Securing Remote Workers: What Actually Matters

Remote work broke the model most small business security was built on. The old approach assumed a trusted office network with a firewall at the edge and everything valuable inside it. When your staff, devices, and data all sit outside that boundary, defending the boundary stops meaning very much.

The shift: from network to identity and device

The question is no longer "is this connection coming from inside our network?" It's "is this the right person, on a device we trust, doing something reasonable?"

That reframing has practical consequences. It means your security budget moves from firewall hardware toward identity controls and device management. It means the VPN stops being the centerpiece. And it means two things carry most of the weight: proving who someone is, and proving the machine they're using is in a state you're willing to trust.

1. Identity comes first

With staff signing in from anywhere, credentials are effectively the whole perimeter.

• MFA on everything, with number matching enabled so push-fatigue attacks don't work. Details in how to roll out MFA.
• Conditional access policies — require a managed, compliant device for anything sensitive, block sign-ins from countries you don't operate in, and flag impossible-travel patterns. This is what stops a stolen session cookie from working elsewhere.
• Block legacy authentication, which bypasses MFA entirely and quietly undermines everything above.

2. Manage the device, not the network

You can't secure your employee's home Wi-Fi, and you shouldn't try. You can absolutely control the laptop.

Intune — included in Microsoft 365 Business Premium, which many businesses already own — lets you enforce a baseline regardless of where the machine is:

• Disk encryption (BitLocker or FileVault) so a stolen laptop is a hardware loss rather than a data breach
• Automatic screen lock with a short timeout
• Patching and reporting that works over the internet without needing the corporate network — see why patching matters
• EDR that watches behavior rather than matching known-bad files
• Remote wipe for lost devices, scoped to company data only

Crucially, a managed device is what conditional access checks against. The two controls work as a pair: identity proves the person, device compliance proves the machine.

3. Rethink the VPN

Many businesses still route all remote traffic through a VPN out of habit. It's worth being honest about what that buys you.

If your email, files, and applications are in Microsoft 365 or Azure, a VPN adds latency, creates a bottleneck, and gives a compromised laptop a direct tunnel into your internal network — while protecting traffic that was already encrypted. VPN concentrators are also among the most aggressively targeted devices on the internet, and their firmware is frequently unpatched.

Keep the VPN for what genuinely needs it: internal line-of-business applications, on-premises servers, specific equipment. Access cloud services directly, protected by conditional access. If you do keep a VPN, patch its firmware on the same schedule as everything else — this is a common and serious gap.

4. Home networks and shared spaces

You don't control these, so plan around them rather than pretending otherwise.

Give staff simple, non-patronizing guidance: change the router's default admin password, keep its firmware updated, use WPA3 or WPA2, and don't let household members use the work laptop. That last one matters more than people expect — a family member installing something on a work machine is a real and regular source of incidents.

For public Wi-Fi, the honest position is that modern encrypted traffic is reasonably safe; the bigger risks are shoulder-surfing and unattended devices. A privacy screen and a habit of locking the laptop cover more real-world risk than most technical controls here.

5. The personal device problem

Whatever your policy says, staff check email on personal phones. Blanket bans don't work; they just push the behavior out of sight.

The workable approach is app protection policies, which secure the company data inside apps without managing the whole personal device. Company data can't be copied into personal apps, access requires a PIN, and you can wipe company data remotely without touching personal photos. Staff keep their privacy, you keep control of your data.

The failure mode here is subtle and worth understanding — we covered it in the hidden BYOD risk.

6. The human side

Remote staff can't lean over to a colleague and ask "does this email look right to you?" That informal check caught a lot of problems, and its absence is an underrated risk.

Replace it deliberately: a channel where anyone can paste a suspicious message without embarrassment, a one-click report button in Outlook, and a clearly stated rule that nobody is ever criticized for asking. Remote workers are also disproportionately targeted by business email compromise, precisely because verifying a request in person isn't an option — which is why the phone-verification rule for payment changes matters even more here.

A practical starting order

1. MFA everywhere with number matching
2. Disk encryption verified on every laptop
3. Enroll devices in Intune and enforce a compliance baseline
4. Conditional access requiring compliant devices, admins and finance first
5. App protection policies for personal phones
6. Reduce VPN scope to what genuinely needs it, and patch its firmware

For most small businesses that's configuration of licensing they already hold, not new spend.