Keywords

Introduction

This chapter sets out a discussion to understand new security issues in the context of distance work. We will focus on three areas of security threats. Security is a key aspect of all human activity, including paid work. The COVID-19 pandemic hit the world with great surprise. In most global risk assessment rehearsal, this topic was not recognized, also not any global pandemic, even when we have had such in the past, the most recent before COVID-19 being the 1918–19 Flu pandemic, also called Spanish flu, the Great Influence Epidemic or the 1918 Influenza Pandemic. It is estimated that about 500 million people or one-third of the world’s population at that time, became infected with this virus (Centers for Disease Control and Prevention, 2021). However, the world at that time was extensively different from the current world, most importantly being much less interconnected, and the outcomes of the 1918–19 flu pandemic were rather different from those of COVID-19. The main difference is that 100 years ago the world was not interconnected and global in the way it is now, and the effects of the 1918–19 flu pandemic remained local. In international risk assessments (Atlas Magazine, 2017) a global pandemic was not foreseen very well. Global severe risks were discussed from the viewpoint of likelihood and impact. In the dimension of likelihood there was no mention of pandemics. In the dimension of impact “Spread of infectious diseases” was anyway identified at the place 8.

The first security risk area is data “security and privacy.” The COVID-19 pandemic has permanently changed our relationship with technology, accelerating the drive toward digitization (Véliz, 2021). Information technology devices, however, are generally perceived to be poorly configured compared to work environment IT devices (Fernandes, 2021). Consequently, the work environment at home is almost invariably more prone to data privacy and security risks than the work environment on the employers’ premises. Both devices and telecommunication lines might be less protected. Moreover, devices might be used more in a mixed mode between business and privacy issues. Therefore, in a telework setting, controlling physical access to data, devices, and telecommunication infrastructure is nearly impossible.

The second security risk area is “physical safety.” Physical safety refers to the absence of harm or injury that any person can experience from a physical object or practice (Your Experiences Matter, 2022). In the context of the COVID-19 pandemic, the sudden shift to tele(home)working for an uncertain time period might have caused paying less attention to workplace safety and ergonomics.

The third area of security risk is “mental well-being.” Even for those not contracting the COVID-19 infection, several health risks can emerge. COVID-19 has affected different frontiers of life and induced many psychiatric and mental problems, such as panic, anxiety, depression, post-traumatic stress disorders, suspiciousness, infodemia, cacophony, xenophobia, and racism (Jakovljevic et al., 2020). Feelings of isolation and lack of immediate personal support in the case of problems are crucial in distance work arrangements (Toscano & Zappalà, 2020). A major issue that needs focus and management is communication with other members of the working community. Controlling working time and separating it from free time has become challenging (Allen et al., 2021). Also, productivity measurement may become more difficult, and even when real productivity remains stable or improves, workers may still feel inefficiency in their work duties.

The chapters unfold as follows. After this Introduction, the intellectual history of work from home is introduced. The next section discusses the surprise and impact of COVID-19 on the world in general and on intellectual work in particular. Then, after a short discussion on security in general, we discuss, in turn, our three areas of attention: data security and privacy risks, physical safety risks, and mental security risks. After mapping out the risks, we offer suggestions on the most effective ways to mitigate these risks. The chapter concludes by presenting a summary and conclusions.

Home at Work

Many people around the world have resorted to work from home because of the COVID-19 pandemic. Some have been compelled to do this, while some have taken the change voluntarily. Work from home has its benefits and drawbacks, and individuals react to different issues in diverse ways.

In this chapter, we concentrate on work from home, where the work is mainly intellectual in nature. Physical work, as well as performances containing a physical component, is left outside our discussion, as the risks of security in these types of work activities are very different from risks in purely intellectual work.

