Virtual Assistants (VAs) provide invaluable support to businesses and executives around the world. However, many VA service providers work from home offices, or are primarily remote and digital, thus exposing them and their clients to several cyber security risks. Cybercrime has surged since the pandemic’s widespread work-from-home recommendations, and many home office setups are not equipped with sophisticated, enterprise-grade network security.
As such, if VAs do not ensure that proper security and data protection safeguards are in place, they could be exposing themselves and their clients to potentially huge financially-motivated cyber attacks, and, if successful, irreparable reputational damage.
This short guide outlines some of the most prevalent Virtual Assistant security risks to be aware of, and the steps they can take to mitigate them.
Common threats targeting VAs and their clients
It’s fairly common to see small and medium businesses hire VAs for administrative functions like diary management, taking bookings, handling customer service duties, and so on. It’s worth knowing that small businesses are prolific targets for cybercriminals (38% identified a cyber attack in 2022, 82% of which were phishing attempts) and, according to Markel UK’s survey, 51% of businesses this size have reported at least one cyber security breach in their lifetime.
It’s highly likely that VAs will typically have access to sensitive data, financial information, accounts, CRM systems, websites, and other important business assets, thus looping them into the firing line for a hacker seeking to exploit vulnerabilities for financial gain or disruption.
Some of the most common threats VAs and their clients face include:
- Data breaches: When client information, intellectual property or personally identifiable data is accessed unlawfully or stolen. Breaches can occur via a network intrusion or unsecured devices and can result in damaging legal and financial consequences for companies, particularly those in heavily-regulated industries.
- Malware and ransomware: Cybercriminals can covertly install malicious software either through file downloads or links. Malware frequently disrupts system processes and locks users out of their equipment, with ransomware specifically restricting access until a ransom is paid.
- Phishing: Criminals can disguise themselves as legitimate users, colleagues or suppliers and send seemingly innocuous messages asking for login credentials or file access. These fraudulent messages often contain dangerous file attachments or links that install malware on the unsuspecting user’s system, thus threatening privacy and security.
- Distributed denial-of-service (DDoS) attacks: Systems and networks can be overloaded with excessive traffic that’s coming from automated bots, and the slowdown in service coverage makes resources often inaccessible to users. DDoS attacks affect productivity and, in severe cases, result in long periods of downtime, frequently putting the business at a financial loss.
Important security considerations for Virtual Assistants
VAs typically have access to a broad range of their clients’ systems, applications and software. As such, unlike enterprises and organisations, VAs typically do not have complete, 24/7 cyber incident response processes enabled, given that they often work remotely.
It’s easy for VAs to consider themselves as very irrelevant or borderline useless to a cybercriminal, given that they themselves often don’t have as tangible or expensive assets as their clients do. However, VAs still represent an appealing attack surface for malicious actors, who may use the virtual assistants as a stepping stone to access or steal data from the enterprises they work with.
Therefore, it’s imperative that VAs be aware of the common ways they can be exploited, such as:
Non-disclosure agreements (NDAs)
One of the first lines of defence for any VA is a legally-binding NDA, which ensures that any client information, data, or intellectual property encountered by a VA remains private.
VAs would potentially be legally liable if no NDA was present from the outset of a client contract, opening themselves up to legal action if sensitive or confidential data was compromised. Not only that, but the reputational damage could be debilitating.
Therefore, VAs should review all existing and future NDAs with increased precision before any work commences, to confirm that the correct security protocols have been outlined and initiated.
Security Policies
Much like NDAs, virtual assistants should be familiar with their clients’ individual security policies regarding data access, storage, sharing and publishing. Any client will advise on any considerations or limitations it has about data being exposed, with policies existing to safeguard itself, as well as any suppliers, stakeholders, employees, or other relevant third parties that may have access.
It’s useful for VAs to be aware of the following:
- Data access: Understanding what data the VA can examine, and who else might be able to as well. Have they been mistakenly granted too low/high user permissions?
- Device usage: Clients may stipulate rules around using personal or company devices. They may also implement strict strong and unique password policies.
- Storage: VAs must understand what data can be stored in the cloud and on native servers, or be accessible offline. Clients may request additional security steps to gain access.
- Reporting breaches: It’s vital to understand what protocols the client will follow if there is a data breach or cyber incident, and who is affected. This can commonly come in the form of offsite penetration testing and risk assessments, which could mean that remote network access is temporarily stripped while threats are contained.
Cloud storage and VPNs
Many VAs rely on collaborative cloud storage platforms like Dropbox, Google Drive, and OneDrive to store, share, and sync client data. While these tools are convenient, they can often be a target for cybercriminals attempting to seize information, which is why VAs must enable multi-factor authentication (MFA) on all cloud-based applications. They must also ensure that passwords are not used more than once across logins and applications, with passwords being strong and difficult to crack. They should similarly only share folders or files with client-approved users.
As an additional layer of security, clients generally stipulate strict use of a VPN (virtual private network), which creates an encrypted connection over less secure networks. VPNs help prevent unauthorised entry access to shared systems and networks. While a VA could undoubtedly benefit from a VPN, free or basic-level services often lack the advanced security features that business VPNs have. Therefore, VAs should consider premium solutions that offer sufficient data protection.
Device security
VAs might use their personal devices like laptops, mobile phones, servers etc. to conduct business activities. However, sometimes their clients may stipulate strict use of business-issued equipment. Regardless of its origin, however, any device must be appropriately secured, patched with the latest security updates, and with enterprise-grade anti-malware and antivirus software working autonomously.
It’s prudent to enable MFA when logging into devices, accounts, and networks. While a login will require a password, requesting another verification method, such as SMS or email codes, biometric verification, or by using a third-party authenticator app, will make it immeasurably harder for cybercriminals to compromise a system.
Training and awareness of VA security risks
Phishing is a very common method of data exploitation and compromise. VAs should understand the importance of verifying requests to determine their legitimacy, as fraudulent messages are routinely hard to spot at first glance. They should double-check any requests for logins, information or file access with clients.
If VAs are not well-equipped to deal with potential streams of requests for information, or if they cannot detect suspected phishing attempts from legitimate queries, it’s worth investing in special cyber awareness training, and investing in email security upgrades that can filter requests like these more accurately. Remaining vigilant and reporting any suspected attempts, infections or thefts to clients immediately is critical to ensure optimum security.
In summary, while technology enables VAs to work efficiently and provide value to their clients, it also introduces risks that must be managed. VAs should ensure proper safeguards are in place to mitigate cyber threats. With the right knowledge and protocols to handle sensitive data and systems, VAs can operate securely and help minimise risks for themselves and their clients.
You may also be interested in learning about the 4 common ways hackers target executives.
