# Cyber Security Awareness and Education Support for Home and Hybrid Workers

Fayez Alotaibi, Steven Furnell, Ying He

► To cite this version:

Fayez Alotaibi, Steven Furnell, Ying He. Cyber Security Awareness and Education Support for Home and Hybrid Workers. 17th International Symposium on Human Aspects of Information Security and Assurance (HAISA), Jul 2023, Kent, United Kingdom. pp.64-75, 10.1007/978-3-031-38530-8_6 hal-05462090

HAL Id: hal-05462090

https://inria.hal.science/hal-05462090v1

Submitted on 16 Jan 2026

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons CC BY 4.0 - Attribution - International License
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
# Cyber Security Awareness and Education Support for Home and Hybrid Workers

Fayez Alotaibi¹,²(✉), Steven Furnell¹, and Ying He¹

¹ School of Computer Science, University of Nottingham, Nottingham, UK
{Fayez.Alotaibi,Steven.Furnell,Ying.He}@nottingham.ac.uk

² College of Science and Humanities, Shaqra University, Al-Dawadmi, Saudi Arabia

**Abstract.** Home and hybrid working is now increasingly commonplace in many organizations, particularly in the wake of the enforced home working faced by many during the COVID-19 pandemic. However, while many organizations and workers have now embraced the opportunity, questions remain over whether security practices in the home-based and hybrid context are as robust as those within the traditional workplace. The pandemic highlighted that many organizations were unprepared in terms of related security policies and procedures, and today many still lack specific attention toward these aspects even though home-working itself has become a business norm. One of the potential challenges facing organizations seeking to understand what they should do is the varied range of advice and related sources that can be found, which can lead to relevant issues being overlooked or omitted if they were not covered in the chosen guidance. This paper seeks to examine and evidence this challenge. It does so by analyzing a series of guidance resources from commercial, governmental, and professional body sources. From these, a set of eight thematic control areas are identified, and the sources themselves are then evaluated against this new, consolidated reference point to see how closely they each match. The findings reveal that all of the consulting sources fall significantly short of being able to be considered comprehensive in their coverage of the relevant topics and the level of detail. This in turn highlights the importance of organizations adopting this more holistic view and ensuring that different types of organizations are consulted before determining the necessary practices and awareness needs of their home-based and hybrid workers.

**Keywords:** Employee awareness · Home working · Hybrid working · Remote working

## 1 Introduction

Many organizations are now seeing an increasing proportion of home-based and hybrid working, much of which is due to a continuation of practices adopted during the COVID-19 pandemic [1]. However, not all employees are familiar with the home-working environment, which may cause an increase in cyber security risks [2, 3]. Prior studies have found that many remote workers exhibited aspects of bad security behaviour during the
pandemic, which has made their organization vulnerable to cyber-attacks. For example, 67% of these employees admit that they have not followed security policies in order to be more productive, by sending work documents to their personal email, sharing passwords, and installing malicious apps [4]. In response to this situation, various sources have published guidelines to support businesses in providing a secured Work from Home (WFH) environment for remote workers. However, there is lack of agreement on what such guidance should cover, and therefore the nature and level of advice can still be inconsistent. In order to investigate the situation, this paper aims to identify the cyber security issues that relate to remote workers, and then to review and evaluate the extent to which these issues have been covered by existing guidelines/advice published by IS commercial organizations and official bodies. The findings suggest that even though home/hybrid workers are identified as a relevant audience to address, the nature of support and guidance they receive can still be significantly variable depending upon the source of reference.

## 2 Cyber Security Issues for Home/hybrid Workers

Working from home, whether fully remote or in a hybrid combination with working in the office, is now an increasing trend in the post-pandemic world. While the notion of home-based, hybrid, and remote work are not synonyms [5], all involve elements of working outside the office and in the employee's home environment. It is therefore important to ensuring that expected security practices can translate and transfer into this context. However, evidence suggests that it is not unusual for issues to emerge. For example:

* 67% of remote employees admit that they have tried not to follow security policies to be more productive by sending work documents to their email, sharing passwords, and installing malicious apps [4].

