Robert Half International : Managing the Digital Risks of Remote Work Requires People

The pandemic forced many businesses to quickly adopt or expand remote work, some literally overnight. One downside of that shift has been a significant increase in digital risks. And cybercriminals have been taking full advantage of the opportunity to exploit security vulnerabilities, with more potential targets in this disrupted environment.

Recent data from the FBI underscores this: The agency's Internet Crime Complaint Center saw the number of complaints about cybercrime rise dramatically in the United States in 2020, with reported losses from these incidents exceeding $4.2 billion. Business email compromise (BEC) attacks were among the costliest scams for the nation last year, according to the FBI. Financial losses from these campaigns - which are designed to steal money or sensitive information from businesses or individual users - totaled about $1.8 billion in 2020.

As they prepare for the post-pandemic recovery and seek to avoid potentially devastating digital risks like ransomware attacks, organizations are under pressure to shore up their cyber defenses. Many are also deciding whether to maintain a remote work model or shift to a hybrid workplace - and, of course, determine how they will secure that environment.

Naturally, technology is essential. But in a threat landscape that's constantly evolving, tech tools aren't enough. Organizations need their people active on the front line of cyber defense, as well.

To make that happen, businesses need to frame cyber challenges in a more human-centric way that makes sense to every person in the organization and not just technology pros. Building awareness about the threat actor personas described below can help all employees better understand digital risks. These personas can also help workers determine whether they might be increasing such risks for the business unintentionally.

Get more workforce management tips by subscribing to the Robert Half newsletter.

The insiders who create digital risks

Threat actor personas include three types of insiders:

Well-meaning users
These individuals will bypass security controls so they can do their job quickly and efficiently. Here's an example: A well-meaning user engaged in remote work needs to send a large document to a client, so they find a file transfer service to get the job done. But that service might not be sanctioned by the company's IT department - or even secure.

Opportunistic insiders
These individuals may willingly undermine security measures. However, they would not go so far as to bypass the organization's established security controls. In short, if an opportunistic insider sees that controls are missing, they also see a green light to do what they want. That might be visiting risky websites while using company equipment or downloading apps that could be malicious.

Malicious insiders
These individuals are much more than opportunistic: They make conscious decisions to act in a way that could harm the organization or others. Stealing intellectual property or funds from the company are just two examples of malicious insider activity.

The outsiders who create digital risks

As for external threat actors, there are essentially two varieties: sophisticated and unsophisticated.

Sophisticated threat actors include groups such as organized crime syndicates. These operators are often behind the major data breaches or ransomware attacks that grab today's headlines.

Sophisticated threat actors have access to significant resources. They're adept at concealing their activity - sometimes compromising systems and then quietly gathering intelligence for weeks or even months - before launching their attacks. Some craft highly targeted phishing scams to compromise company executives or those who are close to them. And others boldly impersonate brands to trick users into buying counterfeit goods and sharing personal data.

Unsophisticated threat actors rely on well-understood but easily detectible attack methods to compromise users and systems. Ironically, they're often successful in their efforts because security teams are more focused on deflecting bigger threats, like ransomware attacks.

However, lower-level phishing scams and malicious URLs can also create a lot of noise for companies if they're not dealt with swiftly and effectively. Plus, it's not unusual to see more sophisticated actors using these less-sophisticated strategies to gain a foothold in an organization's systems.

What are the five cybersecurity professionals your IT team needs? See this post to find out.

From understanding to action to vigilance

Once everyone in your organization has a clearer picture of the different threat actor personas, they'll be better equipped to help the business fortify its security. And you can deepen your employees' understanding of digital risks by conducting a risk assessment to identify potential weaknesses in security controls and policies and pinpoint risky behaviors. You can also bring in professionals to assist security staff with these assessments and user training.

Knowing how threat actors operate and how their attacks can impact confidentiality, privacy and more makes it easier for employees to think about security differently - and more actively.

They'll know how to recognize potential phishing scams in their email inbox, for example. They'll think twice before downloading a sketchy app to their work laptop. And when a technology-related obstacle interferes with their productivity, they'll be more likely to consult IT for a solution.

Threat actor personas and risk scenarios break down the perception of security as a specialist subject and empower users to help protect the organization - and themselves. Exploring security challenges across different teams in a remote work or hybrid work environment can be an engaging and productive exercise for everyone involved. It creates an opportunity for shared understanding now - and continued adherence to best practices in the future.

Need to expand your cybersecurity team?

The people working in your IT organization also play a critical role in helping your business manage cyber threats and other digital risks. And if you're looking to hire IT talent, Robert Half can help. We can assist in connecting you with highly skilled professionals who are ready to help your organization meet its rapidly changing IT and cybersecurity needs, whether you have a remote work or hybrid work environment. Contact us today to learn more about our talent solutions.