Research on work from home with networked computers has emerged under several terms, including practice. A pioneering term was that of telework (Bailey & Kurland, 2002), partly inspired by the mostly American term telecommuting, where the need for physical commuting to work was eliminated. Working from home has several benefits, one of the most important is the elimination of usually risky travel to and from work. This benefit outweighs many, if not all, homework security risks. The telework concept further evolved in the term of distance work. One of the earliest studies that mentioned telework is by Green (1988). A term close to distance work is remote work, also used by several researchers (Olson, 1983; Staples, 2001). New terms were also introduced, such as multi-site work, which is mainly used in organizational daily practices, but to some extent even in academic research, such as (Damian & Zowghi, 2002; Marttiin et al., 2002). The next development in the terminology was that of nomad work (O’Brien, 2011), referring to people working everywhere: the initial workplace, other premises by the employer or any institution connected to the employer, during work and other traveling, and home, including different additional places, such as summer cottages.

Working from Home: Data Security and Data Privacy

A first view of safety and security is that of data security and data privacy. Identifying, categorizing, analyzing, and counteracting data security and privacy threats and risks is an endless task. We must focus on some limited set of risks that we consider typical and highly relevant for distance work. These include:

  • Use of private devices

  • Data storage in wrong places

  • Use of badly secured communication networks

  • Mixing up of private and work life

  • Possible unavailability of help desk services

  • Social isolation leading to misconduct.

Before entering these detailed topics, a short introduction to data privacy and security is needed. As ever, the important topic has several names. Data security is a core topic untapped a long time ago (Denning, 1982; Denning & Denning, 1979) but by no means obsolete for the networked world (Kaufman, 2009). Data security is taken as the central concept, as in the final analysis, all information system security and privacy problems come down to data being in the wrong place and/or at the wrong time. Information security is a related term, and information is processed data that is meaningful to someone. Data privacy is a subset and consequence of data security; there is no data privacy without data security. Data privacy is the protection of personal data from those who should not have access to it and the ability of individuals to determine who can access their personal information (Cloudflare, 2021).

Terms such as IT security (Cavusoglu et al., 2004), computer security (Gollmann, 2010), network security (Kaeo, 2004; Marin, 2005) and cybersecurity (Craigen et al., 2014; Singer & Friedman, 2014) are also often used. In general, the terms refer to where the focus of security risks might be management. Nowadays, the term cybersecurity is mostly used.

Somewhat simplified, data security problems can be traced back to three main areas: confidentiality, integrity, and availability. Together, these form the so-called CIA Triad (Fenrich, 2008; Samonas & Coss, 2014) or AIC Triad (Al-Qasrawi, 2016) to avoid confusion with the Central Intelligence Agency of the United States. Of course, these three main areas (confidentiality, integrity, and availability) can be divided into millions of sub-areas, but this broad categorization ensures that none of the basic dimensions of security is forgotten. First, data confidentiality deals with protecting against the disclosure of information by ensuring that the data is limited to those authorized or by representing the data in such a way that its semantics remain accessible only to those who possess some critical (NIST, 1995). Second, data integrity refers to the property that data have not been altered in an unauthorized manner. It covers data in storage, during processing, and while in transit (NIST, 1995). Whereas data can be well protected in terms of confidentiality and integrity, no one has the benefit of the data if it is not available. Therefore, third, data availability concerns the timeliness and reliability of access to and use of data. It includes data accessibility. Hence, availability has to do with the accessibility and continuity of information (University of Delaware, 2021).

The use of private devices was taken under scrutiny with the introduction of the term Bring Your Own Device (BYOD). While the term had its heyday some ten years ago (Miller et al., 2012; Thomson, 2012), the term is still heavily used (Ratchford et al., 2021). Key problems with worker-owned devices are that they are positioned outside complete device maintenance and management of the employer, and that data and activities on it are mixed between the private and work spheres. Use of own personal devices—which are rightfully easily understood to belong to the personal life sphere more integrally than those acquired by the employer—may also be shared with other family members, further increasing security risks. Problems of electricity supply might also become a problem in home environments, which usually do not have proper uninterrupted power supply (UPS) arrangements. Overheating (or cooling) of home devices is also a risk, as home environments are usually not as professionally air-condition controlled as in organizational facilities.

Data storage tends to become distorted and disintegrated in non-organizational settings. Data is usually safe when it resides just in one place. In general, the more storage places, the more risks. In organizational settings, the danger of keeping “all eggs in one basket” is rather minimal, as keeping security copies of organizational databases is a rather mature discipline.

