Thought Leadership

As the world continues to fight and adapt to this ever-changing situation, many businesses have needed to become more innovative and agile in the way they’re operating. Globally, businesses have had their normal work routines flipped upside down and are now being challenged with navigating the unknown. For many, this involves transitioning to a work from home business. This sudden loss of control is difficult for businesses, and for many, this will be a very scary time.

For businesses who already have systems and processes in place, adaptation to a work from home business will be simple. However, for others who may be less prepared, the ability to adapt won’t come as easily and this will present an enormous challenge in an already stressful time.

When considering what can be done to make this navigation of the unknown less stressful, I would like to share three key points that I think allow a business to easily adapt and continue (with some modification) with business as normal.

Well-considered WFH Policy and Procedures

Having a clear direction and an outline of requirements is important to ensure everybody remains safe and understands what is expected of them.

The introduction of any policy should be necessitated by a business need, or to set a minimum standard for the topic that is being covered. When introducing any policy or procedure, the author should always have the business in mind. A good start would be to ask questions such as, ‘what is the desired result of introducing this policy or procedure?‘, or, ‘what past changes have not gone so smoothly?‘. Also question the why, ‘what is the demographic of our people?‘ or ‘what are the minimum access requirements (role, home environment, etc.) and technology needs?‘.

Some basic inclusions for a work from home business policy should include: 

• The purpose of the document;
• Guidelines for request considerations – connectivity, role resources, role suitability and workspace; 
• The frequency or period of this arrangement;
• Guidance on the logistical or performance details, which may include attendance while working from home, communication and timeframes, home insurance needs, information privacy and security, safety and well-being and WFH expenses.

Items such as these will not only set a clear business requirements and objectives, it will also make it clear to employees what is expected from them to uphold the arrangement.

Required Documentation

I am not talking about paperwork for the sake of paperwork, but having some simple documentation to assist and protect your business and its people when adjusting to a work from home business. It is very important that, as a business, you understand your obligations when it comes to safety, and it is just as important that your team understands their obligations when entering into a work from home business arrangement.

Both the business and its people need to understand that work from home business arrangements are an extension of the workplace, and therefore all business policies and safety protocols will apply, albeit with some modifications. As a business, you have a few options to ensure that your staff’s WFH environment is safe and that the arrangement will not present additional risk to the business or the team member.

Conducting safety and risk assessments of the work from home business environment is a good place to start, and there are a few ways that this can be done. The first is by employing an external party who will conduct an in-house assessment of your staff’s WFH environment. Alternatively, you can have your staff complete a self-assessment that includes photographic evidence to support their self-assessment outcomes. These self-assessments should include such areas as ergonomics (chair, workstations and set-up); potential hazards (trip and slip); general walkways to common areas and exits; first aid; lighting (natural and artificial); work environment climate (air-conditioning, fans, fresh air); and location of power supplies.

The home working environment needs to be assessed as if it was an area in the workplace.

Communication

Communication is the conduit that brings all of this together. It’s the start of the process when the business introduces the work from home business arrangement. It’s the connectivity that the business will have with its people, it’s the checks and balances that managers will use to stay on top of their peoples’ outcomes, and it’s the best way to ensure businesses expectations are met and adequate support is being provided to the team.

The business should have – within its policy or setup within its teams, how people will connect and the frequency of these connections. At the start, this may be more frequent and as time progresses the frequency may become less. Ideally, contact and communication should still occur at least at the start of the day and once during the day, not dissimilar to how you’d greet your team at the start of each workday when you arrive, and chat casually or formally throughout the day. This will help remind staff that support is available if they need it.

There is an incredible variety of technology available to businesses these days. This includes platforms such as email, video conferencing, instant messages, use of collaboration software like MS Teams, Zoom, Skype and alike – and let’s not forget the good old telephone. Although not all of these platforms will be needed, it’s a good idea to review the communication needs of your business, the pros and cons of different software options and the volume of contact that your business will need when communicating with its people.

These three key points mentioned are only a guide to the endless possibilities that are available to assist in navigating the unknown in transitioning to a work from home business. It’s extremely important that organisations implement processes and systems that are right for their business. Take the time to ask questions, research and understand what value these changes will provide your business, especially in these unique times.

Authored by:

Brendon Croft
People, Culture and Capability Manager at Best Practice Softwar

COVID-19 may not be the only virus health organisations need to worry about.

