The biggest work from home risks are unmanaged or poorly patched devices, phishing, weak remote access and data kept in the wrong places. Home Wi-Fi is the least of them. Fix identity, device health and data handling first, because those decide how far one mistake can travel.
What does NIST say to secure?
NIST SP 800-46 Rev. 2 covers enterprise telework, remote access and bring your own device. It says all components of these technologies, including organization-issued and personal devices, should be secured against expected threats identified through threat models. That is the right instinct: list the threats, then match controls to them.
CISA's guidance for everyone names four core steps: avoid and report phishing, use strong passwords, use multifactor authentication with a password manager, and update software. For organizations it adds logging, backups, encryption of data and an incident response plan.
What does a remote workday look like as a threat model?
Constructed example for a finance analyst working from a spare room.
- 8:30, she logs in to the company portal from her own laptop. Risk: the laptop is unpatched and shared with a family member who installs browser extensions.
- 10:00, an email appears to be from the CFO asking for a changed bank detail. Risk: social engineering. CISA lists a suspicious sender address, generic greeting, urgency and spoofed links as common signs of phishing.
- 12:00, a call from "IT support" asks her to read out a one time code. Risk: vishing, which uses voice and can spoof caller ID.
- 14:00, she downloads a report to the desktop to work offline. Risk: company data now lives on an unmanaged disk.
- 17:00, she prints a statement and leaves it on the shared desk. Risk: physical exposure.
None of those need an attacker to break into her router. They are identity, device and data problems.
Which controls give the most value?
- Multifactor authentication on every remote access path, and phishing resistant factors for admins and finance staff when you can.
- Device health as a condition of access: current patches, disk encryption and screen lock. If you cannot manage a personal device, give it a narrower, browser based path.
- A way to verify requests out of band. A rule that bank detail changes are confirmed by a call to a known number stops the CFO email whatever its quality.
- Data stays in approved systems. Offer a working way to do the job without local copies, because people route around controls that make work impossible.
- Logging for remote sign ins, with alerts for impossible travel and new devices.
- A simple reporting path: one address or number, and no blame for a click.
What about the home network?
Basic hygiene matters: change the router's default admin password, update its firmware, use a strong Wi-Fi passphrase and keep work devices off a guest network full of smart home gadgets. But NIST's framing suggests treating the home network as untrusted anyway. Encrypt traffic with TLS or a VPN, and rely on authentication at each resource rather than on the network.
How to check or apply this
- Write the five or six threats for your own remote staff, in plain words, using a workday walk through like the one above.
- Check that every remote access path requires MFA. Count the exceptions.
- Measure how many devices meet your patch and encryption baseline.
- Confirm a documented out of band check exists for payments and credential resets.
- Run a phishing and vishing exercise and treat the results as training input, not discipline.
- Test offboarding: can you revoke a remote worker's access and wipe company data within an hour?
What about personal devices and shared households?
Many remote workers use a family computer or a phone for something work related. Decide a policy instead of leaving it to chance. If personal devices are allowed, give them a limited, browser based path with no local downloads, and require a screen lock and current updates. If they are not allowed, say so plainly and supply a managed laptop. Remind staff that other people in the home can see a screen, and that smart speakers and video calls may pick up sensitive conversations.
Quick check
Is a VPN enough to secure remote workers?
No. A VPN protects traffic in transit. It does not fix a phished account, an unpatched laptop or data saved to a personal disk.
What is the first control to roll out?
Multifactor authentication on all remote access, followed by device health checks and an out of band process for payment and password changes.
Sources
- NIST SP 800-46 Rev. 2, Guide to Enterprise Telework, Remote Access, and BYOD Security
- CISA, Cybersecurity Awareness Month: core steps for everyone and organizations
- CISA, Avoiding Social Engineering and Phishing Attacks
Last reviewed: 18 October 2026.