The home environment is an especially vulnerable place to keep data, as data storage is not professionally managed, and can take various forms. The theft of data storage devices is much easier than in most organizational settings, as access to workplaces is usually strictly controlled, but people naturally invite people to their homes. Printers are always a key risk device group for data privacy, and even much so in home environments: “[Not] many administrators are aware about their security risks. The most representative example is printers, which have traditionally been considered totally harmless devices. At present time, this idea is difficult to defend because too many security incidents related with networked printers have risen in the last years” (Hernandez et al., 2001, p. 190).

The use of poorly secured communication networks is common in home-settings. Again, professional management is missing from local networks. Home Wi-Fi networks remain often unprotected, and everyone can have access to them: “Many users have their home Wi-Fi networks in unsecured mode or use publicly available unsecured Wi-Fi networks” (Potnuru, 2012, p. 89). This is bad in the sense that any telecommunication chain is only as strong as its weakest link. In the absence of proper networks, data transfer can even happen through the transportation of the data storage device, and interactions through the network may easily suffer from poor data integrity. Also unauthorized data disintegration can occur. Thus, data availability can always be a great problem outside of the work environment.

Mixing up personal and work life is acceptable when working from home. However, this should not be extended to data and information processing activities. Using the same communication platforms (e.g., social media, e-mail, and instant messaging) for both personal and work-related communication can easily lead to data security breaks. Access control to premises is hard to implement, and anyone having free access to the home can have free access to work-related data, if not carefully protected. Openly drifting papers are of course a major security treat, even in the home environment. Possible unavailability of help desk services is also a major threat. However, generally, it is not possible to extend helpdesk and related activities to IT devices that are not owned by the work organization. Automatic monitoring of work-station infrastructure performance is not usually possible in home-settings. This means that software and hardware problems are not always professionally addressed. Software is not updated, malfunctioning hardware might remain unnoticed, found problems, and malfunctions of systems are not reported and taken care of.

In addition to the more technical problems described above, well-being problems easily emerge. Social isolation, even when performing information processing activities, may lead to distorted habits when no social control is available. Private computers are beyond the coverage and analysis of log data. The computers might not be shut down for long periods, inhibiting automatic software updates and cumulating risk-vulnerable data to different intermediate storages and buffers of the IT infrastructure, finally opening a channel to possible intrusion risks. Automatic security copy production of data is most likely not working in the home environment. Constant switching between the work and personal information spheres may easily lead to the mixing up of data storage and processing activities as well. In addition, eating and drinking by the work station is always a major risk to the hardware, and simultaneous data might be lost: “Residue from food and drink attracts vermin which destroy library materials; spillage can ruin a book and do serious damage to a computer terminal” (Soete, 1998, p. 24).

Working from Home: Aspects of Physical Safety

A second view of safety and security is that of physical safety. It is widely agreed that working from home, or flexible work arrangements, are generally beneficial for both the employer and the workers. In some occupations, it is possible to maintain personal choice in the decision about whether to work from home or to come into work. The condition for working from home is often that the worker has an appropriate and well-maintained safe place for performing the duties. However, this is not the case when workers live in space-constrained living conditions, have a family with home-staying children, or live close to a construction site with lot of noise. When the COVID-19 pandemic hit the world, working from home included the assumption that workers were able to work peacefully and have a spare room that could be converted into a home office. Additionally, when the COVID-19 lockdown started, the assumption was that workers have safe seating, desk, and lighting arrangements, ergonomically safe equipment, safe electric supply, and injury-free immediate environment. (Pennington & Stanford, 2020).

The common factor for injuries is that workers lose control of what they intend to do by a sudden action that causes loss of life or health. Yet, the COVID-19 pandemic may also have affected the physical condition without any sudden incident. This was the case during the COVID-19 pandemic, as there has been widespread use of information technologies at inadequate ergonomic positions, which could have led to various health conditions. These conditions include illumination, noise, temperature, and furniture (Suárez Monzón et al., 2021).

During the lockdown period and working from home, the search for better spaces for virtual working has led workers—or students—to move to closed places with less illumination or ventilation. Also, it is possible that individuals work with smaller devices, such as the cell phone or tablet. This, in turn, might cause musculoskeletal damage, as bad postural habits may be generated over a longer period of time (Suárez Monzón et al., 2021).

