As the current pandemic crisis has scaled across the globe, the majority of the organizations have resorted to working remotely. This opens up an organization to potential cyber threats as there is a lack of control on the employee devices and digital environment. Cybercriminals are using the novel COVID-19 issue as a base for their attacks, which includes spreading malware through files containing information about Coronavirus, fake news and even scams related to masks or cures. Remote employees should be made well aware of such threats and how to be digitally safe.

1. Severity:
HIGH
Copyright ©2020 CTM360® www.ctm360.com 1
#staysafe #‫كلنا_فريق_البحرين‬
REMOTE WORK GUIDELINES
Reference: CTM-ADV-0320-2
Date: 31st March 2020
Category: Best Practices/Guidelines
Description
As the current pandemic crisis has scaled across the globe, the majority of the organizations have resorted to
working remotely. This opens up an organization to potential cyber threats as there is a lack of control on the
employee devices and digital environment. Cybercriminals are using the novel COVID-19 issue as a base for their
attacks, which includes spreading malware through files containing information about Coronavirus, fake news
and even scams related to masks or cures. Remote employees should be made well aware of such threats and
how to be digitally safe.
Please find below the best practices for employees working remotely.
VPN:
● If VPN is used to connect remotely from a work laptop, ensure to use strong passwords with 2FA.
● If you notice that your work machine is slow or experiencing glitches, notify IT immediately.
● If work devices are being used, ensure family members or guests do not have access to these machines.
Emails:
● If you receive an email, verify that the sender is legitimate / trusted and that the email is not misspelled.
● If you receive a suspicious email from an unknown source, ensure to report it to the IT team immediately.
● If you notice a genuine sender sounds suspicious, i.e. suggesting a sudden change in bank / invoicing
details, immediately escalate to IT. Do not engage further with the sender.
● If you are authorizing transactions, confirming payments or engaging in monetary discussions, ensure
that the counterparty is known/verified. These confirmations should be via phone on genuine numbers.
Social Media:
● If you receive a social media connection request, verify the legitimacy of the account. Delete, if unknown.
● Do not disclose any of your activities or work-related matters on social media.
TARGET AUDIENCE FOR CIRCULATION:
● All staff working remotely
● IT security, support teams
● Management

2. Severity:
HIGH
Copyright ©2020 CTM360® www.ctm360.com 2
#staysafe #‫كلنا_فريق_البحرين‬
Remote Meetings:
● Prevailing remote meeting tools (e.g. Zoom) are known to have privacy issues and may push some data
to third-parties.
● Ensure that every meeting is secured with a strong password.
● Disable the option of file transfer in such remote meetings, when not required.
Home Devices:
● It is strongly recommended to avoid using personal devices. On such devices, the level of risk is
exponentially higher and there are more chances your machine may be compromised.
● Isolation and Compartmentalization if using Personal devices for work related use. This can be done via
Dual Boot, Sandbox and Virtualization.
● Employees should avoid logging into their corporate emails from personal devices. If these devices must
be used, ensure that they are protected with antivirus softwares, defenders, firewalls etc. Also, consider
using a spyware scanner (e.g. https://privacy.net/free-spyware-removal-tools/) as a one-time exercise.
● Secure home-wifi networks.
● If your personal devices experience a lag or behave suspiciously, immediately stop for corporate use.
Work From Home - Risks and threats:
Social engineering & Phishing attacks:
● Beware of spam / phishing emails containing attachments that are mostly malicious in nature.
● Stay vigilant against unsolicited or unknown emails.
● Stay alert! Threat actors are using anxiety, pressure, fear or urgency as a tool to execute malicious
campaigns, impersonating known entities (e.g. governments, corporations) and sending links in
SMS/emails fraudulently offering or requesting financial support in lieu of the COVID-19 pandemic.
Fake websites & Fake news:
● Beware of fake websites offering coronavirus vaccines or cures.
● Beware of clicking on pop-up ads. You may become a victim to spyware or other malwares.
● Beware of fake news being spread on social media.
● Be sure to only use trusted information sources from official websites.
Guidelines for IT Staff
● Implement a Zero Trust security framework (providing specific access to resources only to those who
need it) on your network for employees working remotely.
● List all the whitelisted tools and platforms that can be used like cloud services, video conferencing
applications etc.

3. Severity:
HIGH
Copyright ©2020 CTM360® www.ctm360.com 3
#staysafe #‫كلنا_فريق_البحرين‬
● Ensure that all devices that will be used remotely have the latest version of
their operating software, security software and applications.
● Ensure that all devices and applications that will be used remotely have the latest patches installed.
● Ensure that all remote employees have access to a VPN, and that you have sufficient licenses for all the
employees working remotely.
● Confirm that your staff can reach your cloud-based applications and services directly without having to
go through the company network.
● Instruct your staff on emerging threats tied to the COVID-19, including new phishing attacks, attempts to
steal VPN credentials and fake news.
● Develop and implement a security policy that applies to all remote employees, including actions such as
locking computers when they’re not being used.
● Implement two-factor authentication.
Disclaimer
The information contained in this document is meant to provide general guidance and brief information to the intended recipient pertaining to the incident and
recommended action. Therefore, this information is provided "as is" without warranties of any kind, express or implied, including accuracy, timeliness, and
completeness. Consequently, under NO condition shall CTM360®, its related partners, directors, principals, agents or employees be liable for any direct, indirect,
accidental, special, exemplary, punitive, consequential or other damages or claims whatsoever including, but not limited to: loss of data, loss in profits/business, network
disruption…etc., arising out of or in connection with this advisory.
For more information:
Email: monitor@ctm360.com Tel: (+973) 77 360 360