Secure Remote Working - Overview
|Overview and User Considerations||Technical Considerations||Secure Use of Collaboration Tools||Device Considerations|
What is Remote Working?
Remote Working is when an employee can carry out regular business duties from a remote location that is outside of their employers physical work space, typically via the internet. With recent events, remote working has become more popular than previously before and will continue to get more popular as technology evolves.
Remote Working Vs. Teleworking
Although similar and most of the times used interchangeably, remote working and teleworking are similar but are not the same. Employee's who telework and remote work often use the same devices and technology to work such as collaborative tools, cloud platforms, and the internet.
Below are the differences between the two:
Duty to Document
Under the Directive on Service and Digital, employees are required to document their activities and decisions of business value. If any activities or decisions of business value are made while using department-approved or public cloud tools, then these must be captured (e.g., in a Word document) and saved in a departmental corporate repository (e.g., GCdocs) as soon as possible.
For more information, click here.
Threats and Challenges posed by Remote Working
By connecting via the internet to potentially classified or sensitive applications or data, there are threats to the safety and security of that information.
Security issues may include:
For more information please see the references section.
Recommended Security Measures
It is important to realize that because remote working uses the internet for connectivity, it may be a target for compromise. That being said, some helpful measures that employees can take to keep information secure are:
Some general things to consider when using these applications include:
Privacy and Security of Collaborative Tools
Employees should always use department-sanctioned tools for collaboration with colleagues, starting with Microsoft Teams (at Protected B if your departmental tenancy has been accredited to that level, or unclassified otherwise), then moving to other sanctioned tools such as GCTools or WebEx. If those options aren’t available, then the Policy on Acceptable Network and Device Use does allow usage of public cloud tools such as Slack, Zoom or Google Hangouts for unclassified work only. However, there are some privacy issues that need to be recognized before using these applications. It is important to remember that these applications are never to be used for any sensitive or classified work.
The Canadian Center For Cyber Security (CCCS) has provided guidance and considerations when using public cloud tools for video teleconferencing (VTC).
When choosing a collaborative tool, some things to consider are:
For a complete list of things to consider visit the CCCS advisory.
Settings and features that can help keep teleconferencing secure are:
When using a paid license of the application, a feature is unlocked that allows HR and management personnel to export ALL chats. Not only can group chats be exported but also chats that are between you and a colleague that is sent in a private chat. This feature cannot be enabled in the free license. It is important to note that Slack does store data regardless of the license, including after 10,000 messages in the free version.
Slack also retains data such as links, passwords, usernames and chats, however does have options to customize policies on data retention.
Settings and features that can help make Slack more secure are:
For a more in-depth information on how to use Slack securely, visit the Slack Help Center
Zoom has a feature that tracks attention to the webcam in order to see who is actively in the video chat. If a presenter is sharing their screen and a user minimizes the window or leaves their device, a notification will be sent to the meeting hosts. It should be noted that Zoom does not record activity on the device nor does it capture video with this setting.
When a meeting is created, Zoom generates a seemingly random ID that is 9 to 11 digits long. For someone with computing resources, this can easily be cracked allowing malicious actors to join the call.
For more information on how to create a Zoom conference, please see the guide in the references section or click here.
To learn more about best practices and accessibility features please visit ESDC's Accessibility Best Practices for Using Zoom for Meetings and Classes
Google hangouts does indeed require a Google account. It is best to use a work account if possible, to avoid details being linked together exposing private interests, and personal activity online when using that Google account. Details such as names, phone numbers, usernames and other information can be pieced together which can be exposed as a single entity in order to exploit other personal information and interests.
Google stores images that have been sent through hangouts to a public url, meaning anyone can technically see the image provided they have the correct url.
Another issue with Hangouts is that it does not feature "end-to-end" encryption. In simple terms, it is only encrypted when it is being sent. This opens the door for eavesdropping on chats as well as Google having visibility on messages.
Cisco Webex is the official enterprise teleconferencing solution for the Government of Canada offering dial-in call, video teleconferencing and messaging services across smartphones, tablets, and laptops. It is maintained by Cisco and supported by departments within the government for a more tailored solution. Although approved for use, best practices should be followed as if Cisco Webex was a non-managed third party app. It is important to remember that Cisco Webex is for UNCLASSIFIED use only. Some best practices when using Cisco Webex include:
Questions and Contact Information
For questions and other enquiries please email TBS-Cyber Security.
Collaborative Tool References