Home Office and Remote Worker Security Guide

A remote worker's laptop sits on a network the organisation does not control, next to devices it has never seen, used by a person whose identity it may only ever have verified over video. Several well documented intrusions started at home: an engineer's personal computer, a personal browser profile, a legacy remote access account. This guide sets out how to secure work done outside the office: the policy model, the managed device, the home network, the remote access path, the identity of the worker and the credentials that live on their machine. It is written for endpoint, identity and security operations teams and for the managers who approve remote and hybrid working. Detailed VPN, ZTNA and Wi-Fi engineering is covered in companion guides linked below and is not repeated here.

Key takeaways

Assume the home network is hostile. NIST SP 800-46 Rev. 2 tells organisations to plan telework security on the assumption that external networks and devices contain hostile threats.
Tier access by device trust. Managed devices get full access; personal devices get browser or virtual desktop access to a limited set of applications; unknown devices get nothing sensitive.
Personal profiles are the soft spot. Work passwords synced to a personal browser account, and service account credentials saved there, have opened Cisco and Okta to attackers.
Verify the person, not just the login. Deepfake interviews and fake remote IT workers mean identity proofing at hiring and device shipping matter as much as MFA.
Measure the remote estate. Device compliance, patch age, MFA method and remote access logins tell you whether the controls hold when nobody is in the building.

The remote working risk model

NIST SP 800-46 Rev. 2 (Guide to Enterprise Telework, Remote Access, and BYOD Security) frames the problem: external facilities, networks and devices should be assumed to contain hostile threats, devices will be lost or stolen, and strong authentication, preferably multi-factor, is needed. The home adds its own layer of risk.

Risk	How it shows up at home	Primary control
Shared or personal device use	Family members use the work laptop; work done on a personal PC	Managed device, separate accounts, device lock (NIST SP 800-53 AC-11)
Untrusted local network	ISP router with default password, unpatched firmware, IoT devices on the same LAN	Device firewall, always-on encrypted tunnel, router baseline
Credential theft	Phishing, infostealers on personal machines, browser password sync	Phishing-resistant MFA, managed browser profile, no personal sync
Remote access exposure	VPN or RDP accounts that outlive their users, push MFA fatigue	MFA on every path, dormant account removal, ZTNA
Physical exposure	Screens visible to others, documents printed at home, theft from cars and trains	Disk encryption, screen privacy, clear desk, remote wipe
Identity fraud	A fake or proxy worker holding a real account and laptop	Identity proofing, verified shipping address, behavioural monitoring
Data leaving controlled storage	Files saved locally, USB drives, personal cloud uploads	DLP, removable media control, sanctioned collaboration tools

Relevant ATT&CK techniques include External Remote Services (T1133), Valid Accounts (T1078), Phishing (T1566), Multi-Factor Authentication Request Generation (T1621), Credentials from Web Browsers (T1555.003), Remote Access Tools (T1219) and Exfiltration over USB (T1052.001).

Policy and access tiers

NIST SP 800-46 Rev. 2 recommends a telework security policy that defines which forms of remote access are permitted, which device types may use each, and what access each type of teleworker gets. Its example tiers map well to modern estates:

Device	Typical access	Conditions
Organisation-owned, managed laptop	Full access to approved applications, including internal ones through VPN or ZTNA	Compliant posture, disk encryption, EDR healthy, supported OS
Personal (BYOD) laptop or PC	Browser or virtual desktop access to a limited application set; no local sync of sensitive files	Enrolled browser or app protection policy, session controls, download blocking
Personal phone or tablet	Email, chat and low-risk applications through managed apps	App protection, device PIN, OS version minimum
Third-party or unknown device	Webmail or nothing	Step-up authentication; no administrative access ever

Write rules of behaviour: NIST SP 800-53 PL-4 (Rules of Behavior) and PE-17 (Alternate Work Site) give the hooks: no family use of work devices, no work data on personal storage, report loss immediately, use only sanctioned tools.
Decide on printing at home: either forbid printing of classified or personal data, or require a managed printer and secure disposal. See the Printer and Print Server Security Guide.
BYOD needs its own policy: see the BYOD Policy Template.

