How should organisations strengthen remote access security when phishing attempts increase during major disruptions?

Organisations should prioritise phishing resistant authentication for remote access, especially when users are spread across home networks and under stress. MFA helps, but not all MFA methods resist account takeover equally. FIDO based authentication raises the bar by binding login to a physical authenticator, which reduces the value of stolen passwords and helps prevent remote compromise.

Why phishing-resistant remote access matters most during disruption

Major disruptions change attacker economics. Users are stressed, routines are broken, and help desk volume rises, which makes credential harvesting and session hijacking more effective against remote access. The practical issue is not just the login form, but the trust boundary between a distant user, a home network, and whatever system grants reach into internal resources.

Phishing-resistant authentication is the strongest control point because it removes much of the attacker value in stolen passwords and one-time codes. A remote access programme that still depends on reusable secrets or easily relayed prompts will usually fail at the moment resilience matters most.

One useful reference point is the NIST SP 800-207 Zero Trust Architecture, which reinforces the idea that remote connectivity should be evaluated as a continuously trusted state, not a one-time login event.

What to strengthen in the access path

Start with the remote access methods that can be phished, relayed, or replayed. Password plus push approval improves baseline protection, but it does not give the same resistance as a hardware-bound factor. FIDO based authentication, including security keys and passkeys where appropriately deployed, binds the login ceremony to the origin and the authenticator, which makes simple credential theft far less useful.

That should be paired with access reduction, because strong authentication alone does not fix excessive reach. If a remote user can reach too many systems after login, the compromise impact remains high even when the initial sign-in is better protected. Remote access design should therefore limit who can connect, from where, and to which applications or administrative paths.

For broader control design, the NCSC UK Advice and Guidance collection is a useful external reference for remote working and operational resilience, while the CIS Controls v8 help translate that into account management, access control, and logging priorities.

If remote access relies on secrets, service credentials, or long-lived tokens behind the scenes, those materials need the same scrutiny as user passwords. NHIMG’s Ultimate Guide to NHIs is relevant here because remote access often depends on underlying identity and secret hygiene, not only on the human login prompt.

Risk and Threat Considerations

When disruption increases phishing, the main risk is a successful first-stage compromise that turns a legitimate remote login into unauthorised internal access. Attackers do not need to defeat every control if they can capture reusable credentials, replay a token, or socially engineer an approval flow while users are distracted.

Failure mechanism: Weak or relayable MFA, poor access scoping, and overexposed remote pathways allow stolen credentials or coerced approvals to open a session that looks legitimate to defenders.

Impact: The result can be account takeover, lateral movement, data exposure, and rapid escalation from a single compromised remote user into broader internal compromise.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK address the attack and risk surface, while NIST SP 800-63, NIST Zero Trust (SP 800-207), CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST SP 800-63	AAL3 — Authenticator Assurance Level 3	AAL3 requires phishing-resistant authentication for high-assurance remote access.
Recommendation — Use AAL3 for sensitive remote access so stolen passwords and OTP phishing are not enough.
NIST Zero Trust (SP 800-207)	PL-2 — Policy Continuously Evaluated	Zero Trust requires continuous policy evaluation for each remote access request and session.
Recommendation — Continuously evaluate remote access requests instead of trusting the initial login alone.
CIS Controls v8	5 — Account Management	Remote access hardening depends on controlling account provisioning, authentication, and removal paths.
Recommendation — Restrict and review remote access accounts, then remove legacy sign-in paths that weaken MFA.
NIST CSF 2.0	PR.AA — Identity Management, Authentication, and Access Control	This directly covers stronger authentication and access control for remote connectivity.
Recommendation — Enforce phishing-resistant authentication and limit access to only approved remote pathways.
MITRE ATT&CK	T1556 — Modify Authentication Process	Phishing and token theft often succeed by abusing or bypassing authentication workflows.
Recommendation — Detect and investigate attempts to bypass or manipulate remote authentication workflows.

Practitioner Guidance

What to prioritise: Treat phishing-resistant authentication as the default for any remote access that reaches sensitive systems, then remove fallback paths that let a stolen password or intercepted OTP become a productive login. If the access path is administrative or production-facing, require the strongest available authenticator and narrower session scope than ordinary user access.

What to verify: Confirm that remote access is actually using phishing-resistant methods end to end, not only advertised as MFA. Check whether help desk reset flows, emergency access, or legacy VPN paths quietly reintroduce phishable sign-in methods or bypasses.

Practitioner takeaway: During major disruptions, the organisation should optimise for login methods that remain trustworthy under stress, because the true test of remote access security is whether stolen secrets can still be converted into a valid session.