Working remotely doesn't have to mean sacrificing security
Remote and hybrid work have changed how businesses think about cybersecurity.
Employees may work from home, the office, a hotel, a coffee shop, or while traveling. They may access company applications and data from different networks and devices throughout the day.
That flexibility can be good for business, but it also changes the security challenge.
The answer isn't to make remote workers behave as though they're sitting behind an office firewall. It's to protect the people, devices, applications, and data they use wherever they work.
Modern remote-work security combines secure devices, strong identity controls, updated software, protected data, and policies that help employees recognize and respond to threats.
Why does remote work create security challenges?
Traditional office networks were often designed around a central perimeter. Employees connected from company-managed devices and accessed resources through a controlled network.
Remote work makes that model less practical.
Employees may connect from networks the business doesn't control. They may use cloud applications instead of applications hosted inside the corporate network. They may also work with sensitive information in locations where other people can see their screens or access their devices.
Remote work can therefore expand an organization's attack surface.
Microsoft recommends an identity-centric approach to secure remote work, using controls such as multi-factor authentication, device compliance checks, and policies that help ensure only authorized users and healthy devices can access organizational resources.
Start with secure devices
A remote employee's computer is an important part of your company's security strategy.
Businesses should look beyond antivirus software and consider security protections built into the device itself.
Modern business PCs can include hardware-enforced security that helps protect the system from threats targeting firmware and other parts of the device below the operating system.
For example, HP Wolf Security includes hardware-enforced protections designed to help protect HP business PCs from threats across multiple layers, including hardware, BIOS, the operating system, and applications.
Protect the firmware
The BIOS or UEFI firmware helps initialize a PC before the operating system loads. Because it operates below the operating system, firmware can be an attractive target for attackers.
HP Sure Start helps protect the BIOS by checking its integrity and restoring a known-good version if unauthorized changes are detected.
This type of hardware-level protection adds another layer to endpoint security.
Protect web browsing and files
Remote employees regularly encounter websites, downloads, email attachments, and other content that may contain threats.
HP Sure Click is designed to isolate potentially risky web content and files, helping prevent malicious content from spreading to the rest of the PC.
Layered protection like this can complement traditional endpoint security and help reduce the impact of a successful phishing or malware attempt.
Protect your screen
Remote employees may work in airports, hotels, coworking spaces, or other public locations.
A strong password won't prevent someone nearby from reading confidential information displayed on a screen.
HP Sure View is an optional integrated privacy screen available on select HP PCs that helps limit viewing angles and reduce visual exposure when working in public spaces.
Employees should also position their screens carefully and avoid displaying sensitive information where it can easily be seen.
Protect employee identities
A secure device is only one part of remote-work security.
Employees also need secure ways to prove they are authorized to access company systems.
Use multi-factor authentication
Multi-factor authentication adds another verification step beyond a password.
For example, an employee might be required to approve a sign-in using a security key, authenticator application, biometric verification, or another authentication method.
MFA can help reduce the risk associated with stolen or compromised passwords.
Consider passwordless authentication
Organizations can also consider passkeys and other passwordless authentication methods.
Windows 11 supports passkeys using technologies such as Windows Hello and FIDO2. Passkeys use cryptographic credentials rather than requiring users to enter a traditional password during sign-in.
Where supported by the organization's applications and identity provider, passwordless authentication can reduce exposure to password-based phishing attacks.
Keep devices and software updated
Remote employees still need the same security updates as employees working in an office.
Make sure devices receive:
- Operating system updates
- Browser updates
- Application updates
- Firmware and BIOS updates
- Security software updates
Businesses should establish a process for monitoring device compliance rather than relying entirely on employees to remember when updates are needed.
Protect company data
Remote workers may access sensitive information from many different locations and applications.
Businesses should identify what data is sensitive and determine how it should be stored, shared, accessed, and protected.
Important controls can include:
- Encryption for sensitive data
- Access controls based on job responsibilities
- Secure cloud storage
- Data loss prevention policies
- Regular backups
- Controlled file sharing
- Secure disposal of devices and data
The goal is to make sure sensitive information remains protected even when an employee isn't physically inside a corporate office.
Don't rely on the office network as your primary defense
One of the biggest changes in remote-work security is the move away from treating the corporate network as the main security boundary.
A remote employee may never connect directly to the traditional corporate network. Instead, they might access cloud applications from a home network or mobile connection.
That means security controls need to follow the user and device.
A modern approach considers questions such as:
- Who is requesting access?
- What device are they using?
- Is the device managed and up to date?
- What application are they accessing?
- What information are they trying to access?
- Does the request meet the organization's security requirements?
