Remote work moves company data onto devices and networks the organisation does not fully control. Security in that model is therefore not a matter of one tool but of a set of decisions: whose hardware, what access, which authentication, and what happens after an incident. Below are the questions we are asked most often.
Quick Overview
What you’ll learn:
- Whether an employee may work on a personal laptop, and on what condition
- What a VPN actually changes and what it does not protect
- Why a second authentication factor matters more than forced password rotation
- What reporting an incident looks like when nobody is in the office
Who this article is for:
- Employees of companies working remotely or in a hybrid model
- Team leaders accountable for how their people work
- People setting security rules in an organisation without its own IT function
Reading time: 6 minutes
”Can an Employee Work on a Personal Laptop?”
They can, if the organisation has deliberately agreed to it and written down the conditions. The problem is not who owns the hardware but what else runs on it and who else has access. The NIST guidance on telework and personal devices (csrc.nist.gov) explicitly recommends assuming that a device outside the organisation’s control may already be compromised, and designing access so that this possibility does not mean losing data.
In practice that means three things: a separate user account on the device that household members do not log into; no local storage of company documents unless full-disk encryption is on; and access to resources through a browser or a managed client rather than by copying files to the desktop.
The most common real incident in this area is not an attack. It is a computer shared with the family on which a logged-in session to a company system was left open.
There is also a question worth settling in advance, because it only surfaces when someone leaves: how the organisation withdraws access to data from a device it does not own. If the answer is a request to delete the files voluntarily, control over the data was notional from the start. What actually works here is the absence of local copies and access solely through an account that can be disabled in one move.
”Is a VPN Enough?”
A VPN settles one thing: it secures the transmission between the device and the company network and lets you reach internal resources. It does not check whether the device is healthy, it does not stop malware, and it does not protect against someone entering their credentials on a spoofed page.
More than that, a VPN established from an infected device works exactly as designed: it gives that device a route into the company network. Treating it as the only safeguard for remote work is therefore a design error rather than a configuration oversight.
As for the home network: company traffic over a VPN is encrypted regardless of the router’s state. It is still worth changing the router’s default administrator password and turning off its remote management, because a device with factory credentials is a target in its own right. The question of public hotspots is only partly closed by a VPN — what remains is someone reading the screen, which on a train is often a more realistic risk than intercepted traffic.
”How Often Should We Force Password Changes?”
Less often than is usually assumed. The NIST authentication guidance (csrc.nist.gov) moves away from periodic forced rotation without cause, because it produces predictable passwords — suffixed with the month and reused across systems. A change is needed when there is reason to believe the password has leaked.
Two things deliver more in remote work than a rotation calendar. The first is a second authentication factor — a key, an app or a passkey; a password on its own, however long, remains one lost piece of information away from losing the account. The second is a password manager, so that every account has a different password and the employee has to remember or write down none of them.
A password manager incidentally solves a problem companies ask about separately: shared accounts for tools whose licence does not allow multiple users. A password circulating in a team chat stays there forever and stops being accountable — there is no way to establish who used it. A shared vault with controlled access does not remove the licence limit, but it does restore the ability to withdraw access from one person.
”What Do We Do if Something Happens After Hours?”
This question comes up more often than the technical ones and has the simplest answer: there must be one route for reporting, known to everyone, that works in the evening and at the weekend too. A phone number or an address for reporting a suspicious event before anyone has established whether it is actually an incident.
The accompanying rule matters just as much: reporting must not cost the reporter. If an employee who clicked a link in a fake invoice expects a disciplinary conversation, they will report it the next morning at the earliest, or never — and in this class of event the first hour is what counts. Organisations that reward reporting learn about incidents while sessions can still be revoked and passwords changed.
Read Also
- Phishing and social engineering: how to spot an attack — the most common entry route in remote work, described through concrete warning signs
- Strong Passwords and Password Managers for Teams — how responsibility is divided when rolling a password manager out to a team
- Endpoint Security: EDR, XDR and Patching a Hybrid Device Fleet — the same problem from the device-management side, for organisations with an IT function
Build Your Skills
This topic connects to the IT Security for Non-Technical Employees and Information Security courses. The first is an awareness workshop for a whole team; the second organises the rules at the level of the organisation. Contact us to match the scope.
Frequently Asked Questions (FAQ)
Should we ban working from cafes and coworking spaces?
A ban is hard to sustain and pushes the practice out of sight. Two rules work better: position the screen so it is not visible to bystanders, and lock the screen every time you step away from the device, even for a minute.
May someone send company documents to a personal mailbox to finish work in the evening?
No, and this is one of the few answers with no caveats. A document in a personal mailbox leaves the organisation’s control — it cannot be revoked and there is no way to check who it was forwarded to. If evening work is genuinely needed, the answer is remote access, not a copy.
How often should a team be trained on security awareness?
A one-off workshop depletes faster than people assume, but repeating the same material annually changes nothing either. What works better is a short induction session for new joiners plus regular, brief reminders built on events that actually happened in the organisation.
Is a personal phone with company email a problem?
It is one when the phone has no screen lock and no encryption, or when access cannot be revoked remotely after the device is lost. Those three conditions — lock, encryption, revocable access — settle this question far more than who bought the phone.