* 23% of remote workers reuse their passwords across work and personal accounts such as social media accounts and online banking [6].

* around half of US employees believe that public Wi-Fi can be trusted to access their organization's system [7], whereas 56% of IT security leaders believe that home and public Wi-Fi is one of the biggest security challenges organizations should consider [8];

* 59% of IT decision makers consider user awareness as one of the biggest security challenges [8] and 58% of organizations said most employees do not follow their information security awareness policy [10].

* 61% of organizations believe that remote workers are more likely to use the same device for work and personal activities [6], and 14% of UK workers do not lock their smart devices after they complete their organization tasks [9].

According to a report by Tessian [11], 56% of IT team leaders believed homeworkers had picked up bad information security practices since they had been working remotely. Moreover, 54% were concerned that some employees would bring infected devices, and the report also found that 40% of remote workers were planning to bring their own devices to the workplace. Moreover, 40% of young homeworkers admitted that they had
made information security mistakes while working from home that nobody would know about. In addition, 29% of these employees were afraid to notify the IT team that they had made information security mistakes.

Having established that there are problems to be addressed in the home/hybrid working contexts, it is relevant to consider the extent to which related guidance is *available*, as well as the degree to which is it *comprehensive* and *consistent* in the coverage that it provides. These aspects are examined in the sections that follow.

## 3 Assessing Current Security Guidance for Hybrid Workers

In order to assess the level of support that has been made available to support and guide organizations on protecting their home and hybrid workers, this study has surveyed a series of 20 distinct resources, drawn from a range of sources. All are provided based on offering relevant guidance but can prove to have differing topic focus and levels of coverage. The resources were broadly categorized as being drawn from two main types of sources – commercial organizations (typically originating from the cyber security area and/or more general IT domain) and official/professional organizations (encompassing governmental sources from different countries, and professional bodies and membership organizations linked to cyber security). These are more specifically described below, and the sources used in each case are also listed in Tables 1 and 2:

* **Commercial organization:** This category refers to companies in the cyber security or wider IT sectors, who sell security products and services and have published related advice in the context of home/hybrid working. Note that the eight organizations sampled here are intended to be a representative set rather than an comprehensive catalogue.

<table><caption>**Table 1.** Guidance from Commercial Organizations</caption><thead><tr><td>Source</td><td>Guidance Title</td><td>Ref.</td></tr></thead><tbody><tr><td>Cisco</td><td>“Five tips to enable a remote workforce securely”</td><td>[12]</td></tr><tr><td>CMA (Cyber Management Alliance)</td><td>“Best Cybersecurity Tips for Remote Workers”</td><td>[13]</td></tr><tr><td>ESET</td><td>“Tips for cybersecurity when working from home”</td><td>[14]</td></tr><tr><td>HP (Hewlett Packard)</td><td>“HP Remote Worker Cybersecurity Best Practices”</td><td>[15]</td></tr><tr><td>Kaspersky</td><td>“Cyber Security Risks: Best Practices for Working from Home and Remotely”</td><td>[16]</td></tr><tr><td>McAfee</td><td>“How to Stay Connected and Protected in a Remote Work Environment”</td><td>[17]</td></tr><tr><td>Microsoft</td><td>“11 security tips to help stay safe in the COVID-19”</td><td>[18]</td></tr><tr><td>Samsung</td><td>“8 tips for securing remote workforces”</td><td>[19]</td></tr></tbody></table>
* **Official and Professional Sources:** These are organizations that provide security guidance from the perspective of a particular country, region, or professional sector. There are many examples of these resources in many different countries, and as with the commercial organizations the list aims to be illustrative rather than exhaustive.

