If your staff are working remotely, whether this is from home or in transit, what should they do if something has gone wrong, or just doesn’t seem right?
Post-pandemic, many people are working remotely, including those new to the workforce and who therefore have no experience of office life. Because they are working remotely, there’s no opportunity to ask someone sitting nearby whether what they’ve just experienced is normal, or what to do about it.
New starters, whether new to your company or to the workforce, may well not know what to do, and won’t have an informal network to run problems by. Even if they know who to contact, they may not want to be a nuisance, to over-burden your help desk, or to feel that they’ve asked a stupid question.
Or maybe the problem is significant enough that they can’t get access to your network or systems in order to report the problem.
Ideally, you will have thought this through, and put in place procedures so that they know what to look for, what to report and to whom they should report.
Common IT help desk problems
There are many memes going around about the apparently simple problems that IT help desk staff have to deal with every day. Yet these problems don’t seem simple to the person experiencing them at the time, they are impacting their ability to work, and just might be a symptom of a security issue. Examples are:
- They can’t log in to their device, or to the office software
- Their computer is running slowly, or isn’t working at all
- They have no internet connection
- Their email isn’t working
- They are struggling to reset their password.
One option here would be to issue remote staff with a binder of initial steps to take to try and fix common problems before calling for help – but do make sure they know who to call and/or how to report the problem, and remind them that there might be a security issue underlying the symptoms they are experiencing, so they should act promptly.
Incidents reported to the ICO
The Information Commissioners Office has a list of the types of incidents that they are routinely notified about (not all these are cyber), which include:
- Data sent to the wrong person
- Failure to use bcc, or to redact other information
- Lost/stolen paperwork or devices containing personal data
- Failure to dispose of hardware correctly
- Unauthorised access
- Malware or ransomware
- Denial of service
For some of these, it will be obvious that it is a security issue, such as loss or disclosure of data.
Recognition of phishing emails should be covered in your security awareness training, as should the appropriate action to take if your staff laptops are displaying a ransom note. It’s worth ensuring that your onboarding process, and your procedures for work-from-home, cover the most likely security issues that people will face, explaining what the symptoms might be, and how to report them.
Something like a denial-of-service attack though, will just look as though the system is unavailable, or running really slowly.
A strong security culture is one in which staff feel comfortable reporting potential security issues rather than hiding them, so a no-blame culture is particularly important if your staff are working remotely.
How will staff report problems?
It may seem obvious, but if an attack means that your staff can’t access your systems, they will need an alternative way to reach the help desk and/or their line managers. Your business continuity plan should cover this, and this kind of detail should be available to remote staff without the need to log in to anything.
Remote workers, especially those new to your company or to the workforce may need extra support, and you may need to strengthen your policies and procedures to provide that support.
If you’d like some help with thinking this through, or with updating your documentation, contact the Click and Protect team on 0113 733 6230 or via our contact us page.
