Crossword Cybersecurity Regulatory News (CCS)

Crossword Cybersecurity issues working from home guidance - helping companies migrate to becoming a distributed workforce, whilst staying secure

26 March 2020 - London, UK - Crossword Cybersecurity Plc (AIM:CCS, "Crossword", the "Company" or the "Group"), the technology commercialisation company focused on cyber security and risk, has today issued guidance for businesses on how to address some of the most common security concerns for employees when working from home. The advice is being made widely available as many of Crossword's clients mobilise to keep their businesses running as normally as possible whilst adhering to UK Government and Public Health advice designed to control the spread of the COVID-19 virus.

As IT professionals all know, working from home comes with a range of security risks, but employees need to be educated too - human behaviour is invariably the weakest link in a company's cybersecurity posture. In the current environment, with many more employees working at home, cybercriminals are actively looking for opportunities to launch phishing attacks and compromise the IT infrastructure of businesses, large and small.

Guidance on working from home

All companies should start by reviewing the home working guidance available at the UK Government's National Cyber Security Centre (NCSC). This resource helps companies prepare their employees and think about the best way to protect their systems. Crossword has been advising a number of its FTSE clients in a range of sectors, and below is a summary of the guidance given, in addition to that from the NCSC.

1. Run audio and video calls securely - What is visible in the background of your screen during video calls and is someone monitoring who is on the call? The same is true for audio only calls. A team member should be responsible for ensuring only invited guests are present, and calls should be locked once started, so other participants cannot join.

2. Educate employees on Phishing attacks - The NCSC mentions COVID-19 related Phishing attacks which use the current crisis to trick employees into clicking on fake links, downloading malware, and revealing passwords - so educate them. These could be fake HR notifications or corporate communications; fake tax credits; fake emails from mortgage providers; free meals and mechanisms for registering for them. The list is endless and cyber criminals are very news savvy and quick to adapt. Employees are likely to be more vulnerable to phishing attacks due to people rushing, fear, panic, and urgency; all the behavioural traits that result in successful phishing attacks.

3. Automate Virtual Personal Network configurations (VPNs) - IT and Security teams may have a backlog of users to set up on VPNs, to provide secure connections to corporate networks. Do not allow employees to send data insecurely, use automation to make accelerated deployments and guarantee correct configuration. Even IT staff are fallible, and the combination of pressure of work volume and working fast, may leave a gaping hole in your infrastructure.

4. Control the use of personal devices for corporate work - Due to the rapid increase in home workers, many employees may be using their own devices to access emails and data, which may not be covered by Bring Your Own Device (BYOD) policies. What this means in practicality, is that employee's personal devices may not be securely configured, nor managed properly and be more vulnerable. IT and Security teams again, may need to retrospectively ensure that employees are complying with BYOD policies, have appropriate endpoint security software installed etc.

5. Stop personal email and unauthorised cloud storage use - When companies are experiencing IT difficulties in setting up employees working from home, people may be tempted to use personal emails or their personal cloud to send and store data, as a work around. These are a risk and can be easy for cyber criminals to target to gain company information or distribute malware, as they are not protected by the corporate security infrastructure.

6. Keep collaboration tools up to date - Tools such as Microsoft Teams, Zoom and Google Hangouts are great, but it is important to ensure all call participants are using the latest versions of the software, and that includes partners and customers that may be on calls. Employees should also only use the corporate approved tools and versions as they will have been tested by security teams for vulnerabilities, that could be exploited by cybercriminals.

Stuart Jubb, Consulting Director at Crossword commented: "Throughout the UK, companies are doing everything they can to ensure business continues as normally as possible as the COVID-19 situation develops. The guidance we are issuing today is a summary of the key points we have been discussing with our clients across a wide range of vertical markets. Good IT security measures are arguably more important than ever as companies become a largely distributed workforce, almost overnight. As ever though, it is not just about the technology, but good behaviour and education amongst employees as cybercriminals work to exploit any vulnerability they can find, whether that be a person, mis-configured tech, or unpatched software."

About Crossword Cybersecurity plc

Crossword Cybersecurity plc focuses on the development and commercialisation of university research-based cyber security and risk management related software and cyber security consulting. The Group's specialist cyber security product development and software engineering teams work with its university partners to develop the research concept into a fully-fledged commercial product that it will then take to market. The Group's aim is to build up a portfolio of revenue generating, intellectual property based, cyber security products. Rizikon Assurance, Crossword's leading product, is a SaaS platform that enables medium to large companies to assess and manage all risks from their suppliers. Nixer CyberML, Crossword's most recently launched product, is a new tool for businesses that want to solve advanced security and cybercrime problems, such as detecting and dealing with compromised accounts, fraud, and in-application denial of service attacks. Crossword's team of expert cyber security consultants leverages years of experience in national security, defence and commercial cyber intelligence and operations to provide bespoke advice tailored to its clients' business needs.

Contacts

Crossword Cybersecurity plc - Tel: +44 (0) 20 3953 8460

Email: info@crosswordcybersecurity.com

Tom Ilube, Chief Executive Officer

Mary Dowd, Finance Director

Hybridan LLP (Broker) - Tel: +44 (0)203 764 2341

Claire Louise Noyce

For media enquiries contact:

Lorena Duke, GingerPR

lorena@gingerpr.co.uk, 01932 485 300