6 Tactics to Protect Remote Servers from Social Engineering Hacks
Taking your team remote is a bold move for any business. It necessitates secure, remotely available servers and resources so that remote team members can connect. With recent events pushing many teams rapidly into all-remote conditions, it’s important to take your security steps in stride. Ideally, you have already built a tech-stack of remote servers, company security, and secure Saas platforms. But the final layer of security always comes down to the team.
Social engineering is the type of hacking that uses trickery instead of technical skill. If even one of your employees is tricked or targeted and deceived by a social engineering, the hacker gains access to your remote server and assets as if they were the employee. They can steal data, delete files, plant malware, and possibly even transfer money. Often, one stolen login can be leveraged to even greater access and damage, once an authorized login is secured. Other types of social hacking manipulate employees into revealing information, transferring funds, or planting malware themselves.
Securing Your Team from Social Engineering
The last layer of any company’s cybersecurity is the team and their ability to detect and resist social engineering attempts. Therefore, the best thing you can do is to provide a security infrastructure that is easy to use and train your team in resisting infiltration attempts.
1. Send Out the Bulletin
The first thing to do is inform your team. The best defense against social hacking is a team that is on their toes and ready to take the right steps. Many of the defense strategies require a small amount of extra effort, like always double-checking certain procedures, and everyone needs to be on board.
Aside from security routines, you want everyone thinking about the possibility of an infiltration attempt. You want them suspicious of familiar contacts through a new platform or username. You want them to know all the latest scams like fake COVID-relief and bait software traps in addition to the usual impersonation and opportunity type scams.
So send out a bulletin, an e-book, or an online training course. Include an easy one-page best practices guide they can print or reference easily. Then make sure these tips become common knowledge in the company culture.
2. Use Passwords & Pins for Everything
When securing remote work operations, always use a password. Any time the software gives you the option, add a password or pin. The best policies include a complex password for each person. But to be clear, even a shared simple password provides significantly more protection than an ungated connection. This has proven true with the recent Zoombombing phenomena.
Always have a password and enforce complexity based on the sensitivity of your data and the capacity of your staff. We strongly recommend unique pass-codes for each person with flagged tracking on the activities of each individual logged-in account. This will become vital to detect an infected account if someone does get hacked.
3. Location Detection
Speaking of detection, track login location. People working remotely follow two general patterns. Either they are working from home and all logins will be within a 10-mile radius of their home or they are traveling for business and their log-in locations should already be charted. The exception is working vacations, and again, general location can be logged with the company.
Here’s the trick: Any logins that happen outside the known radius are immediately flagged as hacking. This will flag both distant hackers and anyone using a VPN that routes through distant IP addresses.
4. 2+ Factor Authentication
2-factor authentication used to be considered a hassle, but has now become more commonplace and accepted. Why? Because 2-factor authentication is the single best defense against login theft. Consider the critical moment when an employee gets a password-change authentication text that they didn’t request. 2-factor authentication to email and especially to phone ensure that the real owner of each account is regularly alerted to operations and given a chance to put on the breaks.
Use more than one type of additional authentication. Use phone and email confirmations. Also consider additional password types like photo, drawing, or puzzle passwords in which the solution is only known by the true user. Social hacking intended to access accounts can be thwarted by this kind of defense.
5. 2-Factor Live Confirmation
When it comes to social hacking, it’s also necessary to include live confirmation policies. Social hackers often impersonate people’s bosses, coworkers, and remote contacts in order to steal information, identity data, gain access, or to trick someone into taking a damaging action. This means that live confirmation is a necessary precaution.
Live confirmation means using a second channel of communication to double-confirm requests before they are performed. You might ask that everyone get confirmation through the internal work email addresses. You might ask that, for certain requests like money transfer, that a phonecall is necessary before the action is taken. This ensures that no spoofed communication channel can be used to trick someone into taking damaging actions without checking first.
6. Precisely Worded Messages
The detail of your automated security messages can matter more than you might think. A recent fake customer support scam tricked a woman into revealing her one-time email code because the email did not say “password change” anywhere in the text. It called itself a generic one-time code. The hacker, pretending to be a customer-support agent, smoothly said the code would be sent (they knew the system) and asked for the code numbers.
So be clear in your messages. Be precise and detailed on what each security message pertains to. It’s worth the extra hours of procedural message coding to make it work. This way, your emails, text messages, and security alerts always let the recipient know exactly what is going on. It’s one thing to ignore or mistake a no-context string of confirmation numbers. It’s another to ignore an unasked-for change of address or password.
Social engineering is an acute problem when working with remote servers and team members. In order to protect your company data and your employees, it’s important to build a strategy against social hacking that can be implemented across all accounts and used by every remote team member. We can help. Contact us today for more remote work security insights and the IT support to make it happen.