What are the best practices for securing remote work for business employees?

The best practices for securing remote work for business employees are to protect accounts with multi-factor authentication, keep work devices encrypted and updated, rely less on home networks, train staff to spot phishing, back up data, and plan for lost devices and departures. None of it requires a large IT team, and Canada’s Cyber Centre offers free guidance.

What are the main security risks of remote work?

Remote and hybrid work move company data onto home networks, personal phones and laptops that leave the office. The risks that follow are predictable:

• Stolen or reused passwords, which let an attacker sign in as an employee from anywhere.

• Phishing emails and texts that are harder to check when nobody is at the next desk to ask.

• Unpatched or end-of-life devices, including personal ones used for work.

• Lost or stolen laptops and phones that hold company files.

• Shared home and public Wi-Fi that the business doesn’t control.

The Canadian Centre for Cyber Security’s security tips for organizations with remote workers address each of these. The sections below turn them into steps a small business can follow.

1. Protect accounts before anything else

• Turn on multi-factor authentication (MFA) for email, file storage, accounting, your store admin and anything else that holds company data. The Cyber Centre’s MFA guidance strongly recommends phishing-resistant FIDO methods, such as security keys and passkeys. If you use an authenticator app, turn on number matching so staff can’t be worn down by repeated prompts; text-message codes can be phished.

• Use long, unique passphrases. The Cyber Centre’s passphrase guidance recommends at least 4 words and 15 characters, and a different one for every account and device.

• Use a password manager for everyday logins, and share company logins through it rather than by email or chat. Secure the manager itself with a strong passphrase and MFA.

• Give each person only the access they need, and review it when roles change.

When we hand over a new store or web application at msmtech, we ask the owner to turn on two-step authentication for every staff account before launch, and we remove our own access when the project ends. Access that nobody remembers granting is the easiest kind to abuse.

2. Keep devices managed and up to date

• Turn on automatic updates for the operating system, browser and apps, and replace devices that no longer receive security updates.

• Encrypt laptops and require a screen lock: FileVault on Mac and BitLocker on Windows. Recent phones encrypt their storage when a passcode is set.

• Use built-in or business antivirus and keep it on.

• Prefer company-owned devices. If staff use personal devices, decide what company data may live on them, and use your email and file providers’ settings to wipe company data from a lost device.

3. Make the home network less important

• Change the router’s default admin password and keep its firmware updated.

• Use a separate guest network for smart devices and visitors.

• Avoid public Wi-Fi for work, or use a phone hotspot instead.

• Prefer cloud services with MFA over opening office systems to the internet. Where staff need to reach internal servers, require a VPN, and MFA on the VPN too.

4. Train people to spot phishing

Phishing works because it imitates the messages people expect. Teach staff to check the sender, never approve an MFA prompt they didn’t start, and confirm payment or banking changes by phone using a number they already have. A short reminder every few months works better than a long annual course, and Get Cyber Safe has free material you can share.

• Make reporting easy: one address or chat channel for “this looks odd”.

• Thank people who report, including false alarms, so they keep doing it.

• Rehearse the most likely scam in your business, such as a fake supplier asking to change bank details.

5. Back up and plan for recovery

• Keep backups of important data in at least two places, one of them offline or in a separate account that ransomware on a work laptop can’t reach.

• Test a restore at least twice a year.

• Write a one-page plan: who to call, how to lock accounts and how to tell customers if data is exposed.

6. Handle arrivals, departures and lost devices

• When someone joins: set up accounts with MFA, enroll their device and walk through these rules.

• When someone leaves: disable accounts the same day, transfer shared logins and recover devices.

• When a device is lost: change the passwords used on it, sign it out of every service and wipe company data.

What to do after a breach in Canada

If personal information is exposed, Canadian businesses may have legal duties beyond fixing the problem. Under PIPEDA, the Office of the Privacy Commissioner’s guide to mandatory breach reporting says you must:

• Report to the Privacy Commissioner any breach that creates a real risk of significant harm to an individual.

• Notify the affected people as soon as feasible.

• Keep a record of every breach of security safeguards for two years, including those you didn’t have to report.

Quebec, Alberta and British Columbia have their own private-sector privacy laws with similar duties. This is general information, not legal advice.

Remote work security checklist

1. MFA on email, files, accounting, banking and admin accounts

2. Unique passphrases, with everyday logins in a password manager

3. Automatic updates and disk encryption on every work device

4. Router passwords changed; no work on public Wi-Fi without a hotspot or VPN

5. Phishing reminders every few months, and one place to report

6. Tested backups, one copy out of reach of a work laptop

7. A same-day process for departures and lost devices

For a fuller set of controls, the Cyber Centre’s baseline cyber security controls for small and medium organizations cover 13 areas, from incident response to secure websites.

Running your own servers for remote staff? Read about VPS hosting and what you take on with it →. If your team needs a secure web app instead of shared spreadsheets, see custom software solutions → or talk to msmtech →

Frequently asked questions

Is a VPN enough to secure remote work?

No. A VPN protects the connection to your internal systems, but it doesn’t stop phishing, stolen passwords or an unpatched laptop. Pair it with MFA, updated and encrypted devices, and staff training.

Should employees use personal devices for work?

Company-owned devices are easier to secure, which is why the Cyber Centre recommends them where possible. If you allow personal devices, set a written policy on what company data they may hold, and require a screen lock, updates and the ability to wipe company data.

What is the single most important remote work security measure?

Multi-factor authentication on every account that holds company data. It means a stolen or guessed password is no longer enough to sign in, and it takes minutes to turn on.

How often should remote employees get security training?

Short reminders every few months work better than one long annual session. Use real examples of the scams your business is likely to see, and make reporting a suspicious message easy.