Small versus large organisations: a small business with cloud applications can often skip VPN entirely, issue managed laptops, enforce MFA and conditional access in its identity provider and use the browser for everything else. A large organisation with on-premises applications needs a remote access tier (VPN or ZTNA), device posture checks and a help desk process for lost devices and lockouts across time zones.

Securing the managed device

NIST SP 800-46 Rev. 2 says organisation-controlled telework devices should get the same baseline as office devices (prompt updates, anti-malware, a personal firewall) plus encryption of sensitive data and firewall policies suited to external networks. The NI Cyber Security Centre's home working advice, which points to NCSC guidance, adds remote lock and wipe and fast loss reporting.

Management: enrol every device in MDM or UEM so configuration, compliance and wipe work over the internet without VPN. See the Microsoft Intune Guide.
Encryption: full disk encryption with keys escrowed centrally. See the Disk Encryption Guide: BitLocker and FileVault.
Firewall profile: treat every network as public: block inbound connections, disable file and printer sharing and network discovery on untrusted networks.
Patching from the internet: updates must come from cloud update services, not only from on-premises servers reachable through a VPN that the user rarely connects. See the Patch Management Guide.
No local admin: standard user accounts with elevation on request; randomised local administrator passwords. See the Endpoint Privilege Management Guide and the Local Administrator Password Solution (LAPS) Guide.
Removable media: the NI Cyber Security Centre recommends disabling removable media through device management, restricting it to organisation-supplied devices and encrypting it.
Managed browser: force sign-in to the work browser profile and block personal profiles and personal sync on managed devices. Okta did exactly this after its 2023 incident.
Screen lock: short inactivity timeout (AC-11), lock on lid close, privacy filters for travel and shared spaces.

Baseline detail is in the Endpoint Security Guide and the Endpoint Hardening Checklist; this guide only covers what changes when the device lives at home.

The home network and router

Organisations rarely own the home router, but they can set a minimum standard, help staff meet it and design so that a weak router does not matter much. CISA's home Wi-Fi guidance gives a concrete baseline:

Router setting	Recommended state (CISA)
Administrator login	Change the default username and password to a long, random, unique password
Firmware	Check regularly and enable automatic updates where supported
Wi-Fi encryption	WPA3 Personal or WPA2 with AES; open, WEP, WPA and WPA2 TKIP are unsafe, so replace or upgrade the router
Wi-Fi Protected Setup (WPS)	Disabled
Universal Plug and Play (UPnP)	Disabled, enabled only briefly when adding a device
Remote management	Disabled, so settings cannot be changed from the internet
Guest network	Enabled with its own password, used for visitors and smart home and IoT devices

NSA's Cybersecurity Information Sheet "Best Practices for Securing Your Home Network" covers the same ground: securing routing devices, segmenting wireless networks and keeping information confidential during telework. In practice:

Design for a hostile LAN: the device firewall, an always-on tunnel or ZTNA client, and TLS for every application mean a compromised smart TV on the same network sees nothing useful.
Segment IoT: encourage staff to put smart speakers, cameras and TVs on the guest network. See the IoT Security Guide.
Protected DNS: push protective DNS from the endpoint so it applies on any network. See the DNS Security Guide.
High-risk roles: for executives, administrators and staff handling sensitive data, NIST SP 800-46 notes that some organisations supply a managed router, firewall or VPN appliance for the home; weigh the cost and support burden against the risk.
Public Wi-Fi: CISA advises confirming the network name with staff and making sure traffic is encrypted; the tunnel should connect before any business traffic flows. See the Wi-Fi Security Guide.

Remote worker access: VPN, ZTNA and remote desktop

NIST SP 800-46 Rev. 2 describes four remote access methods: tunnelling (VPN), application portals (web portals, terminal servers, VDI), remote desktop access to a specific internal PC, and direct application access (for example webmail and SaaS). It advises that remote desktop access to an internal PC be used only in exceptional cases after careful risk analysis.

