Remote work security means protecting access to your data and systems, not the building or the network your people happen to sit on. The fastest gains come from five things: phishing-resistant multi-factor authentication (MFA), managed and patched devices, isolation of personal devices, offline backups, and staff who know how to report something odd. This guide walks through each one, shows where regulated businesses need extra care, and lays out a phased order of work you can start this quarter.
TL;DR
- Treat identity as the new perimeter: verify every user, device and request, whether or not the person is on a VPN.
- Email is still the front door for attackers, so put phishing-resistant MFA on email and every privileged account first.
- Keep personal (BYOD) devices off the network that holds company systems, and keep backups offline or segmented.
- Healthcare organizations need a documented risk assessment for remote access to e-PHI, not just a policy.
- Roll out Zero Trust in phases, by risk, instead of flipping the whole environment at once.
Table of Contents
- Why remote work changes the security problem
- Start with email and identity
- Replace "trusted VPN" thinking with Zero Trust
- Control the devices, especially personal ones
- Back up as if ransomware will land
- Train people for the moments that matter
- Healthcare and regulated teams: policy is not compliance
- A phased plan for small and mid-sized teams
- Our perspective: fewer vendors, clearer accountability
- Getting help securing a distributed team
- FAQ
- Sources
Why remote work changes the security problem
When everyone sat in one office, a firewall at the edge did most of the work. That model has aged badly. NIST's National Cybersecurity Center of Excellence notes that conventional network security focused on perimeter defenses, but many organizations no longer have a clearly defined perimeter. Your staff now connect from kitchens, coworking spaces and airports, on laptops you may or may not own, to applications that live in several clouds.
Three things follow from that.
- The attack surface is larger. Home routers, personal phones, shared family computers and consumer software all sit between your employee and your data. TechTarget's overview of remote work risks points to this expanded surface and to limited security oversight of home environments.
- People carry more of the risk. Employees at home face more social engineering and more chances to disclose data by accident. Tools matter, but so does a culture where staff can spot phishing and feel free to report it.
- The old fixes do not scale. Many organizations try to patch the perimeter model with temporary measures. The lasting shift is from securing the network to securing each access request.
That is the thread through the rest of this guide.
Start with email and identity
If you can only do one thing this month, protect email and privileged accounts. CISA's counter-phishing guide reports that 32% of breaches involve phishing and 78% of cyber-espionage incidents are phishing-enabled. Remote staff are especially exposed, because there is no colleague at the next desk to ask, "Does this look right to you?"
CISA also advises that organizations require phishing-resistant MFA for access to all privileged accounts and email services. The word "resistant" matters. SMS codes and push approvals can be phished or fatigued out of a user. Hardware security keys and passkeys are bound to the real login site, so a lookalike page gets nothing.
A practical order:
- Start with administrators, finance, HR and executives, the people attackers target first.
- Move on to all email and remote-access logins.
- Retire legacy authentication that cannot support modern MFA.
- Keep a tested recovery path for lost keys, so the help desk is not the weak link.
If you want a step-by-step schedule, our 90-day plan for phishing-resistant MFA breaks the rollout into stages.
Replace "trusted VPN" thinking with Zero Trust
A VPN encrypts traffic between a laptop and your network. It does not tell you whether the laptop is healthy, whether the user is who they claim to be, or whether they should reach that particular system. NIST describes Zero Trust Architecture (ZTA) as moving past perimeter security by requiring continuous verification of user identity, device health and application requests, instead of assuming trust because a user is on a corporate VPN. Its practice guide, SP 1800-35, offers 19 example implementations you can use as models.
There is a hard security reason to move, too. CISA's ransomware advisory lists old VPN flaws among the vulnerabilities attackers exploit, including CVE-2018-13379. A VPN appliance that nobody patched in years is an open door with a login page on it.
What Zero Trust looks like day to day
- Access is granted per application, not per network segment.
- Every request is checked against identity, device posture (patched, encrypted, managed) and context.
- Default admin accounts on remote-access tools are disabled and credentials are rotated.
- Policies start in monitor mode, then move to enforcement.
