{"id":5316,"date":"2020-12-11T10:57:17","date_gmt":"2020-12-11T09:57:17","guid":{"rendered":"https:\/\/phronesys.eu\/?p=5316"},"modified":"2024-04-05T12:51:11","modified_gmt":"2024-04-05T10:51:11","slug":"how-secure-is-your-company-data-during-telework-some-guidelines-from-iso-iec-27002","status":"publish","type":"post","link":"https:\/\/wp.phronesys.prod.aws.phronesys.eu\/en\/how-secure-is-your-company-data-during-telework-some-guidelines-from-iso-iec-27002\/","title":{"rendered":"How secure is your corporate data during telecommuting? Some guidelines from the ISO\/IEC 27002"},"content":{"rendered":"
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

In 2020, the importance of digitization became more apparent than ever, especially for businesses. Even when an employee is home sick or unreachable, digital solutions and \"the cloud\" allow colleagues to still get the files they need. In addition, travel is currently discouraged, making collaboration across borders more difficult. A digital system thereby ensures connectedness so that communication continues flawlessly wherever and whenever. But all this digital remote working, telecommuting, working from home, home office ... is not without risks. In this article, we look at the importance of information security during telecommuting.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t

\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"man<\/picture>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

ISO\/IEC 27001<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

ISO\/IEC 27001 describes the requirements of a quality information security management system. Annex A of that standard includes a list of 35 objectives and associated measures that constitute the minimum requirement for certification. However, that table does not provide a practical elaboration of the measures. For that, it is best to take a look at ISO\/IEC 27002: the code of practice for information security controls. In about a hundred pages, the 114 measures for each objective are explained in detail. In this article, we take a closer look at one of those measures: 6.2.2 telework<\/b>.<\/p>

The standard requires an organization to provide appropriate policies and security measures to protect information accessed, processed or stored while teleworking. Teleworking is defined as any form of work that is performed away from a desk, such as working from home, flexi-working or working in a virtual environment.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

A secure physical and virtual work environment<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\tThe physical environment<\/b>\u00a0in which teleworking takes place must be secure, both the building and the local environment. This prevents (sensitive) information from being destroyed or stolen.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"Same<\/picture>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Access to the virtual work environment<\/b> is also a concern. Remote <\/i>access to internal systems of the organization must be secure so that only authorized individuals can handle the information in those systems. Family or friends who access information, accidentally or unintentionally, are also considered information security threats. For devices and networks used for telecommuting, adequate measures regarding firewalls, encryption and malware protection must be taken.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Your own laptop or one from work?<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Measures should be provided that avoid (sensitive) information on private devices<\/b> used and stored. In fact, those devices can be difficult to control by the organization, including due to laws about privacy and private property (e.g., GDPR). The best option is to keep the information in an operational virtual environment, such as Phronesys'.<\/p>

Furthermore, there are risks around infringement of proprietary rights and (software) licenses. For example, several software developers, including Microsoft Office, prohibit individuals from deploying their own personal version (e.g., Microsoft Office Home) for commercial use. That is, even while telecommuting, employees are required to use the version with a commercial license<\/b> from the employer to use. That license is usually not installed on private devices.<\/span><\/p>

Thus, the ISO\/IEC 27002 directive prefers the option where employers provide their employees with the appropriate devices for telecommuting and discourage the use of private devices. This way, they can better follow the various information security requirements:<\/span><\/p>