Method	Choose it when	Main trade-off
Full-tunnel VPN	Legacy internal applications, need for central inspection of all traffic	Broad network access once connected; the gateway is a high-value target
ZTNA	Per-application access with device posture and identity checks	Application mapping effort; legacy protocols may not fit
VDI or application portal	BYOD, contractors, data that must not reach the endpoint	Cost, latency, and the portal itself must be hardened
Direct SaaS access with conditional access	Cloud-first estates	Relies entirely on identity, device and session controls
Remote desktop to an office PC	Exceptional cases only	Exposes RDP or a remote access tool; hard to monitor

MFA on every path: no remote access method, including legacy VPN profiles and vendor portals, without MFA (NIST SP 800-53 AC-17, IA-2). The Colonial Pipeline ransomware attack began with a legacy VPN account that was no longer used, had no MFA and whose password had leaked.
Phishing-resistant methods: push approval alone invites fatigue attacks; prefer FIDO2 passkeys or certificate-bound device authentication. See the Phishing-Resistant MFA Guide.
Authenticate the device as well as the user: NIST SP 800-46 recommends this so a stolen password alone does not grant access (IA-3 Device Identification and Authentication).
Split tunnelling: a deliberate decision documented against NIST SP 800-53 SC-7(7), not a default.

Engineering detail is in the VPN Security Guide, the ZTNA Guide, the Remote Access Identity Guide and the Remote Desktop (RDP) Security Guide.

Where identity fits: credentials and secrets on the home device

The remote worker's machine is where human and non-human credentials meet: browser-saved passwords, session cookies, developer API keys, cloud CLI tokens and SSH keys. Two incidents show the pattern.

Personal profiles on work devices: in the Okta support system breach, a service account's credentials were saved in an employee's personal Google profile in Chrome on a managed laptop, and Okta judged compromise of that personal account or device the most likely exposure route. Okta then blocked personal Google profiles on managed devices.
Work passwords in personal sync: in the Cisco breach, an employee's password was saved in the browser and synced to a personal Google account the attacker controlled; voice phishing and repeated push prompts then got past MFA on the VPN.
Personal computers used for privileged work: in the LastPass breach, a DevOps engineer's home computer was compromised through vulnerable third-party media software and a keylogger captured the master password used to reach corporate vault keys. Privileged and production access belongs on managed, hardened devices only.

Controls: a sanctioned password manager, no service account or API key stored in a browser or personal vault, short-lived developer credentials issued through SSO, secrets scanning on endpoints and repositories, and a rule that administrative work happens only from privileged access workstations. See the Secrets Management Guide and the Service Account Security Guide.

Deepfake remote workers and identity proofing

A fully remote hire may never meet anyone in person. In June 2022 the FBI's IC3 warned of complaints about deepfakes and stolen personal information used to apply for remote IT, programming, database and software roles, with interview indicators such as lip movements that do not match the audio and coughing or sneezing that does not line up with the video. A 2023 US intelligence community paper on North Korean revenue generation lists red flags for IT workers, including workers who cannot receive equipment at the address on their identification and requests to use different payment accounts, and recommends video verification, background checks that do not rely on worker-supplied contact details, shipping equipment only to verified addresses and checking for remote desktop, VPN or VPS access.

At hiring: document verification against an authoritative source, a live video step with liveness checks, and an independent reference check. See the Deepfake-Resistant Identity Verification Guide.
At device shipping: ship only to the verified address; treat a change of delivery address before day one as a flag.
In the first 90 days: alert on remote access tools (T1219) on the managed laptop, logins from hosting provider or VPS ranges, and a device that never leaves one location while the user appears elsewhere.
Help desk resets: require strong re-verification before resetting MFA for a remote worker; social engineering of the help desk is a common route in. See the Deepfake and AI Impersonation Guide and the Insider Threat from Fake IT Workers Guide (North Korean IT Worker Schemes).

Detection and measurement

Signal	Source	What it can indicate
Sign-ins from new countries, hosting ranges or impossible travel	Identity provider logs	Stolen credentials or a proxy worker
Repeated MFA push denials followed by an approval	Identity provider logs	MFA fatigue (T1621)
New MFA method registered shortly after a password reset	Identity provider audit log	Account takeover or help desk fraud
Device out of compliance or not checked in for N days	MDM / UEM	Unpatched, lost or tampered device
Unapproved remote access tool installed	EDR software inventory	Remote control by a third party
Large uploads to personal cloud storage or USB writes	DLP, EDR	Data leaving controlled storage
VPN logins by accounts with no recent interactive use	VPN gateway logs	Dormant account abuse

Metrics:

Percentage of remote workers on managed, compliant devices (and the count of exceptions with an expiry date).
Percentage of remote access sign-ins using phishing-resistant MFA.
Median patch age of remote endpoints compared with office endpoints.
Mean time from loss report to remote lock or wipe.
Number of remote access accounts unused for 30 days that are still enabled (target zero).
Percentage of managed devices with personal browser profiles and personal sync blocked.

