How to Work Remotely and Securely

Remote work offers flexibility and convenience, but working outside the office can introduce additional cybersecurity risks.

When you work from home, a hotel, coffee shop, airport, or another location, you may be connecting to business systems from networks and environments that your organization doesn't directly control. A lost laptop, compromised account, phishing message, or unsecured network can potentially expose sensitive information.

The good news is that secure remote work doesn't have to be complicated. Using strong authentication, keeping devices updated, protecting your Wi-Fi connection, recognizing phishing attempts, and following your organization's security policies can significantly reduce common risks.

Whether you're working remotely every day or occasionally checking email while traveling, these practices can help you work more securely.

What are the security risks of remote work?

Remote workers can face many of the same cybersecurity threats as employees working in an office. However, working outside a managed corporate environment can introduce additional challenges.

Common threats include:

• Phishing: Fraudulent messages designed to steal passwords, financial information, or other sensitive data.
• Malware: Malicious software that can steal information, damage files, or provide unauthorized access to a device.
• Credential attacks: Attempts to obtain or guess passwords and other authentication information.
• Unsecured networks: Public or poorly secured Wi-Fi networks can create opportunities for attackers to intercept or manipulate network traffic.
• Lost or stolen devices: A laptop or smartphone containing business information can become a security risk if it isn't properly protected.
• Unapproved applications and services: Employees may accidentally expose company information by using unauthorized software, cloud storage, or file-sharing services.
• Social engineering: Attackers may manipulate employees into revealing information or performing actions that compromise security.

Remote work security therefore needs to address more than the internet connection. Your identity, device, applications, data, and physical environment all matter.

1. Use a company-managed device when possible

If your organization provides a laptop or other device for remote work, use it whenever possible.

Company-managed devices can have security controls that aren't available on a personal computer, such as:

• Managed security software
• Automatic software updates
• Device encryption
• Endpoint protection
• Security policies
• Access controls
• Remote management
• Secure configuration settings

Avoid using a personal computer for sensitive business activities unless your organization's policies specifically allow it.

If your organization permits employees to use personal devices, follow its BYOD requirements and keep personal and business information appropriately separated.

2. Protect your accounts with multi-factor authentication

A strong password is important, but a password alone may not be enough to protect an account.

Multi-factor authentication (MFA) requires additional verification when you sign in. Depending on the service, this could involve an authenticator app, security key, passkey, smart card, or biometric authentication.

MFA can help protect your accounts if your password is stolen through phishing or another attack.

Whenever your organization supports it, use MFA for:

• Business email
• Cloud storage
• Collaboration tools
• Financial systems
• Company applications
• Remote-access services
• Administrative accounts

For particularly sensitive accounts, organizations should consider phishing-resistant authentication methods where available.

3. Create strong, unique passwords

Don't reuse your business password for personal accounts or use the same password across multiple services.

If one account is compromised, reused credentials can give an attacker a way into other accounts.

Consider using a reputable password manager to generate and store unique passwords.

Good password practices include:

• Use long, unique passwords or passphrases.
• Don't reuse passwords between accounts.
• Avoid predictable information such as names and birthdays.
• Never share passwords with coworkers.
• Don't send passwords through email or text messages.
• Use MFA whenever available.
• Consider passkeys or other phishing-resistant authentication methods when supported.

You don't need to memorize dozens of complicated passwords. A password manager can handle much of the work for you.

4. Keep your laptop and software updated

Software updates frequently include security fixes for known vulnerabilities.

Before working remotely, make sure your:

• Operating system
• Web browser
• Applications
• Security software
• Device firmware

are up to date.

Whenever possible, enable automatic updates for supported software.

Don't ignore update notifications simply because you're busy. A device that hasn't received important security fixes can be more vulnerable to attacks.

5. Secure your home Wi-Fi

Your home network is part of your remote-work environment.

Start by making sure your router is using a strong administrator password and current security settings. Use modern Wi-Fi security such as WPA3 when supported by your equipment. If WPA3 isn't available, use WPA2 with a strong password.

You should also:

• Change the router's default administrator credentials.
• Keep router firmware updated.
• Use a strong Wi-Fi password.
• Avoid sharing your business network credentials.
• Separate guest devices from your primary network when possible.