<table><caption>**Table 2.** Guidance from Official Sources and Professional Bodies</caption><thead><tr><td>Source</td><td>Guidance Title</td><td>Ref.</td></tr></thead><tbody><tr><td>ACSC (Australian Cyber Security Centre)</td><td>"Cyber security tips when working from home"</td><td>[20]</td></tr><tr><td>CCCS (Canadian Centre for Cyber Security)</td><td>"Security tips for organizations with remote workers"</td><td>[21]</td></tr><tr><td>CIS (Center for Internet Security)</td><td>"5 Online Safety Tips for Work"</td><td>[22]</td></tr><tr><td>CISA (Cybersecurity & Infrastructure Security Agency)</td><td>"Telework best practices"</td><td>[23]</td></tr><tr><td>CPNI (Centre for the Protection of National Infrastructure)</td><td>"Remote Working, including Working from Home, during of COVID-19"</td><td>[24]</td></tr><tr><td>ENISA (European Union Agency for Cybersecurity)</td><td>"Tips for cybersecurity when working from home"</td><td>[25]</td></tr><tr><td>FBI (Federal Bureau of Investigation)</td><td>"Cybersecurity Awareness Month: Steps to Protect Yourself"</td><td>[26]</td></tr><tr><td>IIA (Institute of Internal Auditors)</td><td>"Security in a Work-From-Home Environment"</td><td>[27]</td></tr><tr><td>NCSC (UK National Cyber Security Centre)</td><td>"Home working: preparing your organization and staff"</td><td>[28]</td></tr><tr><td>NIST (US National Institute of Standards and Technology)</td><td>"Telework security overview & tip guide"</td><td>[29]</td></tr><tr><td>NSA (National Security Agency)</td><td>"Best Practices for Keeping Your Home Network Secure"</td><td>[30]</td></tr><tr><td>SANS Institute</td><td>"Top 5 Tips for Working from Home Securely"</td><td>[31]</td></tr></tbody></table>

It should be noted that the sample does not purport to be an exhaustive survey of available guidance. However, it represents a sufficient volume and diversity of sources from which to form a credible impression of the type of material that is available from some key sources to then guide organizations who seek such advice.

As was anticipated, it became clear even from casual inspection that the sources varied in terms of both topic coverage and the depth of treatment being given. As such, the use of any individual source in isolation would give organizations and their employees on a partial view of the issues that may be relevant to them in a home/hybrid working context. With this in mind, it was considered relevant to determine what a consolidated set of guidance would look like, and then to compare each of the sources against this reference point to see the extent of their coverage.
# 4 Consolidating the Guidance for Home and Hybrid Workers

Having identified a range of relevant sources, their content was then analyzed based on cyber security issues that were discussed in Sect. 2 in order to identify the key thematic areas addressed across the range of guidance sources. This thematic analysis led to the identification of the following eight topics, which then serve to represent the core set of areas that home and hybrid workers need to be guided upon or supported with (noting that the abbreviations align with the representation used later in Table 3):

* Backup and Recovery (B&R)

* Device Care (DC)

* Guidelines and Policies (G&P)

* Incident Management (IM)

* Network Security (NS)

* Passwords & Authentication (P&A)

* Training and Education (T&E)

* Updating Software (U)

The topics themselves are outlined in the sub-sections that follow, with each giving an indication of what the topic is, and some examples of what some different sources had to say about them.

## 4.1 Backup and Recovery

Backup and recovery can be introduced as step that employees should follow to save or recover their data in and from the cloud or servers of their organization. HP [15] has recommended organization to test their system backup and make sure their employees using this system to back up their data. However they have not illustrated that if the employees need to know why it is important to back up their data using their organization back up system. Kaspersky [16] have mentioned that organizations should provide cloud or server storage for their employees and encourage their employees to back up their data regularly to avoid losing that data. IIA [27], recommended that organization should check if backup and recovery have been established at home devices. They should indicate where the employees should back up their data and why this is important. ESET has mentioned that remote workers should always turn on automatic backup to save their data under any circumstances [14].

## 4.2 Device Care

This area addresses steps that employees should follow to protect their devices from unauthorized use. HP [15], CMA [13] and McAfee [17] have presented that home workers should only use a specific device for work and no other activities such as watching Netflix or sharing them with family members. IIA [27] and NIST [29] recommend that user should lock their screen immediately after finishing their work and enable ID features to keep their devices away from unauthorized usage.

