networking securely.
• Configure primary applications to filter content and stop other activity that is likely to be malicious.
• Install and use only known and trusted software.
• Configure remote access software based on the organization’s requirements and recommendations; and
• Maintain the PC’s security on an ongoing basis, such as changing passwords regularly and checking the status of security software periodically.

Secure consumer devices used for teleworking, such as cell phones, PDAs, and video game systems
A wide variety of consumer devices exists, and security features available for these devices also vary widely. Some devices offer only a few basic features, whereas others offer sophisticated features similar to those offered by PCs. This does not necessarily imply that more security features are better; in fact, many devices offer more security features because the capabilities they provide (e.g., wireless networking, instant messaging) make them more susceptible to attack than devices without these capabilities. General recommendations for securing telework devices are as follows:

• Limit access to the device, such as setting a personal identification number (PIN) or password and automatically locking a device after an idle period.
• Disable networking capabilities, such as Bluetooth, except when they are needed.
• Use additional security software, such as antivirus software and personal firewalls, if appropriate.
• Ensure that security updates, if available, are acquired and installed at least monthly, or more frequently; and
• Configure applications to support security (e.g., blocking activity that is likely to be malicious).

Secure Information

• Use physical security controls for telework devices and removable media. For example, an organization might require that laptops be physically secured using cable locks when used in hotels, conferences, and other locations where third parties could easily gain physical access to the devices.
• Organizations may also have physical security requirements for papers and other non-computer media that contain sensitive information and are taken outside the organization’s facilities.
• Encrypt files stored on telework devices and removable media such as CDs and flash drives. This prevents attackers from readily gaining access to information in the files. Many options exist for protecting files, including encrypting individual files or folders, volumes, and hard drives. Generally, using an encryption method to protect files also requires the use of an authentication mechanism (e.g., password) to decrypt the files when needed.
• Ensure that information stored on telework devices is backed up. If something adverse happens to a device, such as a hardware, software, or power failure or a natural disaster, the information on the device will be lost unless it has been backed up to another device or removable media. Some organizations permit teleworkers to back up their local files to a centralized system (e.g., through VPN remote access), whereas other organizations recommend that their teleworkers perform local backups (e.g., burning CDs, copying files onto removable media). Teleworkers should perform backups, following their organizations’ guidelines, and verify that the backups are valid and complete. It is important that backups on removable media be secured at least as well as the device that they backed up. For example, if a computer is stored in a locked room, then the media also should be in a secured location; if a computer stores its data encrypted, then the backups of that data should also be encrypted.
• Ensure that information is destroyed when it is no longer needed. For example, the organization’s files should be removed from a computer scheduled to be retired or from a third-party computer that is temporarily used for remote access. Some remote access methods perform basic information cleanup, such as clearing Web browser caches that might inadvertently hold sensitive information, but more extensive cleanup typically requires using a special utility, such as a disk-scrubbing program specifically designed to remove all traces of information from a device. Another example of information destruction is shredding telework papers containing sensitive information once the papers are no longer needed.
• Erase information from missing cell phones and PDAs. If a cell phone or PDA is lost or stolen, occasionally its contents can be erased remotely. This prevents an attacker from obtaining any information from the device. The availability of this service depends on the capabilities of the product and the company providing network services for the product.
• Adequately protect remote access-specific authenticators
• Teleworkers need to ensure that they adequately protect their remote access-specific authenticators, such as passwords, personal identification numbers (PINs), and hardware tokens. Such authenticators should not be stored with the teleworking computer, nor should multiple authenticators be stored with each other (e.g., a password or PIN should not be written on the back of a hardware token).

Social Engineering

• Teleworkers should be aware of how to handle threats involving social engineering, which is a general term for attackers trying to trick people into revealing sensitive information or performing certain actions, such as downloading and executing files that appear to be benign but are actually malicious. For example, an attacker might approach a teleworker in a coffee shop and ask to use the computer for a minute or offer to help the teleworker with using the computer.
• Teleworkers should be wary of any requests they receive that could lead to a security breach or to the theft of a telework device.

Handling a Security Breach

• If a teleworker suspects that a security breach (including loss or theft of materials) has occurred involving a telework device, remote access communications, removable media, or other telework components, the teleworker should immediately follow the organization’s policy and procedures for reporting the possible breach. This is particularly important if any of the affected telework components contain sensitive information such as EPHI so that the potential impact of a security breach is minimized.