Fifty-six (56) percent of employees are using their personal computers as their company’s go remote in response to COVID-19 according to the Work-from-Home (WFH) Employee Cybersecurity Threat Index released by Morphisec. In addition, nearly 25% of employees working from home don’t know what security protocols are in place on their device and more than 1-in-4 have frequent or more issues with spotty WiFi limiting antivirus efficacy.

Morphisec's WFH Employee Cybersecurity Threat Index was based on a survey of more than 800 traditional office workers from across the U.S. These employees self-reported as recently transitioning to working remotely during their company’s response to the COVID-19 pandemic. Although the trend toward remote work was already in progress when COVID-19 struck, it accelerated the transition far faster than anyone anticipated. Due to this, IT and security teams had to scramble in their response to the crisis, and the inaugural threat index spotlights the resulting cybersecurity gaps and vulnerabilities reported by employees.

The American workforce is now reliant on at-home WiFi networks and non-hardened work devices, says the report, and without reliable connectivity, employees may not be getting the protection they need. Antivirus and detection tools need a constant network connection to remain effective at blocking attacks. Non-hardened laptops or other endpoint devices can also pose a significant risk to enterprise network security. Research from earlier this year by Morphisec and Ponemon Institute found the average cost of a successful endpoint attack was $8.9 million in 2019.

Furthermore, attack surfaces have expanded during the crisis through employee reliance on collaboration apps. These tools are increasingly in the crosshairs of malicious parties and have less than adequate patching protocols. In fact, vulnerabilities have forced organizations such as Google, SpaceX, and NASA to actually ban employee use of such applications to reduce their risk of more sophisticated breaches. Morphisec Labs researchers discovered one such flaw in the Zoom application in April that enabled threat actors to record Zoom sessions without the participants’ knowledge.

Although 62% of WFH employees rate their IT department’s response to COVID-19 as above average or better, a third of employees rate the response as average or below. The task now for IT teams is to enhance distributed workforce cybersecurity as work-from-home continues into the future. Many enterprises have seen productivity gains during remote work, and several FORTUNE 500 companies have already announced more permanent WFH adoption. Therefore, just as information technology leaders are reassessing what tools are the best for remote productivity, they must re-examine which aspects of their cybersecurity stacks enhance remote business continuity.

Additional highlights from Morphisec’s Work-from-Home Employee Cybersecurity Threat Index include:

  • Remote working was an entirely new experience for 49% of employees.
  • 75% of WFH employees say they usually or almost always follow their IT team's advice when it comes to cybersecurity protocols.
  • The most common tip employees received from IT in transitioning to WFH was being wary of suspicious emails, attachments, or pop-ups (56%). This was followed by ensuring antivirus software was active (48%), and updating software frequently (46%).
  • Worryingly, 20% of workers said their IT team had not provided any tips as they shifted to working from home.
  • Business chat apps such as Slack and Microsoft Teams were rated by WFH employees as their second most essential tool in working remotely. Yet, workers acknowledged they were the least cautious in using these types of services.

“The COVID-19 crisis has accelerated the long-term shift towards remote workforces by 5-10 years,” said Andrew Homer, VP of Security Strategy at Morphisec. “As tomorrow’s workers seamlessly alternate between work and household tasks on their personal devices, new types of deterministic cybersecurity defenses are required by security teams to limit the need for human intervention. Growing reliance on collaboration applications, which can’t be patched fast enough, begs for the use of defense mechanisms such as moving target defense to thwart in-memory exploits, zero-day attacks, and evasive malware that will continue targeting distributed employees.”

Download the full Morphisec Work-from-Home Employee Cybersecurity Threat Index here.