NCSC [28], CISA [23] and ENISA [25] suggested that the organization encourage staff to activate the screen lock feature, allowing users to protect themselves from unwanted use, also they should not share their work device with family and use it for personal activities. Additionally, the CCCS recommended that employees should not leave their devices open while they are away and report to their organization if their devices have been stolen or lost [21].
## 4.3 Guidelines and Policies

This section refers to the provision of information regarding the areas of security that employees need to follow. Hewlett Packard (HP) [15] has only recommend organization to create security policy for saving data. The CMA [13] guide highlights the importance of security policy and suggests seven areas that must be included: Compliance requirements, Information systems security, Data protection, Remote access control, Backup and media storage, Information disposal, and Alternative work sites. Kaspersky [16] have mentioned that organizations should provide cyber security policies for their employees to illustrate which good practices they should follow. They also provide an example of security policy, but this does not cover some areas such as network security and different work environments. Moreover, Microsoft [18] suggested that remote workers should follow their organization's security policies. They also present some extra tips that remote workers should follow, but they do not mention the important of following these policies.

The UK NCSC [28] and ENISA [25] have suggested that organizations must create a security policy for their employers in terms of Apps instillation and incident response. Also, the Centre for the Protection of National Infrastructure (CPNI) indicates that “organizations should update their security policies based on the new measurement related to information security and deliver them to their employees” [24].

## 4.4 Incident Management

This area can be introduced as plane that was created by the organization in term of security incidents. For instance, ACSC [20], and CMA [13] suggested that organizations should have a plan for incident activity and respond based on these incidents. It is important to have security incidents plan but do the employees need to know about it they should make it clear that organization should provide security incident plan, teach users how to respond and whom the need to contact. Moreover, NIST [29] and CPNI [24] have illustrated that the importance of security incident plan, how users can report incident, when the should race issues, and to whom. Furthermore, ENISA [25] recommended that organizations should provide or create a policy for incident response and informed their employees about it. Additionally, NCSC [28] only mentioned that organizations teach their employees how to report security concerns. CCCS [21] mentioned that organizations teach their employees how to report security concerns and to whom. HP [15] suggested that organizations should have a plan for incident activity, this plan should be updated regularly and it should include a contact number of IT teams.

## 4.5 Network Security

This considers steps that users should take to protect their communications when working at home or remotely. For this area, Kaspersky [16], HP [15], and ACSC [20] illustrated that remote workers should secure their home Wi-Fi using a strong password, updating network device, and choosing secure protocol. Also, if users decide to use public networks then they should use VPN for data encryption. Meanwhile, other sources (such as Samsung [18], NIST [29], and Microsoft [18]) mentioned most of the points but omitted
the guidance on public Wi-Fi. CISA [23] and NSA [30] recommend that remote workers should not use any unprotected network to access their organization system and should always use trusted Wi-Fi for work purposes. However, they have not mentioned how users should protect their home network.

## 4.6 Passwords and Authentication

This addresses the step that remote workers should follow to protect their accounts, when it should be changed, and tools that can be used to ensure password security. In this area, HP [15] has recommended that employees have to use strong passwords for their devices and change it immediately if they note that their passwords have been known. They should explained hoe the strong password look like and why it is important to change their passwords. CMA [13], Kaspersky [16], SANS [31], ACSC [21] and NCSC [28] all explain the important of using a strong passwords, also the illustrated the differences between strong passwords and weak passwords, followed by examples. Moreover, they encourage remote workers to not used the same password across different devices or accounts. ESET [14] recommended that employees should ensure that their passwords are strong enough. However, they have not described *how* the password should be created to satisfy this expectation. NIST [29] also explained that, if users decide to use their own devices, they should consider making a strong password enabling ID features to protect against unauthorized access. However, they have not explained how to create a strong password and when users should have to change their passwords. CCCS [21] recommends that remote workers have to pay attention when they enter their passwords to avoid them being known by an unexpected person.

