Cybersecurity

Who Watches on You as You Work From Home? I Do.

What your company laptop knows about you. That company issued phone? They know more than you think.

Firstly, Congratulations! To those who are able to keep your job after quarantine. Twenty-twenty has been a truly wild ride.

Work-From-Home Devices

Since work began to move home due to COVID-19, company-issued devices have more than ever pervaded our personal space. Remote work or WFH as they like to call it these days does not seem to be just a fad. Some even call it the future of work.

If WFH is here to stay, then it is ever more relevant to be aware of its risk. Aside from the obvious invasion of our desk space, company-issued devices pose a greater privacy risk that new employees may be oblivious to.

An Incident

An introduction of my line of work: I work as the cyber security analyst, and I frequently look through machine data received from various sources.

For simplicity’s sake, let’s say these sources can be generalised into two group — external and internal. Our focal point is the internal source which includes employee host machines, emails, and web traffic.

I lament the fact that I occasionally observe evidence that employees use their work profiles to finish personal dealings or what-nots.

“The details of the payment receipt, tuition particulars, and her identity as a mother was, literally, projected onto a wall for all to see…”

Once, I was alerted to a possibly fraudulent transaction between an employee and an external party, when it was in actual fact a conversation between her and her child’s tutor. The details of the payment receipt, tuition particulars, and her identity as a mother were, literally, projected onto a wall for all to see during a cyber team meeting. It was an uncomfortable investigation.

Her details were spelt out on a dashboard such as this:

For that matter, the employee never found out that a cyber team had investigated her personal business, since the case is resolved before escalation.

To those who are new employees, this may come as a surprise. Let this be a cautionary tale you don’t have to experience.

Therefore, I have compiled a list of reality checks.

Private or public information

Now for the great reveal. This is a non-exhaustive list of what I can know about your laptop use:

1. That file you downloaded
2. That file you uploaded
3. That activity on your laptop, down to the .exe files.
4. That email you sent to yourself
5. That email you sent to your child
6. That email you sent to your child’s tutor (real-life example)
7. The link you clicked
8. The web pages you visited
9. The skype call you made
10. That Facebook call you made
11. That unusual time you turned on your laptop outside working hours.
12. That time you stick a USB drive
13. That time you tried to access Netflix
14. That music playlist you visited online

These are all private information that people in the company can find out about you.

We are just scratching the tip of the iceberg! These are only what’s off the top of my head; I’m sure they are ways to dig more information. Now that you know how closely monitored that work device is, think twice before you send that email to yourself.

Best Practice, The Do’s and Don’ts

With remote work blurring the lines between personal and work spaces, it has become imperative to distinguish how we use our devices.

Fortunately there are some guidelines to protect our privacy from leering eyes.

1. Encrypt your attachments: To avoid mail service scanning. This can be easily done by locking your PDF documents with a password.

2. Don't write sensitive or incriminating data on the body of an email: It is visible to mail services.

3. Or on the header(subject line) for that matter: Ditto.

4. If you must download or upload, do it in small increments: Rationale is that large traffic can trip off monitors as anomalies. Gradual increase of your web payload sneaks under the alert radar.

5. Don’t login to social media: web traffic is monitored. Hostname requests can be tracked — that means visited websites are tracked.

6. Sadly, don't listen to music on your work laptop: Ditto. Still want to use Spotify? A workaround is to use your phone. Personal one.

7. Don’t use your work laptop for personal use: Software and multiple failsafe keep the machine closely tracked. These are local programs that reside in your work devices to detect abnormal user behaviors, such as theft.

Destruction or epitome of privacy

Are work technology assimilating onto our lives, or are our lives taken over by the corporate conglomerate? Yay or Nay to WFH?

Work devices are not private. WFH seems to erode privacy.

Then again self-professed introverts went online to rejoice that the WFH lifestyle have excused(saved) them from face-to-face meetings, therefore, by extension, granted them more privacy.

Well, my take on this is that whether WFH is destroying privacy or not largely depends on your type of work. Operations are well suited for this, while highly immersive work like development may cause blurring of work-life separation. Client-facing.. well, you can’t now.

“…think twice before you send that email to yourself.”

No matter which line of work, know the aforementioned best practices and stay aware of the devices. Lest your Boss finds out about the Netflix show you’ve been watch alongside..

Thanks for reading.

Read about URL Analysis: How To Determine Maliciousness here

Follow me on Medium for more