Remote work has become the norm following an extraordinary measure. According to surveys, more than half of employees in the knowledge economy in the Czech Republic now work in a hybrid or fully remote mode. This is excellent for productivity and work-life balance. However, for cybersecurity it means that the corporate environment no longer has clear boundaries.
In the office, company rules apply, along with the corporate network, company equipment and physical security. At home, an employee works on potentially shared Wi-Fi using the router's default password, possibly on a personal laptop next to a family tablet, without physical supervision and without IT support just outside the door. Attackers registered this change immediately. - Since 2020, the number of attacks targeting remote workers has multiplied.
The most significant risks of a home office
Before we move on to the rules, let us name the specific risks that remote work brings:
- Unsecured home networks - default or weak router passwords, unpatched firmware, shared network with other household members and their devices
- Personal devices (BYOD) - outside IT control, without corporate MDM, with personal apps, games and potentially malware
- Remote access to sensitive systems - RDP, VPN and web portals exposed to the internet are popular targets of attacks
- Phishing targeting home offices - attackers personalise attacks: "Problem with your VPN access," "Update company software for remote work
- Shadow IT - employees use tools not approved by IT (personal Dropbox, WhatsApp for business communication)
- Physical security - sensitive documents at a home workplace, presence of family members or visitors during confidential calls
10 Cybersecurity Rules for Remote Work
Rule 1: Multi-factor authentication for everything
MFA (Multi-Factor Authentication) is the simplest and most effective measure for remote work. Even if an attacker obtains an employee's password (via phishing, a data breach or brute force), they cannot log in without the second factor. MFA must be mandatory for: VPN, email, corporate applications, cloud services, administrative accounts, without exception. Applications such as Microsoft Authenticator or Google Authenticator are free and implementation takes hours.
Rule 2: Use a VPN or ZTNA to access company resources.
VPN (Virtual Private Network) It creates an encrypted tunnel between the employee's device and the corporate network. It is a proven solution but has limitations: once connected via VPN, the device gains access to the entire corporate network, including systems the employee does not need to access. If the device is compromised, the attacker can reach anywhere.
ZTNA (Zero Trust Network Access) It is a more modern approach. Instead of "you are either on the network or you are not", it applies the principle that every access to every resource is verified separately, based on user identity, device status and context. ZTNA significantly limits an attacker's lateral movement in the event of a compromise. For companies that have already deployed VPN and are evaluating options, ZTNA (for example Cloudflare Access, Zscaler, Microsoft Entra) is a more forward-looking choice.
Rule 3: MDM for business premises
Mobile Device Management (MDM) enables the IT department to manage company devices remotely, regardless of their physical location. MDM ensures: enforced encryption, remote wiping of lost or stolen devices, centralised patch and software management, and enforcement of security policies (screen lock, strong password). Microsoft Intune, Jamf, and VMware Workspace ONE are commonly deployed solutions.
Rule 4: Clear BYOD policy
BYOD (Bring Your Own Device), working on personal devices, is a reality in many companies. However, corporate data stored on personal devices that IT does not control are inherently risky. The company must have a clear policy: are employees allowed to access corporate systems from personal devices? Under what conditions? What may and may not be done with corporate data on personal devices?
Technically, BYOD can be set up more securely using MAM (Mobile Application Management), managing only corporate applications on a personal device without controlling the entire device. Sensitive data remains isolated within the corporate container.
Rule 5: Securing your home network
Companies cannot directly manage employees' home networks, but they can provide clear instructions and enforce this standard as a condition of remote work.
- Changing the router's default password to a strong unique password
- Router firmware update
- Use WPA3 or at least WPA2 for Wi-Fi encryption
- Separate network (guest VLAN) for company devices, isolated from personal and IoT devices.
- Prohibition of work on public Wi-Fi without a VPN
Rule 6: Device and data encryption
A company notebook without disk encryption is a security incident waiting to happen. If the device is stolen or lost, all data on it becomes immediately accessible without a password. BitLocker (Windows), FileVault (macOS) or Linux dm-crypt are built-in encryption tools that require only configuration time and nothing more. Mandatory encryption of all company devices is the minimum standard.
Rule 7: Clean desk and screen policy
Physical security in the home environment: screen lock after short inactivity (maximum 5 minutes), prohibition of leaving sensitive documents unattended at the workstation, secure shredding of physical documents, locking devices when leaving the workspace, even at home. These rules must be part of the Remote Work policy and employees must confirm them with a signature.
Rule 8: Secure video conferencing
Video conferencing has introduced new security challenges. Rules for secure video calls:
- Only approved tools (Teams, Zoom with a corporate account, Google Meet): no personal accounts or unapproved applications.
- Passwords or waiting rooms for all meetings with external participants
- Check shared screen settings: share only a specific window, not the entire desktop.
- Watch your background: no visible sensitive information (whiteboards, documents, access codes on sticky notes).
- Recording of meetings only with participants' consent and a clear policy on storing recordings.
Rule 9: Regular phishing simulations for the remote team
Remote workers are a specific target of phishing campaigns, attackers exploit their isolation from colleagues and the inability to quickly verify a suspicious email "down the corridor." Phishing simulations focused on scenarios relevant to remote work (fake IT communications about VPN, Teams notifications, password reset requests) dramatically increase team vigilance.
Rule 10: Clear procedure for reporting an incident
Every remote employee must know what to do if they click on a phishing link, lose or have their device stolen, or notice suspicious activity. The procedure must be simple, accessible (not only within the internal network), and free of penalties for reporting. Prompt reporting of an incident dramatically reduces its impact. - every hour of delay gives the attacker more time for lateral movement and data exfiltration.
How to effectively enforce a secure remote work policy
Rules without enforcement are merely documents. Technical enforcement (MDM, MFA, VPN) is essential but insufficient. Employees must understand and agree to the rules. A Remote Work security policy should:
- To be written clearly, not in legal jargon.
- To be signed by employees as a condition of remote work
- Being part of the onboarding process for new employees
- To be regularly (annually) inspected and updated
Cybersecurity for remote work is not a one-off project; it is the continuous management of access, devices and processes in an environment where the corporate perimeter no longer exists. If your company's remote work is not covered from a security perspective, or if you wish to verify the current state, SecureOn.cz offers a remote work security audit as well as complete setup of policies and technical measures tailored to your organisation.