Do it in phases
The common failure is rushing. Seasoned practitioners favour a phased, risk-based rollout: pick the most sensitive applications, define who needs them, enforce, learn, and then widen the scope. Our write-ups on a two-quarter Zero Trust network access pilot and on NIST-aligned Zero Trust network design cover the mechanics, and the CISA and NIST remote access roadmap is a good starting point for IT leaders.
Control the devices, especially personal ones
Bring-your-own-device is where many remote programs quietly fail. NIST's guide to enterprise telework, remote access and BYOD security is the reference document, and its practical lesson is simple: a personal machine you cannot inspect should not sit on the same internal network as your enterprise assets. The usual fix is a separate, isolated network or access path for those devices, so that malware on a compromised home PC cannot move sideways into your servers.
A workable device policy has four parts:
| Control | What it means for remote staff |
|---|---|
| Managed company laptops | Full-disk encryption, automatic updates, endpoint detection and remote wipe |
| BYOD access | Limited to specific web apps through an isolated path, never to the internal network |
| Patching | Operating system and browser updates on a short, enforced schedule |
| Local admin rights | Removed for everyday users |
CISA's phishing guidance adds a useful layer for high-risk users: remote browser isolation can contain malware inside an isolation boundary when someone clicks a malicious link or opens a malicious file.
Developers and secrets
Engineering teams working remotely add a particular risk: credentials and API keys that end up in code repositories. Scanners help, but reviewing what actually changes in a pull request matters too. This piece on why developers need more than scanners for secrets in code is a useful read for teams that ship from home offices.
Back up as if ransomware will land
Remote work does not create ransomware, but it widens the ways in. CISA's guidance is to maintain regular, known-good backups stored offline or segmented from source systems and to patch high-risk vulnerabilities promptly. Organizations that do both are far better placed to recover without paying.
Three questions to test your own setup:
- If an employee's laptop is encrypted by ransomware tonight, can it reach your backups?
- When did you last restore a full system from backup, rather than a single file?
- Who decides, at 2 a.m., to isolate a user, and do they know they have the authority?
If the answers are shaky, rehearse. A ransomware tabletop exercise is cheap compared with learning the gaps live, and our guide to the first hour of ransomware response shows what to settle in advance.
Train people for the moments that matter
Annual slide decks do not change behaviour. What helps is short, specific guidance tied to real situations a remote worker meets:
- Unexpected requests. A message from "the CEO" asking for gift cards or a changed bank account gets verified by phone, on a number you already have.
- Home networks. Change the router's default admin password, keep its firmware current, and use WPA3 or WPA2 with a strong passphrase.
- Shared spaces. Lock the screen, keep family members off work devices, and avoid taking calls with sensitive details in public.
- Reporting. One obvious button or address for "this looks wrong", and a promise that nobody is blamed for reporting.
That last point carries the most weight. A fast report turns a breach into an incident you contain. Our overviews of common employee cybersecurity vulnerabilities and of employee cybersecurity training for HR leaders go deeper.
Privacy-minded practices help beyond your own walls too. If your team works with client files, for example coaches or consultants handling session notes, practical steps for securing client records show how secure connections, updated devices and careful access can limit accidental disclosure. That page is in Dutch, but the principles carry over.
Healthcare and regulated teams: policy is not compliance
If your remote staff touch electronic protected health information (e-PHI), HIPAA applies at home as it does in the clinic. HHS answers directly that covered entities allowing telework must implement appropriate safeguards to protect the organization's data, and that includes access controls such as automatic logoff.
Two points trip organizations up:
- Off-the-shelf does not mean compliant. Buying a tool does not satisfy the Security Rule. You need a formal, documented risk assessment covering remote access.
- "Addressable" does not mean optional. If you decide not to implement a control such as automatic logoff, you must document an equivalent alternative or a sound rationale. Without that record, an audit finds a gap.
Telehealth adds a patient-facing side. HHS guidance for providers says you should explain why privacy and security matter and tell patients about the protections of the technologies you offer. Patients have a role as well: updated devices, secure connections, and a private spot for appointments so sensitive details are not overheard.
The same documentation habit helps with SOC 2, PCI-DSS and ISO 27001 audits. Auditors want to see the decision, the owner and the evidence.
