How should security teams protect corporate data when employees work from co-working spaces?

Security teams should treat co-working spaces as shared, untrusted environments and apply zero trust controls across both physical and network access. Require VPN use, encrypt data in transit and at rest, enforce single sign-on, disable public sharing features, and apply least privilege with time-limited entitlements. Pair those controls with physical safeguards such as access fobs, screen privacy filters, shredding, and continuous monitoring.

Why co-working spaces change the security model

Co-working spaces shift the trust boundary. The company no longer controls the network, the room, the endpoint visibility, or who can observe a screen, so the safer assumption is that both physical and digital controls must compensate for a shared environment. That means access decisions should be bounded, observable, and reversible rather than relied on as permanent trust.

In practice, this matters because the same session may traverse public Wi-Fi, shared printers, communal seating, and unknown devices nearby. Security teams should therefore design for exposure reduction, not just connectivity, and make sure remote access, storage, and collaboration settings do not assume an office-grade perimeter.

Controls that matter most for data protection

The strongest protection is layered: verify the user and device before granting access, keep traffic encrypted, and limit what a session can see or do once connected. NIST Cybersecurity Framework 2.0 is a useful way to organise that approach across govern, identify, protect, detect, respond, and recover.

For the access layer, use strong authentication, least privilege, and time-limited entitlements so that a lost laptop or exposed session does not translate into broad data exposure. For the collaboration layer, disable public sharing defaults, restrict external forwarding, and require encrypted storage and transport so that files remain protected even when users move between locations. Teams that rely on machine or service-side controls should also be careful not to leave secrets or tokens exposed in portable workflows; the lesson from the Hugging Face Spaces breach is that exposed credentials can quickly turn a convenience feature into a data-loss path.

Physical protection still matters in a shared room. Screen privacy filters, clean-desk habits, device locks, and shredding are not cosmetic extras; they reduce the chance that sensitive information is captured by shoulder surfing, unattended devices, or discarded paper. In a co-working setting, those safeguards close gaps that software controls cannot see.

How to keep protection usable without overlocking people out

Teams usually fail here in one of two ways: they either over-trust the environment and expose data, or they over-restrict users and drive them to work around the controls. The better pattern is to make the secure path the easiest path, with single sign-on, managed VPN access, approved collaboration tools, and device posture checks that are fast enough to survive daily use.

When the workforce is mobile, policy should distinguish between low-risk browsing and high-risk data handling. A person can often read non-sensitive content in a co-working space, but confidential files, privileged workflows, and administrative actions should require stronger assurance and tighter session rules. That distinction keeps controls proportional without weakening the data boundary.

Risk and Threat Considerations

Co-working spaces increase the chance of data exposure because the organisation cannot control the local network, the physical proximity of others, or the stability of the endpoint environment. The main risk is not just interception, but also accidental disclosure through screen visibility, shared devices, unmanaged printers, or overbroad session persistence.

Failure mechanism: Attackers or opportunistic observers can exploit weak Wi-Fi hygiene, unattended devices, shared screens, or permissive sharing settings to capture credentials, content, or session access, then reuse that access from elsewhere.

Impact: Sensitive corporate data can be copied, forwarded, or altered without immediate detection, and a single exposed session can create broader account, file, and downstream business risk if access is not time-bounded and revocable.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	PR.AA-05 — Identity Management, Authentication, and Access Control	Co-working access needs strong auth and least-privilege session control.
	PR.DS-01 — Data-at-rest is protected	Portable work in shared spaces needs encryption for stored corporate data.
	PR.DS-02 — Data-in-transit is protected	Shared networks make encrypted transport essential for corporate traffic.
Recommendation — Enforce strong authentication and least-privilege access for remote work sessions. Protect stored data with encryption on all employee devices and storage. Use encrypted channels for all corporate access from untrusted networks.
NIST SP 800-53 Rev 5	IA-2 — Identification and Authentication (Organizational Users)	Workers in shared spaces need strong user authentication before access.
	AC-6 — Least Privilege	Co-working sessions should limit what users can do if exposure occurs.
	SC-13 — Cryptographic Protection	Encryption is central when traffic crosses untrusted public networks.
Recommendation — Require strong user authentication before granting corporate access. Limit user permissions to the minimum needed for the task. Use cryptographic protection for data in transit and sensitive storage.
CIS Controls v8	CIS-6 — Access Control Management	Remote shared-space use needs tight account and entitlement control.
	CIS-3 — Data Protection	Data protection controls directly address exposure in shared environments.
Recommendation — Restrict and review access rights for users working outside the office. Protect sensitive data with encryption, sharing limits, and handling rules.

Practitioner Guidance

What to prioritise: Treat the highest-value control as the one that limits blast radius after login. If a user can authenticate from a co-working space, make sure the session still has device checks, narrow entitlements, and fast revocation options.

What to verify: Confirm that public-sharing defaults are off, VPN enforcement is real rather than advisory, and collaboration tools do not retain broader access than the business intent requires. Also verify that physical controls are actually usable in the field, because controls that are inconvenient tend to fail first.

Common mistake: Teams often secure the network and forget the room. In shared spaces, the weakest link is frequently what the user can see, print, or leave open on a screen rather than the transport layer alone.

Practitioner takeaway: The goal is not to make co-working spaces perfectly safe, it is to make any compromise or observation in that environment low-impact, short-lived, and easy to revoke.