If you're unsure how to secure your home router, check the manufacturer's current instructions or contact your internet service provider.

6. Be careful when using public Wi-Fi

Public Wi-Fi can be convenient, but don't assume that every network is trustworthy.

Attackers can create networks with names designed to resemble legitimate Wi-Fi networks at hotels, airports, coffee shops, and other public locations.

When working remotely:

• Verify the network name before connecting.
• Avoid performing sensitive tasks on unfamiliar networks when possible.
• Use your organization's approved secure-access tools.
• Turn off automatic Wi-Fi connections.
• Avoid leaving your device connected when you aren't using the network.
• Use your mobile hotspot when appropriate.

HTTPS encryption protects many web connections, but it doesn't make every public network trustworthy. Continue to follow your organization's security requirements even when a website shows a secure connection.

7. Use a VPN when your organization requires one

A VPN, or virtual private network, creates an encrypted connection between your device and a VPN server.

Organizations may use VPNs to provide employees with secure access to internal systems and resources from outside the office.

A VPN can help protect network traffic from certain types of interception, but it isn't a complete cybersecurity solution.

A VPN does not automatically:

• Protect you from phishing
• Prevent malware
• Secure a compromised account
• Make an unsafe website legitimate
• Protect against every type of cyberattack

If your employer provides a VPN, use the company's approved service and follow its instructions.

For personal VPN services, understand what the service actually protects and what information the provider may collect before choosing one.

8. Learn how to recognize phishing

Phishing is one of the most common threats remote workers encounter.

A phishing message may appear to come from your employer, a coworker, a customer, a vendor, a financial institution, or another familiar organization.

Be cautious when a message:

• Creates a sense of urgency
• Requests a password or authentication code
• Asks you to open an unexpected attachment
• Contains a suspicious link
• Requests an unusual payment
• Asks you to change payment information
• Appears to come from an executive but makes an unusual request

If something seems unusual, verify it using another communication method.

For example, if your manager sends an unexpected message asking you to purchase gift cards, don't simply reply to the message. Contact your manager through a known phone number or another established communication channel.

For more information, see How to Identify Phishing Emails and Protect Your PC.

9. Protect sensitive business information

Remote work can make it easier to accidentally expose confidential information.

Think about what information you're accessing and who might be able to see it.

When working remotely:

• Lock your screen whenever you step away.
• Avoid leaving sensitive documents visible.
• Don't save confidential files to unauthorized personal services.
• Use approved company applications and cloud storage.
• Verify recipients before sending sensitive information.
• Follow your organization's data-classification policies.
• Dispose of printed sensitive information securely.

If you work in a public place, pay attention to who can see your screen.

A privacy screen can also help reduce visual exposure when you're working with sensitive information in shared spaces.

10. Protect your physical workspace

Digital security isn't the only consideration when working remotely.

Someone who can physically access your computer may be able to access information stored on it, depending on the device's security configuration.

Keep your work device secure by:

• Locking your screen when you step away.
• Keeping laptops with you while traveling.
• Avoiding unattended devices in vehicles.
• Using a secure bag when transporting equipment.
• Keeping sensitive documents out of public view.
• Using device encryption where available.

If your laptop is lost or stolen, notify your organization's IT or security team immediately.

11. Be careful with removable storage

USB drives and other removable storage devices can introduce security risks.

Don't connect an unknown USB drive to your work computer. It could contain malware or other unwanted software.

Use company-approved removable storage when required and follow your organization's policies for transferring sensitive information.

Cloud storage can also introduce risk if employees use unauthorized services to store or share business files. Use the platforms approved by your organization.

12. Separate work and personal activities

Keeping work and personal computing separate can reduce the chance of accidentally exposing business information.

For example, avoid:

• Using personal email to send confidential business files.
• Uploading company documents to personal cloud storage.
• Installing unapproved applications on a managed work computer.
• Using personal accounts to access sensitive company systems.
• Copying business information to personal devices without authorization.

Your employer may have specific policies governing these activities, so follow those requirements.

13. Secure video meetings and collaboration tools

Remote work often depends on video conferencing, messaging, and collaboration platforms.

Use the security settings provided by your organization's approved services.