All these issues concern the risk area of physical safety. It must be noted in this regard that there are two separate concepts for being in harm-free condition without risks. Safety implies a human aspect, freedom from accident or injury, while security implies deliberateness or intent, as well as protection from dangers. The concept of security is used mainly in the context of protection against undesirable threats, whereas safety is frequently used in connection with injuries (water safety, home safety, and fire safety) (Somerkoski & Lillsunde, 2014). In general, however, working is a protective factor for workers, as employers must follow labor legislation. The condition for this is, of course, that the employer complies with the law in these respects. A thorough socialization during onboarding processes of new workers, therefore, is important.

Despite any onboarding and socialization processes being in place, however, injuries—both unintentional and violence-related—currently take the lives of 4.4 million people around the world each year and constitute nearly 8% of all deaths (World Health Organization, 2021). For people aged 5–29 years, injuries are the most common reason for death. A major part of these are home and leisure injuries. For instance, falls, which are an under-recognized public health issue, account for over 684,000 deaths each year for children and youth. Tens of millions more people, however, suffer non-fatal injuries that lead to emergency department and acute care visits. Hospitalization might be both expensive and painful. Research has found several risk factors for injuries, for instance alcohol or substance use, lack of adult supervision of children, poverty, economic and gender inequality issues, unemployment, or a lack of safety in the built environment. Also, some social factors and determinants might affect the frequency of injuries, for instance easy access to alcohol, weak social safety nets, including unsafe housing or schools. In vulnerable communities, where trauma care services are inadequate, the consequences of injuries can be exacerbated (World Health Organization, 2021).

In response to the global COVID-19 pandemic, many countries, if not all, have implemented physical distancing to limit transmission of the coronavirus. During the pandemic, physical restrictions, such as lockdown periods, affected the workplace, traffic, sport, and leisure activities. Respectively, more people were staying at home. This caused an increasing number of home injuries. For instance, in Australia, the home was the most commonly reported place for injury occurrence, as the injury rate increased by 9.3% compared to the time before the pandemic (2017–2019). This figure was based on the use of the emergency service health department. (Monash University Accident Research Centre, 2021).

In the US, the pandemic almost doubled the number of injuries in the household. The representative sample of 26% reported having experienced an injury in the household during the pandemic. The comparative figure before the pandemic was 14.3%. Falls were the most common cause of injury, consistent with earlier studies (Gielen et al., 2015). Families with children living at home were significantly associated with a higher likelihood of reporting injury. Households with children reported almost three times more injuries during the COVID-19 pandemic compared to those without children. However, the researchers in this study did not find an overall connection between increased time spent at home and report of injuries (Gielen et al., 2015).

Product safety can be regarded as a part of physical safety issues. The COVID-19 pandemic affected the consumption of products and product-based injuries widely. For instance, in the US, school-related injuries and sport activities dropped sharply 81%. This was the most probably for the suspension of the school and sports-club activities. During the COVID-19 pandemic, however, respectively, skateboard, hoverboard, scooter, and bicycle injuries that were treated in the emergency services increased by almost 40%. Button battery injuries (swallowing or inserting in the nose) increased by 93% in injuries in 5–9-year-old children (United States Consumer Product Safety Commission, 2021).

Researching and navigating the COVID-19 pandemic environment might help minimize the risk of the future. This was the case when researchers found that unintentional burn injuries among children rose 32.5% during the first six months of the COVID-19 pandemic compared with the same period in the previous year. Researchers state that this was due to stay-at-home orders given during the beginning of the pandemic (Family Safety & Health, 2021).

Because of the lack of special arrangements for safety and the constant interplay between private and business issues, human’s concentration is limited, leading to larger catastrophes, such as fires or water damages in worst cases. In the case of the simultaneous task of taking care of children, the risk is further accelerated.

Working from Home: Aspects of Mental Well-Being

A third view of safety and security is that of mental well-being. According to the World Health Organization, safety is a condition where factors that are a threat to society are managed so that everyone has the feeling of well-being and prosperity (Welander et al., 2004) Additionally, the concept of well-being is often used when emotions are in question. Mental well-being refers to the stable condition of the mind.