A phased plan for small and mid-sized teams
You do not need a security operations centre to make progress. A sensible sequence for a company without a large IT team:
Weeks 1 to 4: close the obvious doors
- Inventory who works remotely, on what device, to which systems.
- Turn on phishing-resistant MFA for admins and email.
- Patch or retire any legacy VPN appliance.
- Confirm backups are offline or segmented, and test a restore.
Weeks 5 to 8: manage the endpoints
- Enrol company laptops in management with encryption and automatic updates.
- Put BYOD on an isolated, web-app-only path.
- Remove local admin rights.
Weeks 9 to 13: move to identity-centred access
- Choose your two or three most sensitive applications and put them behind Zero Trust access.
- Run in monitor mode, review the logs, then enforce.
- Hold a tabletop exercise and write down who does what in the first hour.
If budget and headcount are tight, our small business playbook for reducing cyber risk without an IT team shows what to prioritize first, and the enterprise vulnerability management guide helps larger environments keep patching under control.
Our perspective: fewer vendors, clearer accountability
When we talk to IT managers and business owners about remote work, the technology is rarely the first problem. The problem is fragmentation. One vendor sells the VPN, another monitors endpoints, a third handles compliance paperwork, and when something odd happens at 11 p.m., nobody owns the whole picture. Each tool may be fine on its own. The gaps between them are where attackers and auditors find you.
Our view is that remote work security works best when identity, devices, monitoring, backup and compliance are designed together and run by people who can see all of it. That is why we bring cybersecurity, IT management and compliance under one provider, with one SLA and one point of accountability. Detection and response get faster when the team watching alerts is the same team that manages the endpoints and knows your cloud setup.
We also push clients toward a phased approach. Rushing Zero Trust into a live environment breaks workflows and teaches staff to route around controls. Starting with email, admins and the two or three systems that would hurt most to lose gives you a real reduction in risk within a quarter, and a clear base to build on.
Finally, we think pricing should be as predictable as the protection. Flat monthly fees with no surprise invoices let a small business budget for security the way it budgets for rent.
— Nick - Sr. Executive
Getting help securing a distributed team
If you would rather not stitch this together yourself, Nexus offers managed cybersecurity with 24/7 threat detection, managed IT, cloud and network services, and compliance and risk assessments for frameworks such as SOC 2, HIPAA, PCI-DSS and ISO 27001, all under one contract. You can see the full list on our services page, or start from the Nexus home page to tell us how your team works today.
FAQ
How do you maintain security when employees work remotely?
Combine technical controls with habits. Use phishing-resistant MFA, managed and updated devices, isolated access for personal devices, and offline or segmented backups. Then train staff to report suspicious messages quickly and without fear of blame.
What is remote work security?
It is the set of policies and tools that protect company data and systems when people work outside the office. The focus has shifted from defending a network perimeter to verifying each user, device and request, which is the idea behind Zero Trust.
Can you be 100% secure while working remotely?
No, and no office is either. The aim is to make attacks hard, limit the damage when one succeeds, and recover quickly. Tested backups, fast detection and a rehearsed response plan matter as much as prevention.
Is a VPN enough to secure remote workers?
Not on its own. A VPN encrypts the connection but does not check who the user really is or whether the device is healthy. NIST's Zero Trust guidance recommends continuous verification instead of trust based on VPN membership, and unpatched VPN appliances are a known ransomware entry point.
What must healthcare organizations do for remote staff?
Perform and document a risk assessment for any remote access to e-PHI, and apply safeguards such as automatic logoff or record an equivalent alternative. A written remote work policy alone will not satisfy HIPAA in an audit.
Sources
- Implementing a Zero Trust Architecture, NCCoE
- 10 Remote Work Cybersecurity Risks and How to Prevent Them, TechTarget
- Capacity Enhancement Guide: Counter-Phishing Recommendations for Federal Agencies, CISA
- #StopRansomware: Ghost (Cring) Ransomware, CISA
- Guide to Enterprise Telework, Remote Access, and BYOD Security, NIST
- Phishing Guidance: Stopping the Attack Cycle at Phase One, CISA
- Security Rule access control and telecommuting FAQ, HHS
- Educating patients about privacy and security risks in telehealth, HHS