The shift towards remote work has changed the way we approach our professional lives. In Australia, since the COVID-19 pandemic, working from home has become not only common practice but a growing expectation. Many job applicants look for roles that offer the flexibility of remote work, and some will pass over roles that don’t. This change brings real benefits, but it also changes where and how an organisation’s data is handled, and with that comes insider risk.
The Appeal of Working from Home
Remote work allowed businesses to keep operating through lockdowns and restrictions. For many employees, working from home offers a more flexible and comfortable environment and a better work-life balance. In Australia it has become attractive enough that some job seekers decline offers without it.
How Remote Work Changes Insider Risk
Insider risk covers harm to an organisation, intended or not, by employees or contractors with legitimate access. Most of it is negligent or accidental rather than malicious. Remote work doesn’t make people less trustworthy, but it does change the conditions:
- Data moves to more places. Files are downloaded to home devices, synced to personal cloud storage, printed at home or forwarded to personal email to get around a technical hurdle.
- Home networks and shared devices. Family computers, home routers and public Wi-Fi are rarely as well protected as the office.
- Fewer informal checks. In the office, a quick question to a colleague (“should this go to the client?”) catches many mistakes. At home, people are more likely to just send it.
- New tools. Remote workers are quick to adopt unapproved apps and AI tools to get work done, sometimes pasting sensitive data into them.
Conflicts of Interest
Remote work can also make undisclosed conflicts of interest harder to notice. For example, imagine an employee who quietly takes on a second role with a competitor or supplier. The concern for the organisation isn’t where they work, but whether confidential information, client relationships or intellectual property move between the two. Clear policies on secondary employment and declaring outside interests deal with this far better than watching people’s working hours.
Protecting Data, Not Watching People
The answer to remote-work insider risk is visibility into how sensitive data moves, not surveillance of employees. Keystroke counts, screen recording and activity tracking measure the wrong thing: they say little about whether data is safe, and they damage trust. What matters is knowing where sensitive information lives, who can reach it, and when it moves somewhere it shouldn’t, such as personal email, personal storage or an AI tool.
Where organisations want to understand how remote and office work compare, that question should be answered fairly, at the level of teams and roles, from work metadata rather than message content, keystrokes or screens.
Ethical Considerations
Transparent communication is essential in building trust between employers and employees. Clear policies should set out what is reviewed, why, and how it is used. Any approach should be proportionate, respect privacy and comply with workplace surveillance and privacy laws, which in Australia vary between states and territories. Without transparency, even well-intentioned security controls can lead to a breakdown in trust and morale.
Strategies to Mitigate Insider Risk
Organisations can adopt various strategies to reduce insider risk in the remote working environment:
- Clear Communication: Explicitly outline remote work policies, data handling expectations and what security controls are in place.
- Secure Tools: Give people approved, secure ways to share and store files, so they don’t need personal workarounds.
- Know Your Sensitive Data: Discover and classify sensitive data, and tidy up overshared files and outdated access.
- Visibility into Data Movement: Detect sensitive data leaving the organisation, with alerts reviewed by people who understand the context, so honest mistakes are treated as such.
- Regular Check-ins: Maintain regular communication with remote employees to foster engagement and accountability.
- Legal Compliance: Ensure all security practices comply with local laws and regulations.
In Summary
The shift towards remote work in Australia and across the globe has created a new landscape of opportunities and risks. While the appeal of working from home continues to grow, organisations must stay alert to how it changes the way their data is handled.
By focusing on protecting sensitive data rather than watching people, fostering transparent communication and implementing appropriate technology, employers can navigate this environment effectively. Striking the right balance between security and trust is crucial to a productive and positive remote work culture. In the rapidly changing world of work, adaptability and awareness are key to managing the risks while reaping the rewards of this new frontier.
CEO & Co-Founder, ShadowSight
Who is Christopher McNaughton
Chris is a proficient problem solver with a strategic aptitude for anticipating and addressing potential business issues, particularly in areas such as Insider Threat, Data Governance, Digital Forensics, Workplace Investigations, and Cyber Security. He thrives on turning intricate challenges into opportunities for increased efficiency, offering pragmatic solutions derived from a practical and realistic approach.
Starting his career as a law enforcement Detective, Chris transitioned to multinational organisations where he specialised and excelled in Cyber Security, proving his authority in the field. Even under demanding circumstances, his commitment to delivering exceptional results remains unwavering, underpinned by his extraordinary ability to understand both cyber and business problems swiftly, along with a deep emphasis on active listening.