Protecting Employees Doesn’t Have to Sacrifice Data Privacy

By Otavio Freire

During the pandemic, employees have been targeted by bad actors like never before. To properly protect their employees, companies need to implement security tools that offer visibility and monitoring. However, employees will resist or avoid any oversight that feels like a breach of privacy. How can enterprises strike the balance of protecting their workforce without infringing on employees’ data privacy?

Protecting employees from cyber attacks was a major challenge before COVID-19. However, since the pandemic began, things have got steadily worse. As ZDNet said it in its 2020 roundup, COVID-19 has delivered an “extraordinary array of cybersecurity challenges.” The Ernst & Young cyber team reports “a significant jump in phishing and targeted spear-phishing complaints.” KPMG reported a rapid rise in COVID-19 themed ransomware.

The exploitation of uncertainty, fear

Cyber criminals have always exploited uncertainty and fear in trying to achieve their nefarious goals. However, the rush of cybercriminal activity during the pandemic has a number of material causes.

• The rapid transition to a distributed workforce means employees’ work/home lives have blended. However, home offices are notoriously insecure. They suffer from VPN issues and legacy routers, and all the problems that attend IOT devices. 

• Workforce distribution also brings a new regional focus to which communication channels are favored. For example, WhatsApp dominates Latin America, but WeChat is favored in China and other parts of East Asia. This communication fragmentation opens the door to the emergence of new blind spots in how security and compliance is governed.

• Collaboration tools like Slack and Teams have been rapidly onboarded. However, most companies lack the ability to properly secure these platforms. 57% of IT and security professionals cite internal collaboration platforms as the tech stack representing the most risk.

• Similarly, messaging apps such as WhatsApp, Telegram and WeChat have been picked up as business communication apps. Security and compliance teams typically have no visibility into what is happening within these channels.

• Employees are human beings. They are anxious about a once-in-a-century pandemic, and hopeful about a vaccine. This confluence of circumstances makes attempts at social engineering and phishing much easier for bad actors. 

Threat surfaces are expanding

All of the above adds up to a hugely expanded threat surface. For security and compliance professionals, the instinct is to react to this increased risk with stricter monitoring of employee and executive communications. However, this brings its own set of difficulties.

In short: People don’t like being monitored. They don’t like feeling as though their private correspondence is being scanned without their consent. 

This desire for privacy has been enshrined in law. In the European Union, a number of companies already have been fined over-zealous monitoring of their remote workforce. As the Wall Street Journal reports, “European privacy regulators are scrutinizing how employers collect workers’ personal data and dishing out multimillion-dollar fines for violations.”

What’s the solution? Capture the risks without capturing the content. Establish total visibility into threats, and have total blindness with regard to the content of messages.

Consider the threats that are likely to arrive through an employee’s LinkedIn DMs, a Slack group, or a WhatsApp message. A link, or a file or an executable of some kind–this is what matters most. This is the attack element that security teams need to be alerted to so they can mitigate the threat. But the surrounding conversation? This is irrelevant. It’s all just noise and background to what matters: the digital risk. 

Security and compliance teams should seek tools that offer this balance and allow them to detect threats while also implementing controls that protect privacy. They need solutions that can scan without spying and monitor without reading. Content and digital speech can remain private, even as threats can be immediately addressed.

INDUSTRY PERSPECTIVE GUEST AUTHOR: As the President, CTO and co-founder of SafeGuard Cyber, Otavio Freire is responsible for the development and continuous innovation of SafeGuard Cyber’s enterprise platform, which enables global enterprise customers to extend cyber protection to social media and digital channels.