How to Set Up Cyber Protection for Remote Workers
1. Start With a Remote Worker Cybersecurity Policy
Before installing security software, establish clear rules.
A remote-work cybersecurity policy should tell employees what they can access, which devices they can use, how they should protect company information and what to do when something suspicious happens.
Your policy should cover:
• Approved devices for work
• Acceptable use of company systems
• Password and authentication requirements
• Multi-factor authentication
• Remote-access requirements
• Personal-device or BYOD rules
• Data storage and sharing
• Software installation
• Public Wi-Fi usage
• Security incident reporting
• Lost or stolen devices
• Employee offboarding
NIST’s telework guidance emphasizes that organizations should secure the different components involved in remote access, including employee devices, remote-access technologies and systems being accessed.
My editorial take: A policy nobody understands is almost as ineffective as having no policy. Keep the rules practical enough that an employee can actually follow them during a normal workday.
2. Protect Remote Workers With Multi-Factor Authentication
Passwords are no longer enough to protect important accounts.
A password can be stolen through phishing, reused from another breached service, guessed, or exposed through malware.
Multi-factor authentication (MFA) adds another verification step before access is granted.
For remote workers, MFA should be enabled wherever practical, particularly for:
* Company email
* Cloud storage
* Remote-access systems
* Business applications
* Administrator accounts
* Financial systems
* Customer databases
CISA recommends requiring MFA for remote access and privileged accounts, while encouraging organizations to use stronger, phishing-resistant methods where available.
The important point is not simply to “have MFA.”
The organization should make it part of its access policy.