This approach is consistent with Zero Trust principles, which emphasize verifying access rather than automatically trusting a user or device because of where they are connecting from. Microsoft's secure remote-work guidance specifically recommends protecting users, devices, applications, and data regardless of location.
Don't forget the home network
Businesses may not control an employee's home network, but they can still provide security guidance.
Employees should:
- Use a strong password for their home Wi-Fi network
- Keep their router firmware updated
- Use the router's current security settings
- Avoid sharing work credentials with family members
- Keep company devices separate from unauthorized users when possible
- Avoid using public Wi-Fi for sensitive work unless appropriate security controls are in place
Businesses should also establish clear policies for connecting to company resources from personal devices and networks.
Build clear security policies
Technology alone can't protect a remote workforce.
Employees need clear expectations about how they should handle company devices, accounts, data, and communications.
A remote-work security policy should address topics such as:
Device use
Define which devices employees can use for company work and what security requirements those devices must meet.
Authentication
Require appropriate authentication controls, including MFA where available.
Software
Establish expectations for updates and approved applications.
Data
Explain how employees should store, share, print, and dispose of sensitive information.
Phishing
Teach employees how to recognize suspicious messages and where to report them.
Lost or stolen devices
Employees should know exactly what to do if a company laptop, phone, or other device is lost or stolen.
Personal devices
If employees are allowed to use personal devices for work, establish clear requirements for security, access, and company data.
Printers are endpoints, too
Remote-work security often focuses on laptops and phones, but printers can also handle sensitive information.
Employees may print financial documents, customer information, contracts, employee records, or other confidential material.
Businesses can reduce this risk by using security features such as authentication and secure print release, where employees must verify their identity before a document is released.
It's also important to keep business printers updated and restrict administrative access.
What should a remote-work security plan include?
A practical plan can be organized around several basic areas:
1. Secure the device
Use managed business PCs with appropriate hardware, firmware, operating system, and endpoint protections.
2. Secure the identity
Use strong authentication, MFA, and passwordless options where appropriate.
3. Secure the connection
Use approved methods for accessing company applications and resources from remote locations.
4. Secure the data
Use encryption, access controls, backups, and appropriate data-handling practices.
5. Secure the applications
Keep software updated and limit employees to approved applications and services.
6. Train employees
Teach employees how to recognize phishing, social engineering, suspicious downloads, and other common threats.
7. Monitor and respond
Know how to identify unusual activity and have a clear process for reporting and responding to security incidents.
Remote work and security can work together
Remote work doesn't have to create a choice between flexibility and cybersecurity.
The security model simply needs to match the way people work today.
Instead of assuming that everything inside an office network is safe and everything outside it is risky, businesses can build security around people, devices, applications, and data.
That means using secure devices, strong identity controls, current software, protected data, employee awareness, and policies that help employees work securely wherever they are.
For businesses managing HP PCs, HP Wolf Security provides a range of hardware and software security capabilities designed to protect endpoints across the device lifecycle, from deployment and daily management through retirement.
The goal isn't to make remote work less flexible. It's to make secure work possible from wherever business happens.
Frequently Asked Questions
Is working from home less secure than working in an office?
Not necessarily. Remote work changes the security environment, but organizations can protect remote employees with appropriate identity, device, application, and data security controls. Modern security approaches focus on protecting users and devices regardless of where they connect from.
What is the most important security measure for remote workers?
There isn't one security measure that protects against every threat. Businesses should use multiple layers, including MFA, secure and updated devices, endpoint protection, encryption, access controls, employee training, and incident-response procedures.
Should remote employees use a VPN?
A VPN can be appropriate for specific business applications and network architectures, but it isn't a complete remote-work security strategy. Modern cloud and Zero Trust environments may use other controls to secure access to applications and data. Organizations should follow their IT department's approved access methods.
How can I protect a work laptop at home?
Keep the operating system and applications updated, use strong authentication, enable encryption where provided, lock the device when you're away, protect the device from unauthorized users, and follow your organization's security policies.
Are passkeys secure for remote work?
Passkeys use public-key cryptography and can provide a phishing-resistant alternative to traditional passwords when supported by the service being accessed. Windows 11 supports passkeys through Windows Hello and other compatible authentication methods.
What should I do if my work laptop is lost or stolen?
Notify your IT or security team immediately and follow your organization's incident-response process. Businesses may have tools that can lock, locate, or erase a managed device remotely. HP Protect and Trace with Wolf Connect, for example, is designed to help locate, lock, and erase supported HP PCs remotely, including when a PC is powered down or offline.
What is Zero Trust?
Zero Trust is a security approach that doesn't automatically trust a user or device based on its location. Instead, access is evaluated using factors such as identity, device security, application, and policy. This approach is particularly relevant to organizations supporting remote and hybrid work.
