954-539-5678Free audit
Menu

Cybersecurity · Remote work

How to keep remote and hybrid staff secure without slowing them down

The five layers that matter for remote work: the device, the sign-in, the connection, the files and the home network.

Manage every device that touches data

Require MFA and conditional access

Share files without email attachments

Get your free Technology Health Assessment

30 minutes of data collection, your report the next day, yours to keep with no obligation. Or pick a time now. Or call 954-539-5678.

The short answer

The remote work security best practices that matter most are: give remote staff company-managed devices, require multi-factor authentication (MFA) on every account, control access with sign-in policies rather than a wide-open VPN, keep files in managed cloud storage instead of personal drives and email attachments, and set a few simple rules for home Wi-Fi and public networks.

For a business with 10 to 100 employees, these are achievable in weeks with tools you probably already pay for in Microsoft 365 or Google Workspace. The rest of this guide walks through each layer, what good looks like and the order to tackle it.

Why remote work changes the risk

In an office, the network, the firewall and the IT person’s eyes did some of the security work. At home, an employee may share a router with smart TVs and children’s gaming consoles, print to an unknown printer and log in from a café. NIST’s telework guide (SP 800-46) makes the core point: treat remote devices and networks as untrusted, protect the device itself and limit each person’s access to what they actually need.

The practical upshot is that security has to travel with the person and the device, not sit at the office door.

Layer 1: the device

Unmanaged personal laptops are one of the most common gaps. A company device you can manage centrally gives you control over the basics.

  • Central management. Enroll laptops in a tool such as Microsoft Intune or Google endpoint management so you can push settings, apps and updates, and wipe a lost machine.
  • Automatic updates. Operating system and browser updates on a schedule, with a deadline after which the device restarts.
  • Endpoint protection. Modern antivirus with detection and response, reporting to someone who reads the alerts.
  • Disk encryption. BitLocker or FileVault, so a stolen laptop does not mean stolen data.
  • Screen lock and no shared logins. Each person signs in as themselves, and the screen locks after a few minutes.
  • A clear rule for personal phones. If staff read email on their own phones, use app-level protection so company data can be removed without touching personal photos.

Layer 2: the sign-in

Stolen passwords remain one of the most common ways in. CISA recommends MFA for every account and phishing-resistant MFA where possible.

  • MFA on email, file storage, accounting, the CRM, payroll and remote access, not just email.
  • Authenticator apps or security keys rather than text-message codes for anyone with access to money or sensitive data.
  • Conditional access rules: for example, Microsoft Entra conditional access can allow sign-ins only from managed devices, block countries you do not do business in, or require stronger checks for risky sign-ins.
  • A password manager for shared vendor logins, so nobody keeps passwords in a spreadsheet or a sticky note.
  • Quarterly access reviews so people only have the access their current role needs.

Layer 3: the connection

Many small businesses still run a VPN that drops remote users onto the whole office network. That made sense when everything lived on an office server. Today, most work lives in cloud apps, and there are better options.

  • Cloud apps directly with conditional access. If your files are in SharePoint, OneDrive or Google Drive, staff can connect directly with MFA and device checks, no VPN needed.
  • Zero trust network access for what is left. If you still have an on-premises server or line-of-business app, a modern access tool can expose just that app to approved users instead of the whole network.
  • If you keep a VPN, patch it promptly, require MFA and limit which internal systems each group can reach. Remote access devices are a frequent target for attackers.
  • No remote desktop open to the internet. Exposed remote desktop ports are a well-known entry point for ransomware.

Want a clear picture of your remote setup? Our free Technology Health Assessment takes about 30 minutes of data collection. The next day you get a plain-language report rating your IT operations, cybersecurity, applications, integration, automation and business continuity, with a short list of next steps in order. It is yours to keep, with no obligation. Book your assessment.

Layer 4: the files

  • Keep company files in managed cloud storage, not on desktops, USB drives or personal Dropbox accounts.
  • Share links with named people and an expiry date instead of attaching files to email.
  • Turn off or restrict anonymous “anyone with the link” sharing for sensitive folders.
  • Back up cloud data with a separate backup service. Microsoft 365 and Google Workspace retention is not the same as a backup you can restore from on your terms. Our guide to backup and disaster recovery explains the difference.
  • Label or restrict folders holding client financial, health or HR data.

Layer 5: the home network and public Wi-Fi

You cannot manage every employee’s router, but you can set simple expectations and make them easy to follow.

  1. Change the router’s default admin password and keep its firmware updated, or replace a router that no longer receives updates from its maker.
  2. Use WPA2 or WPA3 encryption with a strong Wi-Fi password.
  3. Put smart TVs, cameras and game consoles on a guest network if the router supports it.
  4. On public Wi-Fi, use a phone hotspot or the company’s secure access tool, and avoid signing in to banking or payroll.
  5. Lock the screen when stepping away, even at home, and keep work devices away from family use.

Common gaps in remote setups

  • Former employees still signed in on personal phones months after leaving.
  • A shared admin account used by several people with no MFA.
  • Files synced to personal cloud accounts because the company option was confusing.
  • Laptops that have not installed updates in months because nobody forced a restart.

A 30-day rollout plan

  1. Week 1: List every remote worker, their devices, the apps they use and where their files live.
  2. Week 2: Turn on MFA for every account and enroll company laptops in device management.
  3. Week 3: Move stray files into managed storage, tighten sharing settings and confirm backups cover cloud data.
  4. Week 4: Add conditional access, retire or lock down the VPN, publish a one-page remote work policy and run a short training session.

Write down how you will handle the day someone leaves: who disables accounts, who recovers the laptop and which shared passwords change. Our employee offboarding checklist covers this step by step.

How JLB USA helps

JLB USA’s managed IT supports businesses with roughly 25 to 100 employees, including remote and hybrid teams: computers, Microsoft 365 and Google Workspace, backups with tested restores and help desk replies within 5 minutes by email or phone. Remote support is available everywhere, with on-site support in Atlanta, Birmingham and Chattanooga. Our cybersecurity services add MFA, access reviews, endpoint protection, encryption and email security.

Keep reading

Book it now

Pick a time for your 30 minutes

Choose a slot that suits you. We’ll confirm by email, collect the data with you on the call, and send your report the next day. It’s free, and the report is yours to keep with no obligation.

Prefer to talk first? Call 954-539-5678, or send the form and we’ll contact you.

Questions we hear

Do remote employees need a VPN?

Not always. If your files and apps are in the cloud, direct access with MFA and device checks is often simpler and safer. A VPN or zero trust access tool is still useful for on-premises servers and older applications.

Should employees use personal computers for remote work?

It is safer to issue company-managed laptops. Personal computers are hard to update, protect and wipe, and you cannot control who else uses them.

What is the single most important remote work security step?

Turn on multi-factor authentication for every account, starting with email and file storage. It blocks most attacks that rely on stolen passwords.

How do I secure employees’ home Wi-Fi?

Ask staff to change the router admin password, update firmware, use WPA2 or WPA3 and put smart home devices on a guest network. Pair this with managed devices so security does not depend on the home network alone.

Related services

Want to know where your business stands?

Pick a time for my free assessmentCall 954-539-5678