Learn / Small business security
Secure remote and hybrid work
How to keep laptops, home networks, video calls and cloud files safe when your team works from home, cafes and the road.
The new office perimeter
When everyone sat in one building, the office firewall was the boundary. Now the boundary is each person's laptop, phone and login. A small team might have staff on home Wi-Fi shared with gaming consoles and smart TVs, on hotel networks, and on personal phones that also hold work email. The goal of remote work security is to make each device and account safe on its own, wherever it is.
Secure the device first
Company laptops should have, at a minimum:
- Full-disk encryption (BitLocker on Windows, FileVault on macOS) so a lost or stolen laptop does not leak client data.
- Automatic operating system and browser updates, with restarts actually happening. See software updates.
- Built-in protection switched on: Microsoft Defender or macOS XProtect plus the firewall. Our built-in antivirus guide explains when that is enough.
- A screen lock of five minutes or less, and a habit of locking the screen (Windows key + L, or Control + Command + Q on a Mac) when stepping away.
- Standard user accounts for daily work, with admin rights only when needed.
- Remote wipe and locate, through a device management service such as Microsoft Intune, Google endpoint management or Apple Business Manager with an MDM provider.
Personal devices (BYOD)
Many small businesses let staff read email on personal phones. That is workable with a few rules: the phone must have a passcode and current updates, work apps should be managed so you can remove company data without wiping personal photos, and lost phones must be reported the same day. Microsoft 365 and Google Workspace can both enforce basic phone rules for work accounts.
Home and public networks
| Situation | Risk | What to do |
|---|---|---|
| Home router with default password | Neighbors or malware change settings | Change the admin password, enable WPA2 or WPA3, update firmware |
| Old router no longer updated | Known flaws never fixed | Replace it; routers have a finite support life |
| Cafe or hotel Wi-Fi | Fake hotspots, snooping on unencrypted traffic | Use a phone hotspot or a company VPN; confirm sites use HTTPS |
| Shared family computer | Other users, unknown software | Do not use it for work; use the work laptop only |
Most important services already encrypt traffic with HTTPS, so the main value of a VPN today is reaching internal company systems and hiding traffic from an untrusted local network. A VPN does not protect you from phishing or malware. If your business only uses cloud apps, strong MFA and device security matter more than a VPN.
Cloud apps and file sharing
- Use one approved place for files (OneDrive, Google Drive, Dropbox or similar) rather than personal accounts and USB sticks.
- Share with named people, not "anyone with the link", and set expiry dates on external shares.
- Turn on MFA and sign-in alerts for the cloud platform, and review unusual sign-in reports monthly.
- Review third-party app permissions. OAuth apps connected to your Microsoft or Google tenant can read mail and files. Remove any you do not recognize.
Video calls and conversations
Lock meetings with passcodes or waiting rooms, avoid posting meeting links publicly, and be aware of what is visible on screen when you share it. Remote work has also increased voice and video impersonation: if "the boss" calls from an unknown number asking for an urgent payment or a password, hang up and call back on the known number. That rule matters even more as voice cloning gets cheaper.
A remote-work policy on one page
Write down, in plain English:
- Which devices may access company data, and what each must have (encryption, updates, screen lock).
- Where company files live and how they may be shared.
- What to do if a device is lost or stolen, and who to tell within the hour.
- That staff should never approve an MFA prompt they did not start, and should report surprise prompts.
- How to get help, including outside office hours.
Ship new laptops pre-configured from your device management service. It is faster than setting each one up by hand and guarantees encryption and updates are on from day one.
