Why the IT Environment of Your Remote Staff Matters
Having worked across two closely connected areas — BPO and staff leasing on one side, and Managed IT Services and cybersecurity on the other — I have had the opportunity to see outsourcing from both perspectives.
When wearing my MSP hat and working with clients, I regularly come across different outsourcing arrangements, including offshore teams, virtual assistants, remote workers and staff working from home.
One thing that continues to surprise me is how often organisations focus heavily on the person they are hiring, but pay very little attention to the IT environment in which that person will be working.
This issue exists in organisations of all sizes. However, it can become particularly concerning when a small number of offshore or remote employees are working from home with limited IT controls.
The Home Office Can Become the Weakest Link
Consider a typical home-based worker.
They may be using a personal computer rather than a company-managed device. The same computer might also be used by a husband, wife or children. Passwords may be synchronised with personal devices, browsers may contain personal accounts, and family members may have access to the same computer.
There may be no central device management, no business-grade antivirus, no ability to remotely lock or wipe the computer and no way for the organisation to determine whether the device remains secure.
The employee may be doing their best with the resources available to them. In many cases, I sympathise with the employee because the underlying problem is not necessarily their fault.
The responsibility ultimately sits with the organisation providing or managing the working environment.
Convenience Can Create Significant Cybersecurity Risk
Using unmanaged devices creates risks that organisations may not immediately see.
For example:
- A personal computer may be infected with malware.
- Family members may accidentally access company information.
- Business passwords may be saved in personal browsers.
- Passwords may synchronise to personal phones or tablets.
- Unauthorised applications may be installed.
- Security updates may not be applied.
- Antivirus protection may be inadequate.
- Business files may be downloaded to personal devices.
- USB devices may introduce malware.
- There may be no ability to remotely disable a compromised device.
- An employee may leave the organisation while company information remains on their personal computer.
None of these risks necessarily involve malicious behaviour by the employee.
Sometimes it is simply a consequence of poorly managed IT infrastructure.
The Problem Is Not “Offshore” — It Is “Unmanaged”
It is important to make a distinction here.
Offshore outsourcing itself is not inherently insecure.
A properly managed offshore team can operate within a highly secure environment, with managed computers, appropriate access controls, MFA, endpoint protection, secure networks, logging and centralised IT management.
The real concern is unmanaged access to company systems and information.
Whether the employee is sitting in Sydney, Melbourne, Colombo, Manila or working from another location, the cybersecurity principles remain essentially the same.
If a person has access to your Microsoft 365 environment, CRM, accounting system, customer database, documents or other business systems, the device they use to access those systems becomes an important part of your security perimeter.
What Should a Responsible Outsourcing Partner Provide?
When selecting an offshore staffing or virtual assistance partner, companies should look beyond recruitment, payroll and the hourly rate.
A responsible provider should be able to demonstrate how it protects the IT environment used by its staff.
Depending on the nature of the work, this may include:
Company-Managed Devices
Staff should ideally work from company-provided and centrally managed computers rather than unmanaged personal devices.
Endpoint Protection
Computers should have appropriate antivirus and endpoint security protection, with security updates and monitoring properly managed.
Device Management
The organisation should have the ability to manage devices centrally, enforce security policies and control access.
Remote Lock and Wipe
If a device is lost, stolen or compromised, there should be a mechanism to lock it or, where appropriate, remotely wipe company information.
Strong Authentication
MFA and appropriate password policies should be implemented, particularly for systems containing sensitive business information.
Controlled Access
Employees should have access only to the systems and information required to perform their role.
Secure Offboarding
When an employee leaves, access should be removed promptly and company devices, accounts and information should be recovered or secured.
Don’t Forget Personal Phones
One area that is frequently overlooked is the employee’s personal mobile phone.
Business passwords, authentication applications, email accounts and browser credentials can sometimes end up on personal devices.
For example, a password saved on a business computer could potentially synchronise through a personal browser account to another computer or mobile device.
This creates a problem that may be invisible to the employer.
The organisation may believe that its data is protected because the employee is using a company application, while credentials or business information may actually exist across several personal devices.
Cybersecurity Should Be Part of the Outsourcing Decision
When selecting an outsourcing or virtual assistance provider, businesses often compare:
- hourly rates;
- experience;
- English proficiency;
- availability;
- staffing levels; and
- service quality.
These are all important.
However, IT security should be part of the assessment as well.
Ask potential providers:
- Are staff using company-managed computers?
- Are personal computers permitted?
- Is endpoint protection installed and centrally managed?
- Are devices encrypted?
- Can devices be remotely locked or wiped?
- Is MFA enforced?
- How is access granted and removed?
- How are passwords managed?
- What happens when an employee leaves?
- Who provides IT support?
- How are security incidents handled?
- Can the provider demonstrate its security controls?
These questions can reveal a great deal about the maturity of an outsourcing provider.
At Offshore Assist, IT Is Not an Afterthought
At Offshore Assist, we approach staff leasing and virtual assistance with a strong focus on the IT environment.
Our experience in both outsourcing and Managed IT Services has reinforced an important principle:
Providing a person to perform a job is only part of providing a secure outsourcing solution. The technology environment in which that person works matters just as much.
We pay particular attention to areas such as managed devices, endpoint protection, access control, authentication and the ability to secure devices when circumstances change.
The objective is not simply to provide offshore staff.
It is to provide businesses with an outsourcing environment where people, technology and security work together.
The Bottom Line
Your offshore or remote employee may be trustworthy. Your outsourcing partner may also be trustworthy.
But trust alone is not a cybersecurity strategy.
A business should not rely on an employee’s personal computer, personal phone, family members or home network to protect access to valuable company information.
The right outsourcing partner should take responsibility for creating an appropriate and secure working environment.
When you outsource your people, don’t outsource your cybersecurity responsibility.
Choose a partner that understands both sides of the equation — people and technology — and has the capability to protect your business while your remote and offshore teams get on with their work.