Cyber security for remote and hybrid workers

The home office is a different network

In the office, the business controls the firewall, Wi-Fi and devices. At home, staff share a network with smart TVs, game consoles, children's tablets and a router that may not have had a firmware update since it was installed. You cannot manage all of that, and you should not try. The aim is to make the work laptop and the work accounts secure regardless of the network around them. That approach, sometimes called zero trust, treats every network as untrusted. Instead of relying on being inside the office, each sign-in is checked: is this the right person, with MFA, on a compliant company device? If so, access is granted. If not, it is refused.

Company devices beat personal computers

A personal home computer is the biggest remote work risk. It may be shared with family, run outdated software, lack encryption and have no security monitoring. Work files saved there are outside your control. Where possible, give remote staff a company laptop managed through Intune or similar, with encryption, EDR, automatic updates and standard user rights. If personal computers must be used, limit them to browser access to Microsoft 365, block downloads through conditional access or app protection, and never allow them onto the office network or VPN.

VPN or cloud access

Many small businesses no longer need a traditional VPN. If files are in SharePoint and OneDrive and the main business application is cloud-based, staff can work securely over the internet with MFA and device checks. Where a VPN is still needed, for example to reach an on-premises server, use one that requires MFA, keep its firmware updated and allow only company devices to connect. Remote desktop to an office computer should never be exposed directly to the internet. Use a gateway with MFA or a cloud desktop service such as Azure Virtual Desktop instead.

Home Wi-Fi and routers

Ask staff to check a few basics: the Wi-Fi uses WPA2 or WPA3 with a strong password, the router admin password has been changed from the default, and router firmware updates are applied. Many internet providers manage the router remotely, which helps. Suggest putting smart devices on a guest network if the router supports it. If the household still has an old router from a previous provider, it may be worth replacing; an unsupported router stops receiving security fixes and can be taken over remotely. Do not over-promise on home network security. Even with a well-configured router, the company device itself must be protected, because you cannot see or control what else is on that network.

Working in public places

Cafes, airports and hotels bring other risks. Public Wi-Fi can be spoofed, so staff should prefer a phone hotspot for work. Modern websites and Microsoft 365 use encrypted connections, which protects data in transit, but a fake network can still lead people to a lookalike login page. Remind staff to type addresses themselves or use bookmarks, and to watch for unexpected sign-in prompts. Screens and conversations are easy to overlook. A privacy screen filter helps on trains and in cafes, and client calls should not be taken in places where others can hear details.

Printing, paper and family

Printing at home creates paper copies of work documents that end up in household recycling. Agree on what can be printed and how it should be disposed of, for example shredding sensitive pages or bringing them to the office. Discourage connecting work laptops to personal printers over USB if you block removable storage.

Make it clear the work laptop is for work. Children borrowing it for homework or a partner checking personal email introduces software and websites outside your control. Screens should lock automatically after a few minutes and when the laptop lid closes. A lockable drawer or cupboard for the laptop at the end of the day reduces the chance of it disappearing in a burglary.

Support and reporting from a distance

Remote staff need the same easy way to report problems as office staff. Make sure they know how to contact IT, that remote support tools work on their laptop and that they can report suspicious emails with one click. A short check-in when someone starts working remotely, to confirm their setup meets the basics, prevents most issues. Hybrid work also makes lost and stolen devices more likely. Ensure staff know to report a missing laptop immediately, wherever they are.