17 April 2020

Staying cyber safe while working from home

Our Australian work patterns have changed immensely in response to COVID-19, and when large numbers of employees work remotely, cyber security becomes a primary consideration. 

The key to protecting your company’s data, network resources and sensitive information while working remotely is understanding, identifying and reporting cyber-attack attempts and threats. No matter how effective technical protections are, the human factor is all important. You and your teams actions are the best defense. Here is practical guidance from the Gallagher Cyber Risk team for creating a ‘cyber safe’ remote working environment.

COVID-19-AUS cyer security guidance WFH-image


Understanding common cyber-attacks and how to avoid them

Social engineering

These extremely common attacks typically attempt to trick you into clicking a link or opening an attachment containing malicious software [malware] that enables access to your company’s business systems. Malware can be delivered via email [phishing] or through a website [watering-hole] and typically use an enticement such as a message about an urgent issue or a promise of sharing critical information. Once the malware is enabled, the cyber attacker uses this connection to access your business network or data.

How to avoid social engineering threats

1. Do not open emails from unknown sources: No matter how legitimate they look, check these messages by contacting the sender by telephone, the sender organisation via a trusted email address, or contact your IT helpdesk.
2. Do not respond to authorisation requests you don't recognise: Unexpected emails to approve a connection you didn’t request or to provide multifactor (user name and password) authentication should be referred to your IT helpdesk.
3. Beware of urgent or ‘Act Now’ messages: Be suspicious of any message that prompts you to react urgently to offers of inside information on any issue but especially COVID-19. Treat them in the same way as an email from an unknown sender, address or with an unfamiliar subject line.
4. Stick to reliable websites or sources: Avoid website links in social media posts or on websites that try to attract your attention with supposedly urgent messages. Visit only trusted websites for updates on the COVID-19 pandemic, and other business or market-related information relevant to normal business operations.
5. Don’t use your work assets (computer or phone) for recreational online activities: Don’t let people in your household use them either.

Data sprawl and loss

Data sprawl relates to information that is leaked outside the company’s standard IT/cyber defences and information security practices. This can happen when remote workers take short cuts or try to transfer information in a way that might seem more convenient than the standard business process.

Examples include sending a sensitive file to a personal device or transferring it to a USB stick for sharing or printing, or using a non-business-approved file sharing platform. In all these cases unencrypted information can be leaked or lost.

How to avoid data sprawl or loss

For internal and external collaboration, conferencing and file sharing use only company-approved file-sharing and collaboration tools to transfer information and data. Don’t be tempted by easy accessibility to send business files to personal email accounts, store business information on portable devices or on unauthorised sharing platforms, or in the Cloud.

Be aware of what constitutes sensitive data and recognise that it should be encrypted before it’s transmitted to anyone or anywhere outside of the business. If you need to send an individually encrypted file, secure it with a strong password, and don’t share the password by email. Better still, use a company-approved transfer solution.

Using insecure networks

Working remotely opens up opportunities for cyber-attackers to try and gain access to your company’s networks. They may try to obtain user credentials for email, virtual private networks (VPN) and other remote access systems. They might also attempt to bypass multifactor authentication controls by tricking users into approving an authorisation request. 

Connecting to your business network via an external network that uses a router with insecure settings, which could be the case in your home, or that is unsecured (such as in a shared public Wi-Fi location) can also expose your company’s systems to cyber-attack.

How to avoid insecure networks

Use secure, known networks, preferably a company-provided VPN wherever possible ‒ the VPN offers an added layer of protection for potentially insecure networks.

Ideally you should ensure your home Wi-Fi router is protected with the WPA2 or WPA3 encryption setting. Additionally protect your router/modem and internet service provider (ISP) portal with a strong, unique password – and update your software as soon as your receive prompts from the provider.

Act now to stay cyber safe

Download and refer to our guide alongside your cyber insurance cover and adapt these recommendations to your business’s remote working situation. If you would like to access additional information or have a question about cyber security insurance cover our Cyber Risk team is on hand to help.

Editor’s note: This article has been written to provide clients with guidance. You should refer to your own cyber insurance cover when considering this.

Download our guide to Stay Cyber Safe 

Further reading

Cyber insurance

Cyber security and-COVID-19: how to protect your business online during the coronavirus outbreak

Cyber security package for small business endorsed by government


To the extent that any material in this document may be considered advice, it does not take into account your objectives, needs or financial situation. You should consider whether the advice is appropriate for you and review any relevant Product Disclosure Statement and policy wording before taking out an insurance policy.