October 15. Access Control: Securing Your Home Office (Working From Home)

The shift to remote work has transformed how we work, but also introduces new cyber security challenges, particarly around access control in a less structured environment, like a home office.  When working off site,  your personal network and devices become potential entry points into your organisation's systems, making robust access control crucial.

Key considerations for secure remote work access control:

Strong Network Security:

🔑 Secure Home Wi-Fi: Ensure your home Wi-Fi uses strong encryption (WPA2/WPA3), a strong, unique password for the router, and a separate guest network if possible.

🔑 VPN (Virtual Private Network): Always use a company-provided VPN to connect to internal company resources. A VPN encrypts your traffic, creating a secure tunnel between your device and the corporate network, protecting data from interception on your home network or public Wi-Fi.

Device Security:

🔑 Company-Issued Devices: Ideally, use company-issued laptops or devices for work. These are typically configured with enterprise-grade security software, encryption, and centralised management.

🔑 Personal Device Policy (BYOD): If using personal devices (Bring Your Own Device - BYOD), ensure they meet company security standards (e.g., up-to-date OS, antivirus, encryption) and that work data is logically separated or accessed via secure virtual desktops.

🔑 Device Passwords/Biometrics: Ensure all devices have strong passwords, PINs, or biometric authentication enabled to prevent unauthorised physical access.  When moving between locations, there is a greater risk of theft, loss or damage to devices.

Authentication Protocols:

🔑 Multi-Factor Authentication (MFA): Enforce MFA for all remote access points, including VPNs, cloud applications, and internal systems. This is the single most effective way to secure remote logins.

🔑 Least Privilege: Ensure remote employees only have access to the specific company resources they need to perform their job functions, limiting potential damage if an account is compromised, consider that they may not need access to all the same systems as when they are in the office..

Data Handling and Storage:

🔑 Avoid Local Storage of Sensitive Data: Encourage employees to save work files to secure cloud storage or network drives rather than local device storage, consider restricting saving locally to devices.

🔑 Data Encryption: Ensure data stored on remote devices is encrypted.

🔑 Physical Security: Advise employees to keep work devices and sensitive documents secure within their homes, locked away when not in use, and not visible to others.

• Awareness and Reporting:
  
  🔑 Training: Provide specific training on secure remote work practices, recognising remote-specific phishing attempts, and proper incident reporting.
  
  Effective access control for remote workers ensures that flexibility doesn't come at the cost of security, protecting both individual data and organisational assets.
  
  Policies and Procedures:
  
  Working off site relates to one of the largest risks encountered with personal data - the movement of physical data. Data is at greatest risk when it moves.  Our customers have access to our Work out of School Best Practice Area for guidance, documentation and policies.  
  
  🔑 Policies: 
  
  folder Acceptable Use
  
  document Work off-premises Policy(2.87 MB)
  
  document Working at Home Checklist(22 KB)
  
  pdf DPE Model Bring Your Own Device Policy(15 KB)
  The most secure way is for your data to be in the cloud, but if staff do need to access a server remotely ensure that there is a secure method and the credentials are strong.  Many cyber attacks exploit the vulnerabilities in the Remote Desktop Program that Microsoft provides.  

Today's Cyber Tip: Lock Your Screen When You Step Away!

Whether at home or in the office, make it a habit to lock your computer screen every time you step away from your desk, even for a few minutes. (Windows: Win+L; Mac: Ctrl+Cmd+Q).

Customers can download our our 'Leave it! Lock it!' posters:

 ⬇️ pdf Leave It - Lock It Computer(152 KB)

 ⬇️ pdf HH Leave it Lock it(143 KB)

 ⬇️ pdf HH Leave it lock it 2(212 KB)

Watch our free micro learning video about Mobile Device Management:

DPE Knowledge Bank Guidance and Support:

For schools and colleges, six of the DfE Digital Standards are now mandatory. We have a DfE Digital Standards Tracker tool help you track your cyber resilience and your progress: 

   

Review our Cyber Security Best Practice Area for micro learning, support, guidance and policies:

Cyber Security Best Practice Area

Why not have a look at our 'specialist' trainer Harry the Hacker :