Depending on the platform, this may include:

• Requiring meeting passwords or authentication
• Controlling who can join meetings
• Restricting screen sharing
• Managing recording permissions
• Controlling file-sharing access
• Removing former employees from groups and accounts

Be careful about discussing sensitive information in public locations where conversations can be overheard.

14. Back up important files

Backups can help you recover from incidents such as ransomware, accidental deletion, hardware failure, or other data loss.

If you're using a company-managed device, follow your organization's backup policies rather than creating your own unauthorized backup system.

Businesses should maintain appropriate backups of important information and regularly test that those backups can actually be restored.

15. Know what to do if something goes wrong

Even with good security practices, mistakes and security incidents can happen.

If you accidentally click a suspicious link, download an unexpected attachment, lose your laptop, or believe your account has been compromised, report it immediately.

Don't wait because you're embarrassed or worried about getting in trouble.

Early reporting can give your organization's IT or security team more time to:

• Secure the affected account
• Disconnect a compromised device
• Reset credentials
• Investigate the incident
• Protect other systems
• Recover affected information

Knowing how to report an incident should be part of your organization's remote-work security training.

What laptop is best for remote work?

The best laptop for remote work depends on your job, applications, mobility needs, and organization's security requirements.

For business users, look for a laptop that combines the performance you need with features designed to help protect the device and the information stored on it.

Important considerations can include:

• Security: Look for hardware and software security features that help protect the device from common threats.
• Performance: Choose a processor and memory configuration appropriate for your applications and workload.
• Battery life: Longer battery life can be useful when working away from a power outlet.
• Portability: A lighter laptop can be easier to carry between home, the office, and travel locations.
• Connectivity: Consider the ports and wireless connectivity you need for your peripherals and work environment.
• Camera and audio: A quality webcam and microphone are useful for video meetings and collaboration.
• Display: Choose a display size and resolution that fit the way you work.

For example, HP business laptops can include security technologies designed to help protect devices, firmware, identities, and data.

Explore HP business laptops to compare options based on your organization's needs.

Remote work security checklist

Before starting your next remote-work session, check that:

• Your laptop and applications are updated.
• Your device is protected with appropriate security software.
• MFA is enabled on important accounts.
• You're using strong, unique passwords.
• Your home Wi-Fi is secured.
• You're using your organization's approved VPN or remote-access solution when required.
• You're cautious about unexpected emails, texts, and links.
• Your screen is protected from people nearby.
• Sensitive information is stored only in approved locations.
• Your device is locked whenever you step away.
• You know how to report a suspected security incident.

Frequently asked questions about secure remote work

Is it safe to work remotely?

Remote work can be secure when appropriate protections and policies are in place. Use managed devices when available, protect your accounts with MFA, keep software updated, use secure networks and approved remote-access tools, and follow your organization's security policies.

Do I need a VPN to work remotely?

It depends on your organization's requirements and the systems you're accessing. A company VPN can provide an encrypted connection and secure access to internal resources, but a VPN is only one part of a broader remote-work security strategy.

Is public Wi-Fi safe for remote work?

Public Wi-Fi can introduce security risks, particularly when the network is unfamiliar or improperly configured. When possible, use a trusted network or mobile hotspot and follow your organization's approved secure-access practices.

How can I protect my work laptop at home?

Keep your operating system and applications updated, use strong authentication, enable device encryption when available, lock your screen when you're away, use a secure Wi-Fi network, and follow your organization's device-security requirements.

What should I do if I lose my work laptop?

Contact your organization's IT or security team immediately. Don't wait to see whether you find the device. Your organization may be able to remotely lock, locate, or wipe a managed device and take other steps to protect company information.

What should I do if I accidentally click a phishing link?

Stop interacting with the message or website and report the incident according to your organization's procedures. If you entered a password or other sensitive information, tell your IT or security team immediately so they can help secure your account.

Work remotely with security in mind

Remote work doesn't have to mean sacrificing security.

The strongest approach is to protect every part of the remote-work environment, from the account you use to sign in and the laptop you work on to the network you connect through and the information you access.

Use MFA, keep your software updated, secure your Wi-Fi, be cautious with unexpected messages, protect your physical workspace, and follow your organization's security policies.

Most importantly, make security part of your everyday remote-work routine. A few simple habits can help protect your accounts, devices, business information, and the people you work with.