As teleworking becomes the new normal, what are the risks related to using remote tools? The increase in cybercrime prompted Europol to publish a primer called Pandemic Profiteering How Criminals Exploit the COVID-19 Crisis. The report lists social engineering attacks (phishing emails) as the most significant cybersecurity risk for businesses.

According to Human Resources Director, nearly five million Canadians who didn’t normally telework are now doing so since the week of March 22. With Zoom becoming the overnight default for both large and small corporate meetings, remote workers quickly became familiar with the dark side of videoconferencing.

Zoom saw a 535% rise in daily traffic in the last month. Their users also became the target of zoombombing, a hacking tactic when someone (a person or a troll) joins an online chat uninvited. The zoombomber might share inappropriate images, cite racial slurs and messages, and even more worrisome, the troll can take over another person’s computer, gaining access to sensitive information.

In response to the unexpected hacking, on April 22, Zoom, having surpassed 300 million daily meeting users,  announced a 5.0 version with added encryption as part of its “90-day Security Plan.” The update supports AES 256-bit GCM encryption, which provides more protection for meeting data and greater resistance to tampering. Zoom added a function to report a user. This allows hosts and co-hosts to report users to Zoom’s safety team, who will review any potential misuse of the platform and take appropriate action. (Look for this feature within the security icon in the meeting controls.)

Besides zoombombing, there are other hints about potential cyber breaches work-at-home employees should look out for. Forbes cautions telecommuters to make note of software programs appearing that were never installed, a slowdown in their computer’s operating system, loss of control of the keyboard or mouse, and odd pop-up ads. If any of these happen, employees should contact their IT team as soon as possible for further investigation of the event.

As CIOs and IT managers scramble to develop best practice guidelines for their staff to help protect both company data and personal data, they’re also rethinking their Virtual Private Network (VPN) strategies. One of the reasons for the uptick in cybercrime is people working from home typically have weaker Wi-Fi security. They might be using Wired Equivalent Privacy (WEP) instead of the stronger protocols like Wi-Fi Protected Access II (WPA2).

Virtual Private Networks (VPNs) pose solutions for employees needing to connect to a company’s server but some setups are better than others. In an interview with Forbes, a security infrastructure expert recommends ditching hardware-based legacy VPNs in favor of “cloud-agnostic and scalable network security solutions.’’

With most companies not ready to support a fully-remote workforce (on average a VPN supports 5 to 10 percent of a workforce to telework),  TechRepublic recommends managing VPN capacity by moving it to a software-based service; and to rethink their approach to tunnel traffic.  When a company uses a full tunnel approach, all employee activity can be monitored. A split tunnel approach can save bandwidth but monitoring of a remote worker’s actions is limited. Moving the VPN to a cloud-based solution might make that choice is easier.

With a recent CFO survey from Gartner finding 74% intend to shift some employees to remote work permanently, the new normal will likely need a pivot in VPN strategy.