## 4.7 Training and Education

Training and education can be illustrated as any programs provided by organization in order to increase their employees' security awareness. Samsung [19] has mentioned that "organizations should provide cyber security training programs because human mistakes are the biggest risk factor for security: this program should include cyber security threats and security practice". They have also recommended that organizations need to make sure that their training programs are up to date. However, they have not mentioned which best practice is as well as there are some topics have not covered such as incident management. Kaspersky [16] presents many questions that organization should consider when they are preparing to switch their employees to remote working, one of these questions is "Does the organizations provide cyber security awareness program for their employees?". However, they do not mention that what the organization needs to do after the question, and what security topics need to be covered if they have training program. CMA says that "teaching employees how to detect cyber security threats can be helpful for them to avoid these threats and not become victims" [13]. However cyber threats not only the topics employees need to know about it there are more topics need to be presented to them such as data storage and secure network. CPNI also says that "education and training must be provided for employees to understand the situation of home working and practice as it is required", and have suggested some methods that organization can be consider (e.g. web based and video methods). However, they have
not mentioned which areas should be included in this training program. Finally, ENISA [14] indicates that regular cyber security training and education for employees can help them deal with cyber threats.

## 4.8 Updating Software

This area relates to installing new updates and patches released by suppliers. CMA [13] says that home/remote workers should update their software, apps, and OS; updating software and antivirus program can provide a high level of protection for end-users. Also, they have illustrated the importance of updating OS and suggested that the best way to ensure updating is to enable auto-update. Moreover, ESET [14] illustrates how is it important for employees to make sure that they use the latest operating system version. Also, they gave an example of an operating system that is no longer supported, such as Windows 7.

SANS [31] has mentioned the importance of updating and how it can be useful to protect employees' devices. They have illustrated that users should ensure that their devices, programs, and Apps are running the last software version to secure their devices. Also, they have recommended a list of devices that are connected to the same network. ENISA [25] recommended that organization should provide their employees with up-to-date software and applications, but they have not mentioned when and how should employees keep their devices up to date automatically. Moreover, the Federal Bureau of Investigation (FPI) [26] has recommended that remote users should make sure to update their OS and App as soon as these updates are required and tune on the automatic update feature. ACSC [20] recommended that remote workers should always turn on the automatic update. Also, they provide a guide that employees can follow in order to setup automatic update in different operating systems.

# 5 Re-assessing Coverage of the Existing Sources

In this section, each of the original resources are assessed to determine the extent to which they provide coverage of the eight target topic areas. Beginning first with a top-level view of the extent to which each topic was represented across the set of sources, Fig. 1 shows the differing levels of representation in each case. As can be seen, the issue of Network Security appears to be the most well-represented, but even this is not uniformly present in all cases. Meanwhile, backup and recovery gets the most limited degree of attention, and was only emphasized significantly in the guidance materials from the commercial sources.

Of course, the fact that a topic area is represented in different sources does not necessarily mean that they afford it the same level of attention. With this in mind, Table 3 presents a deeper level of assessment, looking at the level of coverage of each theme. With the source being rated Low (L), medium (M) and high (H) accordingly. The assessment is made based upon assessing various underlying aspects that should be included for each topic:

* Explanation of the importance of the issue.

* When users and organizations should consider the issue.
<figure><img src="image_3.png" /><figcaption>Fig. 1. Coverage of Topics in Different Sources</figcaption></figure>

* Where users and organizations should consider the issue.

* Security controls that help to address the issue.

* What users should do regarding the issues.

The source needs to cover most/all the above aspects for a given topic to score High. If it covers around half of the aspects it gets a Medium rating, and a notably lesser level of coverage is scored Low. The overall result of the assessment is shown in Table 3. When viewed on a source-by-source basis, what clearly emerges is that they are extremely variable in terms of both the topics they cover and the level to which they cover them.

As illustrated by Fig. 1 and Table 3, organizations must look at multiple sources if they are to determine a comprehensive view of best practice for their employees. It can also be seen that the topics do not receive a uniform level of coverage and none of them are covered in all of the sources. Moreover, none of these resources have covered all of these topics. Additionally, the breadth of topic coverage across some of the sources is extremely limited (e.g. the Cisco material only covers two of the topics). Also, out of 20 sources there are only six sources that cover backup and recovery. This issue should have more attention, especially when it comes to the security of the organization's data, users need to know when and where they should back up their data if it is their responsibility to do so.