There seems to be global consensus that the COVID-19 pandemic, lockdown, physical isolation, and working from home have affected workers in versatile ways. First, some of the findings suggest that the COVID-19 pandemic has had a negative effect on the well-being of workers. A present study (Smith et al., 2020) utilizing a sample of 932 UK adults found that the prevalence of poor mental health was 36.8% in contexts where individuals had to isolate themselves or had to obey to social distancing regulations due to the COVID-19 pandemic. Correlates of poor mental health included female sex, a younger age, lower annual income, being a current smoker, and having physical multimorbidity. Supervisor support, however, may protect the mental health and well-being of workers (Evanoff et al., 2020).

Sharing the home with others during the COVID-19 pandemic seems to have an effect on employees’ mental well-being as well. Having an infant at home predicted better overall mental well-being. Also, working parents had a better physical and mental well-being status since they were spending more time at home with their kids. Yet, there was a simultaneous increase in new physical and mental issues due to the increased distractions in work life and lack of support from day-care centers or babysitters during the work day (Xiao et al., 2021).

Some researchers state that individual work management skills have a connection with how well the worker thinks he or she can manage when working from home. Autonomy and self-leadership seem to have a positive relationship with productivity and work engagement. Work from home may also play a protective role for workers since they were not asked to go to work and were not exposed to possible COVID-19 contagion by leaving home. This situation sets new challenges for the employees, as they should provide more support and understanding for family-work conflict—not to forget the need for mental recovery and right to disconnect of each worker. Furthermore, there might be a demand for some organizational changes to support the mental well-being of working-from-home workers (Galanti et al., 2021).

To sum up, policies that promote physical activity, reduce psychological distress, and support balancing childcare while working from home, are important. The employee can address some of these issues, but it is also essential that employers monitor workers’ well-being systemically, for instance providing breaks or logistic support. It is essential for the employer to be able to make adjustments in the “new” workplace and in productivity expectations.

Conclusion and Discussion

This chapter discussed the risks caused by COVID-19 beyond the core health risks that are the core of the pandemic. We focused on three types of risk. First, knowledge work has evolved into networks and digital environments even more rapidly than originally expected; this is sure to increase the risks related to data security and privacy. Second, work is increasingly being carried out in nomad environments, even work that is not knowledge work. While working at home surely has some physical safety benefits, such as the elimination of traveling to work and back, the risks emerging are surely many. Home environments can seldom be well secured and equipped as professionally designed office or factory environments. However, at home, peer and employer support will not be available. Third, we discovered that COVID-19 is not only causing classical health risks, but also a great number of mental health problems and risks.

Within data security and privacy, our greatest concern was that activity had shifted away from employer control. Professional data management controls usual, which are common in organizational settings, are difficult to apply to home office control. The increasing mixing of personal and work spheres adds to the risks of data security and privacy. Furthermore, the physical environment at home is also very different from the professional office environment, not to speak of the factory environment. Again, there is a lack of professional physical environment design and infrastructure. Shortcomings in the working environment can lead to different kinds of health and safety risks. The COVID-19 pandemic poses several risks to mental health. The isolation imposed on individuals can cause a serious mental health risk. Not coping with work demands because of several factors and perpetual over- or underwork can have a deep impact on mental health. Worrying about one’s health and that of other people may be easy for most people. Missing peer support or support from employers, family, or family can also be a considerable risk factor.

People are unique and, therefore, they react differently to the COVID-19 pandemic. An issue being of deep concern and discomfort might be totally unimportant to someone else or even a good thing. We have seen how individuals react to different phenomena around the pandemic in many different ways, and this is also true even for countries. Nations have reacted to the COVID-19 virus in very different ways, even within units where one would expect some amount of coordinated action, such as the European Union. Two years of experience have shown that there is not any best or worst reaction to the COVID-19 pandemic yet available. This very much also holds to individuals, and we cannot say what would be the best individual response to COVID-19 and all the phenomena around it. Each individual must adjust to the situation based on his or her needs and capabilities.