The current COVID-19 crisis afflicting the world has changed the lives of billions of people. Forced into isolation in both our private and working lives, more employees than ever before are now working from home across most industries. With this major crisis leaving many hospitals and healthcare organisations on the edge of their breaking point and more vulnerable to serious technological disruption, it was almost inevitable that the technological vultures known as cyber criminals would soon be circling, looking to maximise profits against vulnerable, high-value targets.

The following article is intended to shine a light on some of the recent concerns surrounding cyber security during COVID-19 that are occurring around the globe, and will provide readers with some quick safety tips and resources for further information. All information provided is general in nature, as we are not IT security advisers, and recommend specialist consultation where possible.

The Current Situation – Cyber Security During COVID-19

Healthcare organisations have traditionally prioritised spending (and rightly so) on equipment and staff over ICT infrastructure, which has unfortunately led to healthcare organisations often being behind the curve when it comes to cyber security with the perception of being “soft-targets” to cyber criminals.

Australia is no exception, as illustrated by the well-publicised ransomware attack affecting multiple Victorian hospitals in October of last year (ACS, 2019).  Figures released by the Office of the Australian Information Commissioner (OIAC) showed the Healthcare provider sector to have the highest number of reported data breaches for the entirety of 2019 (OAIC, 2019).

A particularly severe event in the Czech Republic left a major hospital and COVID-19 testing centre without access to critical equipment, forcing the delay of surgical procedures and relocation of some patients to other institutions (Humanitarian Law & Policy, 2020).

Cyber Attack Vectors

Though ransomware/crypto attacks are often the most publicised methods of attack, increases in multiple attack types have been observed and warned against by numerous security agencies including the FBI, Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) and the United Kingdom’s National Cyber Security Centre (NCSC) to name a few (www.us-cert, 2020). Some of the more common ways in which attacks happen have been listed below.

Human/Social Engineering Risks

Regardless of the security posture of any organisation, and despite even the most robust IT systems, the weakest point in any infrastructure is always the user. Some common methods used to manipulate users into circumventing security controls are listed below.

Phishing

There is a reason phishing emails are such a common occurrence, despite “Nigerian Prince” type scams being the “oldest trick in the book”—people are still falling for them, so they’re still being used. In this context, likely scenarios are emails convincing users to open malicious attachments that steal personal information or install remote access trojans (RAT).

Emails can also convince the user to click links to malicious websites that mine the user’s IP address or install Remote Access Trojans.

Several recent phishing campaigns have been observed on our shores, with emails purporting to be from the WHO and Australia Post for the exact reasons listed above.

Business Email Compromise (BEC) Attacks

Closely related to the phishing, several email scams have been reported whereby users are conned into donating money to COVID-19 charities, including some purporting to be from the WHO.

An additional form of a BEC is a spoofed email pretending to be from one of the targeted business’s VIPs, directing an employee to provide passwords or transfer funds to different accounts.

Vishing

Closely related to the above voice phishing (vishing), is an impersonated phone call attempting to verbally achieve similar goals to phishing, by coercing a user into providing personal details, credit card numbers or browsing malicious web links.

Smishing

SMS phishing (Smishing) uses SMS messages for similar purposes to vishing.

Tech Support Scams

Tech support scams may take any of the above forms and usually involve a malicious actor attempting to convince a user that they need to “urgently” access their computer remotely to fix an issue, when in reality they are after computer access to install a RAT or otherwise cause harm.

Obtaining remote access to a target system is particularly effective in circumventing firewalls, as often rules are applied that ignore returning traffic if it was initiated inside the network. Meaning while a malicious actor can’t launch malicious traffic directly from an outside source, they can have a user initiate first contact and then gain access via the reply traffic.

Technical Risks

DDOS Attacks (Distributed Denial of Service)

There have been some minor increases in DDOS-type activities, where malicious individuals try to overwhelm systems with massive traffic volumes for botnet armies etc. Firewall policies can mitigate these as can most ISPs.

Software and Operating Systems

End of life or out of date OS software is always a security risk in organisations. Microsoft ended support for Windows 7 and Server 2008r2  in January of this year, meaning any newly discovered security vulnerabilities will not be patched in these operating systems and they should be upgraded as soon as possible.

Even the latest versions of operating systems are vulnerable without adequate security patching and up to date Anti-malware software.

