At the end of last year, technology company HP predicted that because remote work setup has weakened organizational security, cyberattacks would be more targeted and methods would vary.

As the pandemic still rages on in many countries, with only a few that have achieved vaccine herd immunity, work from home arrangements are encouraged. The fewer people outside means the less likely the coronavirus would be passed on.

However, home networks are vulnerable to cyberattacks as opposed to corporate networks wherein security postures are of enteprise-grade. Routers and other smart devices are attack surfaces that are easy to penetrate.

HP unveils advanced security solutions for businesses, remote workforce

HP LaserJet multifunction printers boost productivity, security

“In our transition to remote work, it is critical not to let our guard down and sacrifice our security and privacy. This is why, we at HP, continues to deliver on the best-in-class security technologies to empower the Filipino workforce so that they can work and collaborate securely,” said Christian Edmond Reyes, managing director for the Philippines, HP Inc. “As more company devices leave the protection of the company network, sustainable recovery and success has become a security decision.”

Quoting Verizon’s 2020 Data Breach Investigations Report, HP pointed out how small businesses are easy targets for cyber criminals. It said that within two months of the COVID-19 outbreak, 13% of small businesses (SMB) reported that they had been victims of an attack.

Large organizations have the resources to bolster their defenses and that leaves SMBs whose security posture is if not non-existent, weak. Sometimes, SMBs with connections to enterprises are made as entry points to launch much larger attacks.

Matthew Gardiner, principal security strategist for the cloud-based security provider Mimecast, said, often the primary avenue of attack against SMBs is in the form of malicious emails that often contain harmful links or attachments. While some of these emails are generic, poorly written, and easy to spot, others leverage real information to mimic trusted senders requesting sensitive data. 

The recent study by Mimecast revealed that impersonation attacks grew by 24% between January and June. The study, which analyzed more than 195 billion emails, found that these attacks typically use subject lines containing words like “invoice,” “order,” “PO,” or the names of well-known courier or shipping companies.

“Some of these can look very convincing because they can, in an automated fashion, pull graphics off your website, so the email that comes through might have your company logo on it and look superficially quite legitimate,” said Ian Pratt, global head of Security, HP. 

Preventing cyberattack in a remote workplace

Attack surfaces can be anything that is connected to a network. Smart devices are locked-in targets because many rely heavily on the cloud or broadband or other networks. The Internet of Things (IoT) also meant more entry points for hackers.

“Unfortunately, IoT devices commonly found in the home are not as secure because they are often missing key security features such as firmware updates,” said Shivaun Albright, chief technologist of Printing Security, HP. “As soon as a single employee’s laptop is compromised, the corporate network can be at risk, threatening the entire business.”

Recognizing the damage of cyberattacks or data breach to company’s reputation and business operations, HP built its printers with the “highest-possible security settings in place right out of the box.”

“We’re shipping small-business and home printing products with unique passwords,” Albright said.  

HP printers can also proactively detect and thwart a malware attack from outbound DNS network packets on those printers equipped with the HP Connection Inspector. Once an attack is detected, the device initiates Sure Start, a process that returns the device to a safe and secure state.

With many predicting that remote work setup — or hybrid, at least — is here to stay, HP listed steps that companies can share with their employees to ensure that even if companies equipped devices with the strongest security solutions, security is tightly observed.

Essential security

“The list is fairly long on basics, but certainly includes multifactor authentication and more sophisticated and automated anti-phishing, and then behind your technical controls you need to have your people and your processes resilient to cyberattacks,” Mimecast’s Gardiner said. “Just very simple things can help, like looking closely at the full email address in the ‘From’ line rather than just the name of the sender, to check that the domain is the correct one for your organization,” adds Pratt. “Although these, too, can be forged or compromised, in most cases the scammers don’t bother, so it’s a useful check.”

Keeping software up to date, enabling two-factor authentication, choosing strong passwords, and using a password manager can also go a long way in protecting small businesses from hackers. 

Pratt adds that choosing technology designed with security in mind can significantly mitigate the risks and reduce the potential damage caused by an attack. For example, HP PCs come standard with HP Essential Security, a suite of security features including HP Sure Sense and HP Sure Click, which proactively prevent threats and ensure fast recovery if an attack does happen. SMBs can upgrade to HP Pro Security for advanced protection against malware and phishing attacks. 

“Sure Sense is a next-generation approach to spotting malware that uses machine learning and artificial intelligence to stay ahead of attackers,” Pratt said. “When the user clicks on a potential phishing site that is trying to steal their credentials, we can alert them that they shouldn’t enter any passwords or other details.”

HP Sure Click provides an added layer of protection without relying on detection. “Basically, for any potentially risky activity — like opening an email attachment or clicking on a link — it’s going to create a virtual machine in the background, a disposable computer, to perform that particular task,” Pratt said. “That disposable computer is going to live just for the life of the task, and only have the access and resources required for that task, no more. When the task finishes, that virtual machine is automatically thrown away.” 

While many small businesses equip their staff with generic cybersecurity software, Pratt warns that such services are often insufficient to protect them against increasingly sophisticated attacks, especially in a remote workplace setting.

“Just using anti-virus software isn’t enough these days,” he said. “Now everybody has to take this stuff more seriously and use more sophisticated approaches to security.”