Securing Remote and Hybrid Workers

Hybrid work is now normal for many organizations, including those that support the Department of War and other federal missions. Staff connect from home offices, hotel rooms, client sites and airport lounges. The traditional model, where trusted devices sat inside a protected office network, no longer describes where work happens.

Securing remote workers means moving protection to the places that travel with the user: the device, the identity and the connection to each application.

Start with managed devices

A personal laptop shared with family members is not a suitable place for sensitive work. Organization-managed devices let you enforce a known, secure baseline wherever the user is:

• Full-disk encryption, so a lost or stolen laptop does not expose data.
• Endpoint detection and response that reports to your security team from any network.
• Automatic patching of the operating system, browsers and applications, without waiting for the device to return to the office.
• Hardened configurations, such as disabling local administrator rights for everyday use and blocking unapproved software.
• Remote lock and wipe for lost devices.

If personal devices are allowed for limited purposes, such as email on a phone, use mobile management or app-level controls to keep work data separate and removable. NIST SP 800-46 covers telework and bring-your-own-device security in more detail.

VPN versus zero-trust access

A traditional VPN places the remote device on the internal network. Once connected, a user, or an attacker with that user's credentials, can often reach far more than they need. VPN appliances are also internet-facing and have been a frequent target of exploitation, so they must be patched quickly and monitored closely.

Zero-trust access, described in NIST SP 800-207, takes a different approach. Each request to each application is evaluated based on the user's identity, the health of the device and other context. Users reach only the applications they are authorized for, not the whole network.

• Verify identity strongly with phishing-resistant MFA.
• Check device posture, such as whether the device is managed, encrypted and patched, before granting access.
• Grant access per application rather than per network.
• Log every access decision so unusual activity can be detected and investigated.

Most organizations move gradually, keeping a VPN for some systems while shifting others behind zero-trust access. Our secure architecture engineers can help plan that transition.

Home networks and public Wi-Fi

You do not control the home router, the smart devices on the same network or the hotel Wi-Fi. Treat these networks as untrusted. Encrypt traffic between the device and your services, enable the device's host firewall, and avoid relying on the local network for protection. Give staff simple guidance: change default router passwords, keep router firmware updated, and use a separate network for smart home devices where possible.

Travel

• Take only what you need. Some organizations issue loaner devices with minimal data for international travel.
• Keep devices with you or locked away. Do not leave them in hotel rooms or with unknown parties.
• Use a privacy screen and avoid sensitive calls in public spaces.
• Avoid public charging ports and unknown USB devices. Use your own charger.
• Report loss or suspected tampering immediately so access can be revoked.

Foreign travel can carry additional reporting and briefing requirements for cleared personnel. Follow your security office's guidance.

Controlled unclassified information at home

NIST SP 800-171 and CMMC apply wherever controlled unclassified information is processed, including alternate work sites. Organizations should define where CUI may be handled remotely and how:

• Access CUI only on managed, compliant devices through approved connections that use FIPS-validated encryption where required.
• Do not print CUI at home unless explicitly permitted, and store and destroy any paper copies properly.
• Prevent household members from viewing or overhearing CUI.
• Do not download CUI to personal storage, email or messaging accounts.

Document these rules in policy and training, and make sure your system security plan reflects how remote work actually happens. Our CMMC team helps organizations address remote work in their assessments.

Frequently asked questions

Is a VPN still secure? A well-patched, MFA-protected VPN can be part of a secure design. The concern is broad network access and the exposure of the VPN appliance itself.

Can employees use personal computers for work? For sensitive data and CUI, organization-managed devices are strongly preferred, because you cannot verify or enforce the security of a personal computer.