Securing a Team That Works From Anywhere

For years the plan was a firewall at the office and a network you trusted inside it. Almost none of that survives a team spread across homes, trains and somebody's parents' house in another state. The two things you still control are the account and the machine, and nearly all the useful work now sits in those two places.

The questions change with it. Who is signing in, from what device, into what. A laptop on a kitchen table with a patched operating system, an encrypted disk and a managed account is in better shape than a desktop in the office that nobody has looked at since it was installed.

That is good news for a small business, because the controls that matter are mostly settings rather than hardware. Most of what follows can be done from consoles you are already paying for, in an afternoon each.

The rest of this piece is about which of those settings are worth the friction they create, and which are theatre that costs you goodwill and buys you nothing.

Multi factor sign in on everything, with a phishing resistant method for administrators and for finance. Nothing else on this page comes close in value for the effort, and it is the one item worth arguing about.

Then conditional rules, which is where an identity platform earns its licence fee. Block sign ins from countries where you have no staff and no customers. Require a device known to be compliant before anything sensitive opens. Require a fresh check when the pattern changes: a new device, a new country, a sudden jump in location.

Watch the session lifetime setting. A long remember me window is comfortable for staff and equally comfortable for whoever steals the session token out of a browser. Keep it short for anything that matters, longer for the low value tools, and always require a fresh check before an administrative action.

Then set up alerts on the events worth waking up for. Impossible travel. A new multi factor method registered on an account. A mailbox rule forwarding outside the company. An administrative role granted to somebody. Those should reach a person, not a monthly report.

Full disk encryption on every laptop and every phone. It ships with the operating systems you already run, it costs nothing, and it is what turns a lost device into an inconvenience instead of a notification to every customer whose data was on it.

Two details separate real encryption from nominal encryption. Recovery keys have to be escrowed centrally, or you will have no way into a machine during the week its owner is unreachable. And the screen has to lock by itself after a short idle period, because encryption protects a machine that is off rather than one sitting open on a train seat.

Remote wipe is worth having and worth less than people assume. It only fires when the device comes online and is still enrolled, and anybody who took the laptop deliberately is not going to put it back on the internet in a state where that can happen. Treat it as the last step rather than as the plan.

The honest ranking is encryption first, automatic screen lock second, remote wipe third. Get the first two right and the third becomes a useful extra rather than something you are quietly relying on.

Almost every small company has staff reading work mail on a personal phone. You can pretend otherwise and write a policy nobody follows, or you can make the arrangement survivable. The second option is cheaper and it is also true.

What is worth enforcing on a personal device: work data stays inside a managed application, a passcode is required, the operating system is not several versions out of date, and you can remove the work data without touching anything else on the phone. That set is defensible, and most people accept it once it is explained.

What is not worth enforcing is full management of a phone somebody bought with their own money. It gives you the ability to wipe their photographs, it makes staff feel watched, and it pushes people to forward work mail to a personal address instead. That outcome is worse than the thing you were trying to prevent.

Write down what you can and cannot see, and hand it to people before they enrol. The sentence that defuses most of this is that the company can remove the work container and can see nothing else on the device. If that is true with your tooling, say it plainly. If it is not true, pick different tooling.

The advice about hostile public wifi has aged badly. Nearly everything is encrypted in transit now, and the classic cafe attack mostly fails against a current browser on an updated device. Warning people off public networks is not where your effort belongs.

What is still real at home is the shared environment. The family desktop that also holds the printer. Children's devices on the same network. A router still using its default administrative password, reachable by anything on that wifi. Old smart devices nobody updates. None of them reads your work traffic. They matter because a compromised device on the same network can reach a work laptop that is trusting its local subnet.

So the useful advice is short. Keep the laptop firewall on for home networks as well as public ones. Do not let the work machine treat its local network as trusted. Change the router password. Do not print anything sensitive on a shared machine.

A company VPN has genuine uses: reaching an internal application that was never published safely, or applying a filtering policy that has to run everywhere. Sold as protection on public wifi it is mostly theatre, and a full tunnel that routes all home traffic through your office adds a failure point and a support burden. Use one where you have a specific job for it.

The sequence matters more than the tooling, and it should fit on one page pinned somewhere findable. Somebody rings a number and says the words. What happens next should not depend on who happens to pick up.

Disable the account and revoke every session and refresh token. Mark the device lost in the management console and issue the wipe so it fires whenever the machine next appears. Reset the password and any application passwords. Then look at what was signed in on that machine and rotate whatever was cached there.

Then work out what was actually on it. Local files, a synced drive folder, a mailbox cached for offline use, and browser saved passwords if you left that feature enabled. Where the disk was encrypted and the machine was locked, the answer to most of these questions is that none of it is readable, and that is precisely why the encryption is there. Record it either way. A lost device deserves a short written note with the date, the device, what was on it and the actions taken. If anybody ever asks a question about that machine, whether a customer, an insurer or a regulator, the note is your answer.

The old model was a server on the office network pushing updates to machines that came back every day. It does not work for a team who may not touch anything of yours for months at a time.

Move update management into the cloud console for your platform, set a policy with a deadline and a small deferral window so people can finish what they are doing, and make the machine report its state back. Then read the compliance report and chase the stragglers, because there are always stragglers and they are usually the machines that matter.

The lever that works is access rather than nagging. When a device that is behind on updates loses access to company data until it catches up, patching stops being a conversation and becomes a background task. Introduce that gently, with warnings before enforcement, or you will spend a week on the phone.

Browsers and self installed applications need the same treatment. On a remote laptop the operating system is usually the best patched thing on the machine, and the browser extension somebody added in a hurry during a busy week is usually the worst.

Worth the friction: multi factor everywhere, disk encryption with escrowed recovery keys, automatic screen lock, endpoint protection that reports to a console somebody reads, removal of local administrator rights, patching with a deadline behind it, a password manager, and a backup of anything that only exists on a laptop.

Worth much less: forced password changes on a schedule, which mostly produce a predictable pattern with a number on the end. Blanket bans on personal webmail, which people route around within a fortnight. Blocking every USB device without asking what the warehouse actually needs. The yearly training video. A VPN bought as a security product with no specific job to do.

The test is whether the control changes what an attacker has to do. Rotating passwords on a schedule does not, because a stolen password gets used the same afternoon it is taken. Encryption does, because it makes a stolen laptop worthless. Apply that test to your own list and a few items will not survive it.

Then be honest with your team about the ones that do survive. People accept friction when they understand the reason and can see that it applies to the directors as well. A control quietly waived at the top is a control nobody further down takes seriously either.