Working safely from home and on the road: 7 rules for laptop and phone

In the office the environment is predictable: one network, known devices, colleagues who notice when something is off. At home and on the road, that falls away. The laptop sits on the kitchen table, the phone lies next to a coffee in the station, and the business report gets printed on the kids' printer. None of that is reckless, but together it makes an SME more vulnerable than the manager thinks. Below are seven rules we introduce at clients, with the why and the how for each.

Why the risks are different outside the office

In incidents related to remote work, it rarely comes from a targeted attack. It is more mundane than that.

• Loss and theft: a laptop on the train, a phone out of a coat pocket. The device is replaceable, the email and files on it not always.
• Public wifi: in a hotel, station or coffee bar you do not know who runs the network or who is listening in.
• Family members on the same PC: a child installing a game on the laptop that also holds the bookkeeping.
• Shoulder surfers: on the train or on a terrace, the person next to you reads a quote or a personnel file with ease.

None of those situations calls for panic. They call for a few fixed habits.

The seven rules

1. Turn on disk encryption. Enable BitLocker (Windows) or FileVault (macOS) on every laptop. Without encryption, whoever finds the laptop can take out the drive and read everything, even without your password. With encryption, a stolen laptop is an expensive brick, nothing more. Store the recovery key centrally, not on the laptop itself.
2. Automatic screen lock and a strong PIN. Have the screen lock after a few minutes and use a PIN of at least six digits on the phone, preferably with fingerprint or face recognition. Leaving the laptop open to grab a coffee is the moment someone looks along or walks off with something.
3. No company data on private devices, unless managed. The private laptop at home is shared, not updated and not encrypted. If you work on it, you are handling company data on a device you have no view of. Either everyone gets a business device, or the private device is brought under management. There is no middle ground.
4. Avoid public wifi, use your phone's hotspot. Your 4G or 5G connection is almost always safer than the free wifi network of wherever you are sitting. If it has to be wifi, make sure only managed devices with an up-to-date system connect, and never log in anywhere without MFA. Our step-by-step plan for MFA helps with that.
5. Business documents only in the company environment. Files belong in OneDrive or SharePoint, not in an email attachment to yourself, not in a private cloud and not on a USB stick. That way everything stays backed up, shareable and manageable remotely. Lose the device and you lose no work.
6. Report loss within the hour. The sooner you report it, the sooner the device is blocked or wiped remotely and access to email and files is revoked. Agree on who to report to and how, including evenings and weekends. Shame is the biggest enemy here: nobody gets angry about a lost laptop, but they do about a report that arrives two days late.
7. Privacy filter and think before printing. A privacy filter on the screen makes reading along on the train impossible. And what you print at home stays at home: on the printer, in the paper bin, with the recycling. Do not print sensitive documents at home, or take them back and shred them at the office.

What the manager arranges

Rules that only exist in someone's head do not last. As a manager you put three things on paper, together less than a page.

• Remote work agreements: where and on which device work is done, which networks are allowed, and that family members do not use the business device.
• Device policy: who gets which device, what is allowed on it, what happens when someone leaves, and whether private devices are permitted.
• What to do in case of loss: one phone number or address, reachable outside working hours, and the steps that follow.

That fits in the one-page IT policy we described earlier. Go through it once with the whole team and repeat it with every new employee.

Managed devices make it easy

Most of the rules above can be enforced instead of requested. With a management platform such as Microsoft Intune or a similar solution, you switch on encryption, screen lock and updates centrally for every device, see which devices are behind, and wipe a lost laptop or phone with one click. For an SME of fifteen employees that is not a heavy project: the devices are usually already in Microsoft 365, and the setup is done once. After that nobody has to think about it anymore, and that is exactly the point.