Remote Access Technologies

The rapid expansion and increased reliance on work from home infrastructure, tools such as VPN appliances/concentrators, RDP endpoints, communications platform (Zoom, Skype) and remote access platforms such as Citrix, have exacerbated security risks and formed threats such as poor network design, configuration mistakes and out of date devices and software.

Several vulnerabilities were found to have been exploited in major vendor products including Citrix, Palo Alto and Fortinet. Likewise, an increase in phishing attacks centred around popular communications software products Zoom and Teams, where in some instances sessions were even hijacked by external sources.

A majority of these issues can be avoided, by merely ensuring OS, hardware and software products are up to date with the latest patches, and by using security controls such as strong passwords and two-factor authentication.

It is 3:00am and I am awake. Again.

This is the third time this week. I reach for my phone and open up my social media app where I scroll through the latest COVID-19 updates in a group of doctors that is 13,000-strong. My eyes frantically try to keep up with numerous graphs, projections, news stories and the impacts of compromised mental health during COVID-19. Scattered in between these are personal stories of frustration, anger or even complete denial of the scale of the problem.

By the time I manage to get to work and see my first patient at 8:00, my mind has already spent 5 hours ruminating about COVID-19. My eyes are dry and my shoulders already feel heavy. Surely this behaviour is unsustainable? A chat in the tearoom with my colleagues, sitting 1.5m away from me, reveal this phenomenon to be common.

As we find ourselves in the midst of a one in 100-year event that has upheaved our daily schedules, it is normal to feel stressed, worried or anxious. With rapidly changing government policies regarding work and play, isolation and uncertainty prevails over consistency, routine and social interactions. Many of us in the healthcare and technology industries, who are still able to work and have a steady income, watch in fear as those in the hospitality, retail and tourism industries lose their jobs and livelihoods. We worry about the future and about the economy.

Is the government doing enough?
Why did they let all those people off the Ruby Princess?
Are we doing enough to look after mental health during COVID-19?
Will there be a global economic recession or a depression on the other side of this pandemic?

Stress occurs when there is a perceived threat that is beyond our ability to control. When we are are stressed, there are physiological changes within our body that cause us to be more alert and vigilant. This is commonly known as the ‘fight or flight’ response. If the threat is continuous or persistent, those physiological changes can affect our emotional health and well-being in the form of anxiety.

Anxiety, much like a chameleon, can manifest in many ways. It can be as subtle as mild irritability and a reduction in concentration, to a more noticeable insomnia, early morning rising or reduced appetite, to full blown panic attacks with physical symptoms. This can be compounded by our current situation of physical and social isolation, that has become an mandated part of life today.

How Can We Deal With the Constant Strain on Mental Health during COVID-19?

The first step to coping is to accept that there are many variables that are completely out of our control, such as the duration of this pandemic; how many people will be affected; how others are responding to the situation and if there is enough toilet paper at the shops.

The second step is focusing on the variables we do have control over – such as our daily routine, finding enjoyable things to do at home, connecting with and supporting our friends, families and colleagues. Practically this may involve simple things like going for daily exercise in the morning, getting ready everyday, going to ‘work’ in a dedicated room and clearing it away when work has finished, having breaks, doing activities with the family, debriefing with friends and colleagues and switching off the news and social media. Some workplaces have created virtual ‘tea rooms’ or ‘water coolers’ in their respective meeting applications where staff can drop in at random times, as they would if in an office, and catch up with other colleagues whom they may not interact with regularly.

Of the above, daily exercise is proven to be the most effective intervention for stress at a population level. This is likely because sunlight and the natural hormones that get released during exercise can elevate the mood. For me personally, limiting social media and the news has also helped significantly as my brain gets a break from the constant negative stimulus after 7pm every night. Re-discovering the myriad of enjoyable things to do at home such as gardening, board games and reading, to finally getting through the decade old to-do list of sorting travel photos and decluttering, these activities have provided a welcome sense of achievement.

The link below is a great resource that explains how our normal worries can become excessive, and it provides some methods on how we can stop ourselves from progressing through a negative chain of thoughts that can lead to heightened risk to our mental health during COVID-19. There are also some practical tools included, such as an Activity Menu to keep occupied and a Decision Tree about how to prevent ourselves from overthinking things which are out of our control.

Click here to download a helpful PDF on managing stress and anxiety during this difficult time.

If these simple measures do not help to improve how you are feeling, then it may be time to check-in with your GP.

Authored by:

Dr. Fabrina Hossain
Clinical Advisor at Best Practice Software