Supporting a Sudden Shift to Remote Work: Access and Security
Key takeaway
Get identity right first: MFA on every remote entry point, before expanding VPN access. The dangerous shortcuts are opening remote desktop to the internet and relaxing password rules to reduce support calls — both are routinely exploited within days.
When an office workforce has to work from home at short notice, the pressure is to restore productivity in days. The decisions made in that week tend to become permanent, so a few of them are worth getting right immediately.
Do these first
- Multi-factor authentication on email, VPN, and any administrative access. It's the single highest-value control and can be deployed quickly.
- Inventory what's actually being accessed remotely, including the systems people found their own way into.
- Publish clear guidance on approved tools — otherwise staff will choose their own file sharing and chat, and you'll be securing it retroactively.
- Make the service desk route obvious, because phishing surges whenever people are uncertain who to ask.
Never do these, even temporarily
- Expose remote desktop directly to the internet. It's scanned continuously and is a primary ransomware entry point.
- Relax password or lockout policy to cut support calls.
- Share a single VPN or admin credential across a team.
- Disable logging or monitoring to save capacity during the transition — that's precisely when you need it.
VPN or published applications?
A VPN puts the device on your network, which means an unmanaged home computer becomes an internal host. Where possible, publish individual applications behind identity-aware access instead, so each request is authenticated and authorised rather than the whole network being trusted. Where a VPN is necessary, split-tunnel general internet traffic so capacity goes to work systems, and require device checks before connection.
Personal devices
- Decide explicitly whether they're allowed, and for what. An unstated policy means the answer is yes by default.
- Where allowed, require an up-to-date operating system, disk encryption, and screen lock, and keep company data in managed applications rather than the local filesystem.
- Provide a way to wipe company data without wiping personal data.
- Cover printing and document handling at home in the policy; it's the gap most organisations miss.
Then go back and do it properly
Schedule a review a few weeks in: revoke the temporary access grants, close the firewall rules opened in a hurry, and document what became permanent. The security debt from a fast rollout is manageable if it's written down while everyone still remembers what they changed.