Employee vacations are an important part of maintaining a productive workforce, but they can also create temporary gaps in a company's cybersecurity defenses. Criminals may take advantage of absent employees, unfamiliar approval processes, reduced staffing, and workers connecting from locations outside the company's normal network.
Businesses should consider how employee travel and time away may affect account access, internal communication, device security, and incident response procedures.
Vacation Auto-Replies Can Reveal Useful Information
Automatic email replies are helpful, but they may also provide cybercriminals with valuable details. An out-of-office message may identify how long an employee will be unavailable, where they are traveling, and which coworker is handling their responsibilities.
This information could be used to create a convincing phishing or business email compromise attempt. For example, a criminal may impersonate the vacationing employee and contact the temporary replacement with an urgent request to transfer funds, purchase gift cards, change payment information, or provide confidential data.
Out-of-office messages should be kept brief and should avoid unnecessary details about travel dates, destinations, job responsibilities, or internal company procedures.
Temporary Responsibilities Can Create Approval Gaps
When an employee goes on vacation, financial approvals, vendor communications, payroll responsibilities, and account management tasks may be assigned to someone else. Employees filling in may not recognize an unusual request or may be unfamiliar with the company's normal verification process.
Before an employee leaves, the business should clearly document who has authority to approve payments, modify account information, access sensitive systems, and communicate with vendors. Employees should also understand that urgent requests should not bypass established security procedures.
Payment changes, wire transfers, payroll updates, and requests involving sensitive information should be independently verified through a known phone number or another trusted communication method. Crime Insurance may help address certain losses involving employee dishonesty, theft, fraud, forgery, or funds-transfer fraud, depending on the policy's terms, conditions, limits, and exclusions.
Traveling Employees May Use Unsecured Networks
Employees who work while traveling may connect to hotel, airport, conference center, coffee shop, or vacation rental Wi-Fi. Public networks may expose company information or make it easier for criminals to intercept data.
Whenever possible, employees should avoid accessing sensitive business systems through unsecured networks. Businesses may require the use of an approved virtual private network, mobile hotspot, or another secure connection.
Employees should also be cautious of networks with names that resemble legitimate hotel or airport Wi-Fi. A fraudulent network may be created specifically to capture passwords or other information.
Lost or Stolen Devices Can Expose Business Data
Laptops, tablets, and smartphones are more likely to be lost, stolen, or left unattended while employees are traveling. A device containing saved passwords, customer records, financial information, or access to company systems could create a serious cybersecurity incident.
Business devices should use strong passwords, automatic screen locks, current security updates, device encryption, and multifactor authentication. Remote tracking and remote-wipe capabilities may also help limit access when a device is missing.
Employees should be instructed to report a lost or stolen device immediately rather than waiting until they return from vacation.
Personal Devices May Create Additional Risks
An employee may decide to check email or complete a quick task from a personal phone, tablet, or computer. However, personal devices may not have the same security controls as company-owned equipment.
They may be shared with family members, use outdated software, contain unapproved applications, or lack adequate malware protection. Businesses should have a clear policy regarding whether employees may access company systems from personal devices and what security requirements must be followed.
Reduced Staffing Can Delay the Response to an Incident
Vacations can leave fewer employees available to identify and respond to suspicious activity. An alert may be sent to someone who is unavailable, or the person responsible for responding may not have a trained backup.
Businesses should make sure more than one person knows how to respond to a suspected cyber incident. The response plan should identify who needs to be contacted, how affected systems should be isolated, and how important records can be accessed.
Contact information for technology vendors, cybersecurity providers, insurance professionals, legal counsel, and other appropriate resources should be available to authorized employees.
Shared Passwords Should Not Be a Vacation Solution
Sharing a username and password may seem like the easiest way to provide temporary access, but it can make it difficult to track who completed an action. It may also leave the account exposed after the employee returns.
Each employee should have an individual account with access based on their responsibilities. Temporary permissions can be provided when needed and removed once the employee returns.
Multifactor authentication should also be used when available, particularly for email, financial accounts, remote access tools, and systems containing sensitive information.
Prepare Before Employees Leave
A pre-vacation cybersecurity process can help reduce confusion and prevent employees from creating unofficial workarounds. Before an employee leaves, the business may want to:
- Confirm who will handle essential responsibilities
- Review payment and account-change approval procedures
- Remove unnecessary temporary access
- Confirm that devices and software are updated
- Review expectations for working while traveling
- Verify that important files are stored in approved locations
- Identify a backup contact for security alerts
- Remind employees how to report suspicious activity or lost equipment
These steps can be included in the company's existing vacation approval or employee departure checklist.
Review Cybersecurity Procedures and Insurance
Cybersecurity prevention should involve employee training, secure technology, access controls, data backups, and a documented incident response plan. Businesses should regularly review these procedures, especially before periods when multiple employees may be away.
Cyber Liability Insurance may help with certain expenses associated with a covered cyber incident, depending on the policy\s terms, conditions, limits, and exclusions. Businesses should review their operations, data exposure, security practices, and insurance options with qualified professionals.
Employee vacations should not require a business to lower its security standards. Planning ahead can help employees enjoy their time away while reducing cybersecurity gaps for the company.
Contact CMS Insurance and Financial to discuss how your current business insurance program addresses cyber-related risks and changing business operations.
