Device Security for Remote Workers

Device Security for Remote Workers

Photo by cottonbro studio on Pexels

Even with a secure VPN and locked-down Wi-Fi, the devices your workers use — laptops, phones, tablets — are the front line of your security defense. A compromised device undermines every other security measure. This lesson covers how to secure both company-owned and personal (BYOD) devices for remote work.

Company-Owned vs. BYOD: Two Approaches

Company-Owned Devices (Recommended)

When the business owns the device, you control what's installed, how it's configured, and when it's updated. This is the safest approach. For small businesses, even a basic company laptop is more secure than a personal device with unknown history.

BYOD (Bring Your Own Device)

When workers use personal devices, you lose control. You don't know what software is installed, whether the OS is updated, or if family members also use the device. If BYOD is necessary, use Mobile Device Management (MDM) to separate work data from personal data.

Essential Device Security Measures

1. Full Disk Encryption (Critical)

If a laptop is stolen, encryption ensures the thief can't read the data without the password. Without encryption, they can simply remove the hard drive and read everything.

• Windows: Enable BitLocker (included free with Windows Pro). Go to Settings > Privacy & Security > Device Security > BitLocker > Turn on.
• Mac: FileVault is built in. Go to System Settings > Privacy & Security > FileVault > Turn on.
• Linux: Use LUKS full disk encryption during installation, or VeraCrypt (free, open source) for encrypting specific partitions.

Important: Save the recovery key in a secure location (password manager or printed in a safe). If the worker forgets their password, the recovery key is the only way to access the data.

2. Automatic OS Updates (Critical)

Operating system updates patch security vulnerabilities. Many attacks exploit vulnerabilities that were patched months or years ago — the victims simply hadn't updated.

1. Windows: Settings > Windows Update > Enable automatic updates. Also enable "Receive updates for other Microsoft products."
2. Mac: System Settings > General > Software Update > Enable automatic updates for macOS and apps.
3. Check monthly: Verify updates are actually installing — sometimes they fail silently.

3. Antivirus and Anti-Malware (Critical)

Every device needs active malware protection. You don't need expensive security suites — free options provide excellent protection.

• Windows: Windows Defender (now Microsoft Defender) is built in and free. Ensure it's enabled and updated. No third-party software needed for most small businesses.
• Mac: Built-in XProtect provides basic protection. For additional security, install Malwarebytes (free version for manual scans, paid for real-time).
• Linux: ClamAV (free, open source) for on-demand scanning. Linux desktops are less targeted but not immune.
• All platforms: Enable firewall (built into Windows and Mac). For Linux, use ufw (Uncomplicated Firewall).

4. Screen Lock with Password/PIN (Important)

If a worker steps away from their laptop at a coffee shop, an unlocked screen is an open invitation. Configure automatic screen lock after 5 minutes of inactivity.

1. Windows: Settings > Accounts > Sign-in options > Set "Dynamic lock" and configure screen timeout to 5 minutes in Power settings
2. Mac: System Settings > Lock Screen > Set "Require password after screen saver begins" to 5 minutes
3. Also: Train workers to manually lock with Windows+L (Windows) or Control+Command+Q (Mac) whenever they step away

5. Browser Security (Important)

The browser is the primary interface for most work activities — and the primary attack vector for phishing and malware.

1. Use a modern browser: Chrome, Firefox, or Edge — all receive automatic security updates
2. Enable phishing protection: All major browsers have this built in — ensure it's enabled in settings
3. Install uBlock Origin: Free, open-source ad and tracker blocker. Reduces exposure to malicious ads.
4. Disable unnecessary extensions: Each extension is a potential attack vector. Only install what you need, from trusted developers.
5. Use separate profiles: Workers should use a work browser profile for company activities, separate from personal browsing

6. Mobile Device Management for BYOD

If workers use personal phones for work email or apps, use MDM to create a secure work container that separates work data from personal data.

• Microsoft Intune: Included with Microsoft 365 Business Premium ($6/user/month) — manages both company and personal devices
• Google MDM: Free with Google Workspace — basic device management for Android and iOS
• Flyve MDM: Open-source MDM, free to self-host — good for technically capable teams
• Container approach: Work data is encrypted and managed separately — if the worker leaves, you can wipe only the work container, not their personal data

Step-by-Step: Device Security Setup Checklist

1. Full disk encryption: Enable BitLocker/FileVault — save recovery keys in password manager
2. Automatic updates: Enable for OS and all applications
3. Antivirus active: Verify Windows Defender or equivalent is running and updated
4. Firewall enabled: Check that the built-in firewall is active
5. Screen lock: Set 5-minute auto-lock, train workers to lock manually
6. Browser security: Install uBlock Origin, enable phishing protection
7. Password manager: Install Bitwarden (free) or KeePass (free) — stop reusing passwords
8. VPN client: Install Tailscale or OpenVPN client — always connect before accessing company resources
9. Backup: Configure automatic backups — local external drive plus cloud backup
10. Document: Create a device inventory with serial numbers, encryption status, and last update date

Free Security Tools for Remote Devices

• Bitwarden (bitwarden.com): Free, open-source password manager — unlimited passwords across all devices
• Microsoft Defender: Built into Windows, excellent protection with no cost
• VeraCrypt (veracrypt.fr): Free encryption for sensitive files and folders on any platform
• uBlock Origin: Free browser extension — blocks ads, trackers, and malicious domains
• BleachBit (bleachbit.org): Free system cleaner — removes temporary files that could contain sensitive data

Key Takeaways

• Full disk encryption is non-negotiable — if a device is stolen, encryption is your last line of defense
• Automatic OS updates are the simplest, most effective security measure — enable them on every device
• Windows Defender provides excellent free protection — no paid antivirus needed for most small businesses
• For BYOD, use MDM to create work containers that separate company data from personal data
• Install a password manager (Bitwarden is free) — password reuse is one of the biggest security risks