Securing a remote employee's computer
Away from the office, a work computer is no longer behind the company network's protections. A few simple rules, applied centrally, are enough to cover most of the risks.
Kayzen Security editorial team3 min read
The hardware
- A work computer, inventoried and administered by the company or its IT provider.
- An encrypted disk (BitLocker on Windows, FileVault on macOS), with a recovery key held by the company.
- A screen that locks automatically after a few minutes of inactivity.
- No administrator account for everyday use.
Protection that follows the computer
The protections installed on the computer (malicious site filtering, antivirus, firewall, updates) must work wherever the computer is, and report their status to a central console. Protection that only works at the office does not protect the employee at home or on a train.
Network and access
- Home internet box kept up to date, Wi-Fi password changed from the default one, WPA2 or WPA3 encryption.
- Avoid public Wi-Fi for sensitive tasks; otherwise, use your phone's hotspot.
- Access to company applications through secure means (VPN, protected online applications), always with two-factor authentication.
- No transfer of work files to personal email accounts or storage.
Usage rules
- Keep work and personal life separate: no games or personal software on the work computer, no children on the work session.
- Know who to report a suspicious message, a loss or a theft to, and do so without delay.
- Lock the session as soon as you step away, including at home.
- Save files to the storage provided by the company, not only on the local disk.
The framework
The rules for remote work are set out in a collective agreement, an employer's policy or, failing that, an agreement between the employer and the employee (French labour code, article L.1222-9), and any monitoring tools must be proportionate and disclosed to employees, in accordance with employment law and the GDPR. The CNIL publishes recommendations on remote work for both employers and employees. The legal framework is to be validated by a professional.
Official sources
- CNIL (new tab) — Commission nationale de l'informatique et des libertés
- ANSSI (new tab) — Agence nationale de la sécurité des systèmes d'information — guides et publications
- Cybermalveillance.gouv.fr (new tab) — Assistance et prévention en sécurité numérique (fiches réflexes, prestataires ExpertCyber)
The resources cited are published by their authors in their original language. Kayzen is not affiliated with any of these organisations.
This guide is general and for information only. It does not replace legal advice or the help of an IT security professional.