Working from home securely: a practical guide for small businesses

Hybrid working stuck. Most Lincolnshire businesses we support have staff working from home at least a couple of days a week, and the IT setup that supports that is genuinely different from an office-only setup. A few years in, some of the shortcuts people took during lockdown are now the source of the security incidents we get called to.

Laptops, not home PCs

The single biggest change from the lockdown era is that home working now needs proper, company-managed laptops. Not a family desktop with three teenagers logged into it. The reason is simple: you can't apply any consistent security to a machine you don't manage. Give staff a work laptop, enrol it in Intune (or the Google Workspace equivalent), and lock down what installs on it. This alone closes off most of the routes attackers use.

MFA everywhere

Multi-factor authentication on every account that touches the internet. Not just email — the payroll system, the accounts package, the CRM, the file share. If it has a login screen and it's reachable from the internet, it needs MFA. Use an authenticator app or a hardware key. SMS is better than nothing but is increasingly bypassed by attackers.

VPN, or something better

For most cloud-first businesses, you don't need a VPN at all — that's kind of the point of moving to 365. Conditional access rules do a better job of protecting cloud accounts than tunnelling everything back to the office. If you have a local file server or a line-of-business app that only lives on the office network, then yes, you need a proper VPN — but design it so people only turn it on when they need those specific systems.

Home Wi-Fi and the family printer

Home Wi-Fi is fine, as long as the work laptop is treating it as untrusted (which it should be by default). Bigger risks live on the network: the family smart TV that hasn't had a firmware update in six years, the printer with a default password, the IoT camera reachable from the internet. Staff don't need to fix all of that, but their work laptop should be configured to assume everything else on the home network is hostile.

The small stuff that actually helps

• A screen privacy filter for anyone working in a coffee shop or a co-working space.
• Full-disk encryption on every work laptop — BitLocker on Windows, FileVault on Mac. Both are free and both should be on by default.
• Auto-lock after five minutes, especially for anyone with kids or flatmates.
• A password manager everyone uses — Bitwarden, 1Password or the built-in Microsoft one is fine. Anything is better than a shared spreadsheet.
• Clear rules about what data can be saved locally vs cloud. "Everything in OneDrive, nothing on the desktop" is a good default.

None of this is complicated on its own. It's making sure it's all in place, on every machine, that's the job. Give us a shout if you'd like us to audit your setup.