COVID-19 has set new challenges for both workers working from home and employers. The condition for bearing the heavy workload and performing effective self-management needs family-work balance, flexibility in working conditions, and support from the environment, such as family, co-workers, customers, and employers. Individuals who live in vulnerable communities have been even more vulnerable during the COVID-19 pandemic (Ladd & Bortolotti, 2020). Vulnerability can take several forms, such as inadequate living space, many children, no decent infrastructure, no education or work opportunities, alcohol or substance use, lack of adult supervision of children, poverty, economic, gender inequality issues, unemployment, or a lack of safety in the built environment. People living in such conditions are even more vulnerable during the COVID-19 pandemic lockdown as more time is consumed at home.

With COVID-19, health and well-being are no longer only a demographic or individual-level issue. Therefore, there is a need to redefine the whole concept of sustainability (Hakovirta & Denuwara, 2020). All sustainability goals set by the United Nations (2015) can be seen in a new light through the COVID-19 pandemic. The pandemic has a direct impact on the goal of good health and well-being. As our chapter shows, the goal of decent work and economic growth is also something that needs to be redefined.

Once the pandemic is over, we will have accumulated a lot of new knowledge on how to master such unusual situations in society. This is the strength of humankind. Before that, we still must devote a lot of energy, time, and concern to the different challenges COVID-19 has brought to us. We must also learn to understand the positive challenges COVID-19 has set to our old, often outdated, ways of living, working, and taking care of our health.

In the end, the COVID-19 pandemic, lasting 2 or 20 years, is a very short period in humankind history. For individuals living now, it surely can deeply affect life, especially in some critical periods of life. We have seen, for example, documentation of students doing all their (university) studies during the COVID-19 pandemic or elderly at nursing homes having no nursing home experience other than that of the COVID-19 effect. Also, those who began their working career within the last two years may not have had any work experience. They have good reason to believe that this is how work-life functions; the “new normal,” even in the times of the COVID-19 era, has not yet vanished.

Practical Implications to Mitigating Risks

The risks of telework in the times of COVID-19 discussed above surrender to classical risk management strategies. There are many of those general lists, but we turn to the version of (Glossop, 2021):

  • Risk acceptance

  • Risk transference

  • Risk avoidance

  • Risk reduction.

Risk acceptance is a strategy we all employ all the time in almost any human activity: We accept risks to avoid excessive cost and resource ways to avoid them. It is close to impossible to say anything general when this is reasonable, and when not, all is deeply contextual.

The traditional way to transfer risks is insurance. It is always just mending bad things that happened, and is of course very questionable, for example, in the case of mental health: financial compensation for mental health loss would most likely be very hard to get, and money would not make up the losses. In telework agreements, risks can be distributed between workers and employers; it is a general knowledge that long-term telework should be covered with a separate telework agreement (Baltina, 2012; Clavería, 2020; Meadows, 2007; Top & Savu, 2015).

Risk avoidance, in its pure meaning, would mean that there is no risk; that would mean no (tele)work. Every worker can, however, do something to avoid risks. In data privacy and security, working offline would be the answer to most data security problems, but it is hardly any viable option in the long run. Loosely hanging paper documents are always a data security and privacy risk (Kahn & Sheshadri, 2008). Deciding and controlling what kinds of work activities are available to do at home is an option everyone should have. In mental health, there might be issues that are better not to be handled outside work environment settings; keeping even the environments separate might sometimes contribute to the maintenance of mental health (Hall & Richter, 1988; Shen, 2019).

In all risk management work, education, and mapping of risks (getting to know and understand them) are key activities. These strongly support risk reduction. In terms of data privacy and security, there are plenty of commercial technical solutions and services that can be bought to improve security. However, it is important to remember that the biggest risk factor is the user (Lineberry, 2007). In work environments, especially in those where real physical work is done, it is well known that keeping the workplace organized and tidy is a key to safety (Parmar & James, 2021), and this of course is very much true for office and intellectual work.

In mental well-being, being able to integrate and at the same time keep separated work and leisure time are keys to avoiding mental health problems (Gershuny, 1989). There is reason to remember that good solutions can be very personal, and it is next to impossible to give any universal guidelines (Lobo, 2006). The key things are that workers think and are aware of these issues, and that they are given enough freedom to tailor their working style to their individual needs. No wonder work-life flexibility is a major topic these days (Gashi et al., 2021; Kossek & Lautsch, 2018).