See the Device Trust and Posture Guide.

Rolling it out

Baseline: inventory remote workers, their devices (managed, BYOD, unknown) and every remote access path, including legacy VPN profiles and vendor portals.
Close the open doors: require MFA on every remote access path and disable dormant remote access accounts; this is the fastest risk reduction.
Publish the policy and tiers: access by device type, rules of behaviour, loss reporting, printing and removable media rules.
Harden the device in rings: pilot conditional access in report-only mode, browser profile restrictions, removable media blocking and firewall profiles with IT, then early adopters, then everyone. Keep a documented exception group to roll back individual users quickly.
Move to phishing-resistant MFA for administrators and remote access first, then all staff.
Support the home network: issue a short router checklist based on the CISA settings above, and offer managed equipment for high-risk roles.
Add hiring and help desk controls for remote identity proofing and MFA resets.
Review quarterly against the metrics and adjust tiers.

Framework mapping

Framework	Reference	Remote working control
NIST SP 800-53 Rev. 5	AC-17 Remote Access; AC-17(1), AC-17(2)	Authorised remote access methods, monitoring and encryption
NIST SP 800-53 Rev. 5	AC-19 Access Control for Mobile Devices; AC-20 Use of External Systems	Managed versus personal device rules
NIST SP 800-53 Rev. 5	PE-17 Alternate Work Site; PL-4 Rules of Behavior	Home working policy and staff obligations
NIST SP 800-53 Rev. 5	IA-2(1), IA-3, AC-11, SC-28, MP-7	MFA, device authentication, screen lock, encryption at rest, removable media
NIST CSF 2.0	PR.AA-03, PR.DS-01, PR.DS-02, PR.PS-02, PR.AT-01, DE.CM-09	Authentication, data protection, patching, awareness, endpoint monitoring
ISO/IEC 27001:2022 Annex A	A.6.7 Remote working; A.7.9 Security of assets off-premises; A.8.1 User endpoint devices	Policy, device and off-site asset controls
MITRE ATT&CK v20	T1133, T1078, T1566, T1621, T1555.003, T1219, T1052.001	Threats to detect and mitigate

Common failure patterns

Forgotten remote access accounts: legacy VPN profiles without MFA that outlive their users, as at Colonial Pipeline.
Personal and work identities mixed in one browser: work passwords synced to personal accounts, as at Cisco, or service account credentials in a personal profile, as at Okta.
Privileged work from personal machines: engineers reaching production or vault keys from a home PC that also runs unpatched consumer software, as at LastPass.
Patching that depends on the VPN: remote devices that only receive updates when connected fall weeks behind.
Push-only MFA and an easily persuaded help desk: both are routinely beaten by social engineering of remote staff.
Hiring without identity proofing: a laptop shipped to an unverified address for a worker nobody has met.

Practitioner checklist

Publish a remote working policy with access tiers by device type, rules of behaviour and loss reporting.
Require MFA, preferably phishing-resistant, on every remote access path, and remove dormant remote accounts.
Manage every work device through MDM or UEM with encryption, EDR, cloud-delivered patching and remote wipe.
Block personal browser profiles and personal password sync on managed devices.
Keep privileged and production access on managed, hardened devices only.
Give staff a home router checklist: changed admin password, current firmware, WPA3 or WPA2-AES, WPS, UPnP and remote management off, guest network for IoT.
Control removable media and home printing for sensitive data.
Verify remote hires' identities and ship equipment only to verified addresses.
Monitor sign-in anomalies, MFA fatigue, device compliance and remote access tools, and report the metrics quarterly.

Home Office and Remote Worker Security Guide: Securing Work Outside the Office