In addition to providing their employees with the guidance, organizations will also need to consider if their users will be in a position to understand the advice and act upon it. Telling people what to do is not enough, they need to know how to do it. For example, when asking users to keep their devices up to date, they need to know why and how to do so. Similarly, when the sources recommend using VPN or MFA, will all users have a sufficient level of knowledge of what these features are and how to use them? Linked to the issue of providing support, another potentially missing element is that the guidelines have not given much focus that much to the communications between hybrid workers and the IT team. According to Tessian [11], 29% of these employees were afraid to notify the IT team that they had made information security mistakes. Therefore, organizations
<table><caption>**Table 3.** Comparison of topic coverage in different sources</caption><thead><tr><th>Sources</th><th></th><th>B&R</th><th>DC</th><th>G&P</th><th>IM</th><th>NS</th><th>P&A</th><th>T&E</th><th>U</th></tr></thead><tbody><tr><td rowspan="7">Commercial Official/Professional</td><td>Cisco [12]</td><td>-</td><td>-</td><td>-</td><td>-</td><td>M</td><td>-</td><td>H</td><td>-</td></tr><tr><td>CMA [13]</td><td>-</td><td>H</td><td>H</td><td>L</td><td>L</td><td>H</td><td>L</td><td>H</td></tr><tr><td>ESET [14]</td><td>H</td><td>-</td><td>M</td><td>-</td><td>M</td><td>M</td><td>-</td><td>H</td></tr><tr><td>HP [15]</td><td>H</td><td>M</td><td>L</td><td>M</td><td>H</td><td>L</td><td>-</td><td>L</td></tr><tr><td>Kaspersky [16]</td><td>H</td><td>H</td><td>L</td><td>-</td><td>H</td><td>H</td><td>M</td><td>L</td></tr><tr><td>McAfee [17]</td><td>-</td><td>M</td><td>L</td><td>-</td><td>M</td><td>-</td><td>-</td><td>-</td></tr><tr><td>Microsoft [18]</td><td>-</td><td>-</td><td>L</td><td>-</td><td>M</td><td>H</td><td>L</td><td>M</td></tr><tr><td rowspan="11">Official/Professional</td><td>Samsung [19]</td><td>-</td><td>L</td><td>-</td><td>-</td><td>M</td><td>L</td><td>L</td><td>L</td></tr><tr><td>ACSC [20]</td><td>-</td><td>H</td><td>-</td><td>-</td><td>H</td><td>H</td><td>L</td><td>H</td></tr><tr><td>CCCS [21]</td><td>L</td><td>H</td><td>L</td><td>L</td><td>M</td><td>-</td><td>L</td><td>H</td></tr><tr><td>CIS [22]</td><td>-</td><td>L</td><td>-</td><td>-</td><td>L</td><td>L</td><td>-</td><td>-</td></tr><tr><td>CISA [23]</td><td>L</td><td>-</td><td>M</td><td>L</td><td>H</td><td>L</td><td>H</td><td>L</td></tr><tr><td>CPNI [24]</td><td>-</td><td>-</td><td>H</td><td>H</td><td>-</td><td>-</td><td>M</td><td>-</td></tr><tr><td>ENISA [25]</td><td>-</td><td>M</td><td>-</td><td>M</td><td>M</td><td>-</td><td>-</td><td>M</td></tr><tr><td>FBI [26]</td><td>-</td><td>-</td><td>-</td><td>-</td><td>M</td><td>H</td><td>-</td><td>M</td></tr><tr><td>IIA [27]</td><td>L</td><td>H</td><td>L</td><td>-</td><td>M</td><td>M</td><td>H</td><td>-</td></tr><tr><td>NCSC [28]</td><td>-</td><td>H</td><td>H</td><td>M</td><td>L</td><td>H</td><td>M</td><td>M</td></tr><tr><td>NIST [29]</td><td>-</td><td>H</td><td>H</td><td>H</td><td>M</td><td>H</td><td>-</td><td>H</td></tr><tr><td>NSA [30]</td><td>-</td><td>-</td><td>-</td><td>-</td><td>H</td><td>H</td><td>M</td><td>M</td></tr><tr><td>SANS [31]</td><td>-</td><td>-</td><td>-</td><td>-</td><td>H</td><td>H</td><td>H</td><td>H</td></tr></tbody></table>

must find a solution to enable a dialogue between home and hybrid employees and IT support to ensure their work environment is secured.

