Remote work
security

The new map: the office is everywhere

When work happens at home, on the train and at the café, there is no "inside of the network" left to trust. The classic model — VPN into the office, then free rein — relied on everything inside the wall being friendly. That assumption died with remote work: a single phished employee on home WiFi is "inside the wall".

This shift is what's driving the industry away from pure VPN solutions: analyst firm Gartner has for years predicted that the majority of corporate remote access will be replaced by ZTNA (zero trust network access) solutions in the coming years — with forecasts pointing toward 2027 for broad rollouts.

Zero trust — without the buzzwords

Behind the buzzword sits a simple principle, formalised in NIST SP 800-207: never trust the location — verify every access. Concretely:

• No safe zone: being "on the office network" or "inside the VPN" grants no automatic rights.
• Every request is tested: who are you (MFA), which device (is it updated and encrypted?), what are you trying to reach, and is it plausible right now?
• Least possible access: the finance system for finance, the code for the developers — not everything for everyone.

Recognise the principles? It's this course's advice at company scale — and CISA's maturity model shows the journey there is incremental too: you start with MFA and device checks, not by tearing everything down.

BYOD: the minimum list for personal computers at work

If you (or your employees) use personal equipment for work — "bring your own device" — a minimum list applies before company data may touch the device:

1. Disk encryption on (BitLocker/FileVault — episode 9).
2. Screen lock and strong login (episodes 2 and 8).
3. Automatic updates on — and an operating system that still receives them (episode 5).
4. Separate accounts: a work profile distinct from personal — its own browser profile as a minimum, its own OS account ideally. The family's shared computer is not a work computer.
5. Company data in the company's cloud — not in private Dropbox folders. Partly security, partly GDPR (episode 14).
6. A plan for loss: remote lock/wipe enabled (episode 8), and the employer knows which devices have access.

The tools: MFA, SSO, conditional access, MDM

Tool	What it does	For whom
MFA	Episode 3 in company form — mandatory on all work accounts. The single most important measure.	Everyone, from one-person companies
SSO	One login for all company services. Fewer passwords, one point to protect (with MFA) — and one button to shut everything off when someone leaves.	From ~5 employees
Conditional access	Rules on top of the login: only updated devices, only plausible locations, extra verification on anomalies. Zero trust in practice.	Companies with sensitive data
MDM	Central device management: enforce encryption, push updates, wipe lost devices. Microsoft Intune (included in several Microsoft 365 plans, otherwise ~€10/user/mo) or Jamf for Apple environments.	From ~10 devices

The home network as a company risk — and the routine document

Company security is now the sum of employees' home networks. The router with the default password (episode 10), the kids' gaming PC on the same network as the work laptop, the IoT gadgets (episode 13) — all suddenly sit one network hop from company data. The solution isn't inspecting employees' homes, but assuming the network is hostile (zero trust again) and securing the device and the access instead.

Also put the routines in writing — a one-page routine document goes a long way for a small company:

• Which devices may be used for work, and what requirements apply (the minimum list above).
• Where company data may be stored — and where it must not end up.
• How suspicious emails and incidents are reported, to whom, and that prompt reporting is never punished (episode 16 covers the rest).
• What happens at offboarding: which accounts are closed, what equipment is returned (more in episode 17).

Sources

Want to dig deeper? These are the sources behind this episode.

1. NIST — SP 800-207: Zero Trust Architecture — the standard document.
2. Gartner — Zero Trust Network Access (ZTNA) — definition and market forecasts.
3. CISA — Zero Trust Maturity Model — the incremental path there.
4. Microsoft — Intune — MDM and conditional access.
5. Jamf — jamf.com — device management for Apple environments.
6. MSB — msb.se — information security guidance for organisations.
7. CERT-SE — cert.se — advice and alerts for Swedish organisations.