How to maintain security when employees work remotely

It’s safe to say that we’re living in unprecedented times. Organizations all around the world suddenly have to work out how to maintain security when employees work remotely. And that’s not all — they also need to balance this with providing a truly first-rate employee experience. We spoke (remotely, of course!) with TOPdesk’s IT and security experts, Mark Herrewijnen and Bart van Manen, to find out how to balance security and employee experience while working from home.

What can organizations do?

First things first: it’s important that every employee is armed with at least a basic knowledge of IT security. Not every employee is a digital native, so it’s crucial that you cater to each and every one of your colleagues. To help with this, Mark suggests producing a one-page summary document outlining key security dos and don’ts (e.g. do remember to back up all documents but don’t log onto public networks).

Not only will this make sure that your employees don’t make basic security mistakes, but your employees will also appreciate having all this key information to hand — you can’t simply expect everyone to intuitively know what to do and what not to do.

There’s also another major danger. Amidst such widespread upheaval, organizations might be tempted to tear up the existing rulebook and introduce sweeping changes in an effort to ensure ongoing security.

Bart warns against this strategy. “Introducing too much change all at once might leave your employees confused and discouraged— they already have enough on their plate as it is. Try to follow established procedures as much as possible, and if you do want to switch things up, use change templates or incident workflows with documented approval steps.”

The message is clear: balancing security and employee experience is difficult enough as it is, so there’s no need to make it even harder.

Lastly, it’s important to ensure ongoing communication between your IT staff and your employees. As much as you might want to rely solely on established procedures, your security strategy will probably be affected in more ways than one. Mark recommends having verified forms of centralized communication — for example an intranet where employees can chat about any issues they’re having.

Try to foster a real sense of community. Let your team know that you’re always there for support if they need it: offering up your expertise and advice at all times. This is crucial if you want to successfully blend organization-wide security with providing a fantastic employee experience.

What should – and shouldn’t – your employees do?

“Well, there are the obvious things that should be avoided: don’t view confidential information in public places, don’t discuss confidential material in virtual meetings using unknown apps, and don’t log on to public networks,” Bart says.

Mark agrees: “You should also remind people not to assume that if everyone else is doing something, that automatically means that it’s safe. Even USB flash drives, which have long been a staple of IT practices, carry their own risks: they have a significant risk of being infected with malware.”

This also goes for VPNs. While some organizations might be rushing to provide employees with their own VPN in an attempt to increase organization-wide security, the opposite is actually true — if you use a VPN, you have a bigger attack surface, which leaves you more vulnerable to security breaches.

That being said, if you’re going to provide the best employee experience possible, it’s just as important to focus on what employees should do — rather than simply what they shouldn’t do. Mark emphasizes that employees should work together to develop contingency plans: triaging teams, sharing management responsibilities, as well as assigning and duplicating all essential codes and failsafe roles.

On the whole, employees should always raise any queries — no matter how large or how small — with their IT team. For Bart, “the key is to create a culture where employees have an ongoing, open dialogue with their IT team. You should make an extra effort to ensure that your less tech-savvy colleagues feel especially comfortable.”

Employee experience doesn’t mean that you have to run around making everyone happy all the time; instead, it means that you’re there for people whenever they need you, and that everyone knows this. Given how integral IT is to the vast majority of modern organizations, IT support is as much a cultural issue as it is a technical one.

If something unfortunate does happen, this is how you manage panic at the service desk