## 6 Conclusions

In conclusion, this paper has identified a series of cyber security issues relevant to remote workers based upon the assessment of a range of guidance sources. It reviewed and evaluated if these issues have been covered enough the existing guidelines/advice published by commercial organizations and official bodies. It is clear from the findings that the issues do not receive a uniform level of coverage, and none of them are covered in all of the sources.

In view of the findings, it is clear that, as things stand, organizations must look at multiple sources to establish a comprehensive view of best practice for their employees. In this context, there is a good chance that organizations will instead select one source and then potentially overlook and omit something of relevance. What would be preferable is for them to have a clearer view of what their home and hybrid workers need to know in
terms of security, and to then have access to appropriate and comprehensive guidance that is suited to their needs. This aspect will be a focus of the authors' future research, with a view to enabling organizations to profile their home and hybrid operations and then establish suitably tailored guidance accordingly.

## References

1. Borkovich, D., Skovira, R.: Working from home: cybersecurity in the age of Covid-19. Issues Inf. Syst. **21**(4), 234–246 (2020)

2. Curran, K.: Cyber security and the remote workforce. Comput. Fraud Secur. **2020**(6), 11–12 (2020)

3. Furnell, S., Shah, J.N.: Home working and cyber security – an outbreak of unpreparedness? Comput. Fraud Secur. (August 2020'), 6–12 (2020)

4. Cyber Ark, 2021. CyberArk State of Remote Work Study: Poor Security Habits Raise Questions About the Future of Remote Work. CyberArk. https://www.cyberark.com/press/cyberark-state-of-remote-work-study-poor-security-habits-raise-questions-about-the-future-of-remote-work/. Accessed 15 Mar 2023

5. Webex. 2023. "What is hybrid work?" https://www.webex.com/what-is-hybrid-work.html. Accessed 14 Mar 2023

6. Schulze, H.: The State of Remote Work Security. Cybersecurity Insiders (2021). https://www.archtis.com/wp-content/uploads/2021/04/2021-Remote-Workforce-Security-Report-archTIS_Final.pdf. Accessed 9 Apr 2023

7. O'Driscoll, A.: Statistics and Facts: Human Error in Cybersecurity. Comparitech (2022). https://www.comparitech.com/blog/information-security/human-error-cybersecurity-stats/. Accessed 11 Mar 2023

8. Schulze, H.: Remote Work From Home Cybersecurity Report. Cybersecurity Insiders (2020). https://rs.ivanti.com/ivi/2537/682a478cc54f.pdf. Accessed 22 Mar 2023

9. Proofpoint, 2020. User Risk Report. Proofpoint. https://www.proofpoint.com/sites/default/files/2020-05/gtd-pfpt-us-tr-user-risk-report-2020_0.pdf. Accessed 10 Mar 2023

10. Netwrix, 2020. 2020 Cyber Threats Report. Netwrix. https://www.netwrix.com/download/collaterals/2020_Cyber_Threats_Report.pdf. Accessed 19 Mar 2023

11. Tessian. (2021). Security Behaviors Report. Tessian. https://www.tessian.com/resources/back-to-work-cybersecurity-behaviors-report/. Accessed 9 Apr 2023

12. Cisco, 2020. Five tips to enable a remote workforce securely. Cisco. https://www.cisco.com/c/dam/global/en_uk/products/collateral/security/secure-remote-worker-solution/srw-5tips-en.pdf. Accessed 17 Mar 2023

13. CMA, 2020. Best Cybersecurity Tips for Remote Workers. Cm-alliance https://www.cm-alliance.com/cybersecurity-blog/best-cybersecurity-tips-for-remote-workers. Accessed 18 Mar 2023

14. ESET, 2020. Working from home: Tips and Advice. https://www.eset.com/uk/working-from-home-tips/. Accessed 15 Mar 2023

