‘New normal’ playbook starts with honest assessment of telework performance

The public sector took a hit when the COVID-19 pandemic forced a rapid shift to remote work. Agencies at all levels, but especially in local government, faced a myriad of issues ranging from the lack of secure infrastructure and increased risks of cyberattacks to inexperienced staff maintaining organizational data without the help of their IT team. More specifically:

Lack of infrastructure. The high cost of having a telecommuting-friendly infrastructure -- from reliable communications and collaboration tools to trusted hosting -- left many agencies without the capacity to accommodate the majority of their remote workers.

Lack of staff expertise. Managers that weren’t prepared for a disaster suffered the most because they were unable to properly communicate and monitor the digital behavior of employees remotely.  When communication wasn’t as reliable and easy, workers could no longer check with each other or with their management and IT departments. These conditions also allowed unfiltered and malicious emails and phone calls to reach employees, putting the organization’s information at great risk. While some small organizations resorted business texting solutions to keep in touch, it’s little more than a Band-Aid solution. A single mistake in this area could spell major disaster for agencies that work with sensitive information like Social Security numbers and health records of millions of citizens.

Insufficient tools and software. Out of the office, many employees used consumer-grade applications, tools and accounts to get their work done and communicate with one another during the pandemic. While online applications like Zoom and Discord might be great for personal use, most of them aren’t secure enough to transfer confidential information. The same could be said for many ostensibly free cloud storage and file-sharing services. The risk increases when employees aren’t familiar with commercial tools, opening unnecessary security risks.

Hastily deployed telework often meant management couldn’t limit or monitor employees’ activity to ensure their equipment’s safety and integrity. In addition, outdated personal devices that did not support the latest version of anti-virus or operating systems left even more gaps for hackers to exploit.

General lack of cybersecurity awareness among employees. Over 95% of cyberattacks rely on social engineering, such as phishing emails and fake phone calls. Most organizations have security teams trained in detecting social engineering attacks on network devices. Remote workers, however, faced greater risk, especially as attackers’ tactics quickly evolved.

How to fix it

As remote work won’t be returning to the office anytime soon,  organizations can improve the security and experience of remote work -- for now and for the future.  

Educate staff regularly. All employees should participate in regular workshops and to learn how to spot social engineering and malware threats as well as how to safely use a device that’s connected to a network housing sensitive data. Staff should learn about keeping operating systems and software up to date and what they should do when attack occurs.

Protect against vulnerabilities. In addition to regular staff education, agencies must invest in proven methods of protection for both on-site and remote workers. Instead of choosing the most expensive tools, IT managers should consider the most cost-efficient products for their agency’s needs, use and levels of threats. Employees should be required, by default, to install a firewall and antivirus applications on their local machines, as well as make use of any top VPN service when connected to public Wi-Fi.

Issue employees work devices. Agencies should consider assigning devices to each employee to be used for work purposes only. This ensures that government-furnished equipment is better protected from  malware or an employee’s unsafe online practices. It also helps support lower-income employees who can’t afford their own quality devices for work, allowing for a fairer work environment for workers from different financial backgrounds.

Invest in flexible cloud servers for sensitive information. Many public-sector agencies handle citizens’ private, sensitive information, such as their medical and financial data, requiring them to have a secure method of storing and transferring their data. Agencies should consider investing in adjustable private servers, both for long-term and temporary storage services, or partnering with third parties who have a track record of security.

Prepare for a quick return to the status quo. To cut back on resettling time for employees and organizations, agencies should look to partners for specialized help in creating IT systems that address their specific needs and functions.

To survive the current situation, government agencies must identify their weak points when it comes to on-site and remote work. By knowing what they’re missing and what’s essential for them, they can better manage their budgets and resources, instead of staying put and waiting for the economy to recover.