15. HP, 2020. HP Remote Worker Cybersecurity Best Practices. Hewlett Packard. https://h20195.www2.hp.com/v2/getpdf.aspx/4AA7-7194ENW.pdf. Accessed 24 Feb 2023

16. Kaspersky, 2022. Cyber Security Risks: Best Practices for Working from Home and Remotely. Kaspersky. https://www.kaspersky.co.uk/resource-center/threats/remote-working-how-to-stay-safe. Accessed 24 Feb 2023

17. McAfee, 2021. How to Stay Connected and Protected in a Remote Work Environment | McAfee Blog. McAfee Blog. https://www.mcafee.com/blogs/tips-tricks/how-to-stay-connected-and-protected-in-a-remote-work-environment. Accessed 28 Feb 2023
18. Microsoft, 2020. 11 security tips to help stay safe in the COVID-19. Microsoft. https://www.microsoft.com/security/blog/2020/06/09/11-security-tips-stay-safe-covid-19-era/. Accessed 26 Feb 2023

19. Samsung, 2020. 8 tips for securing remote workforces. Samsung Business Insights Sep 25. https://insights.samsung.com/2020/09/25/8-tips-for-securing-remote-workforces. Accessed 23 Feb 2023

20. ACSC, 2020. COVID-19: Cyber security tips when working from home. Australian Cyber Security Centre. https://www.cyber.gov.au/acsc/view-all-content/advisories/covid-19-cyber-security-tips-when-working-home. Accessed 21 Feb 2023

21. CCCS, 2020. Security tips for organizations with remote workers (ITSAP.10.016) - Canadian Centre for Cyber Security. Canadian Centre for Cyber Security. https://cyber.gc.ca/en/gui dance/telework-security-issues-itsap10016. Accessed 24 Mar 2023

22. CIS, 2020. 5 Online Safety Tips for Work. CIS. https://www.cisecurity.org/insights/blog/5-online-safety-tips. Accessed 13 Mar 2023

23. CISA, 2020. Telework Essentials Toolkit. Cybersecurity & Infrastructure Secur ity Agency. https://www.cisa.gov/sites/default/files/publications/20-02019b%2520-%252 0Telework_Essentials-08272020-508v2.pdf. Accessed 23 Mar 2023

24. CPNI, 2021. Remote Working, including Working from Home, during of COVID-19. Centre for the Protection of National Infrastructure, December 2021. https://www.npsa.gov.uk/res ources/remote-working-during-covid-19. Accessed 29 Mar 2023

25. ENISA, 2020. Tips for cybersecurity when working from home. European Agency for Cyber Security, 24 March 2020. https://www.enisa.europa.eu/tips-for-cybersecurity-when-working- from-home. Accessed 10 Mar 2023

26. FBI, 2021. Cybersecurity Awareness Month: Steps to Protect Yourself | Federal Bureau of Investigation. Federal Bureau of Investigation. https://www.fbi.gov/video-repository/por tland-cyber-home-102121.mp4/view. Accessed 4 Mar 2023

27. IIA, 2020. Security in a Work-From-Home Environment. Global Knowledge Brief, Institute of Internal Auditors, October 2020. https://iia.no/wp-content/uploads/2021/01/2020-GKB- Security-in-a-Work-From-Home-Environment.pdf. Accessed 20 Mar 2023

28. NCSC, 2020. Home working: preparing your organisation and staff. National Cyber Security Centre. https://www.ncsc.gov.uk/guidance/home-working. Accessed 8 Mar 2023

29. NIST, 2020. Telework security overview & tip guide. US National Institute of Standards and Technology. https://www.nist.gov/document/telework-overview-and-tips-pdf. Accessed 19 Mar 2023

30. NSA, 2018. Best Practices for Securing Your Home Network. Cybersecurity Information Sheet, National Security Agency, September 2018. https://www.nsa.gov/portals/75/docume nts/what-we-do/cybersecurity/professional-resources/csi-best-practices-for-keeping-home- network-secure.pdf?v=1. Accessed 31 Mar 2023

31. SANS, 2020. Top 5 Tips for Working from Home Securely. SANS Institute. https://www.sans.org/blog/top-5-tips-for-working-from-home-securely/. Accessed 13 Mar 2023