Security Basics for Distributed Teams

Security models built around a trusted office network stop making sense when nobody is on it. What replaces them is less dramatic than people expect, and a few widely recommended measures are close to useless.

General guidance. Regulated industries have specific obligations that override anything here.

What actually changed

The perimeter is gone. The old model — trusted inside, untrusted outside — assumed people were inside. Now everyone is outside, permanently.

Devices leave. Laptops travel, sit in homes, occasionally get stolen from cars.

Networks are uncontrolled. Home routers with default passwords, shared flats, hotel wifi.

Household members exist. Screens are visible to people who do not work for you. Calls are audible.

What matters most

In rough order of impact per unit of effort:

Multi-factor authentication everywhere. Single largest reduction in risk available. Prefer app-based or hardware keys over SMS.

A password manager, provided and mandatory. Reused passwords are the mechanism behind most account compromise. Providing the tool removes the excuse.

Full-disk encryption on every device, verified rather than assumed. This is what makes a stolen laptop an inconvenience instead of a breach.

Automatic updates enforced. Unpatched operating systems and browsers are the other main route in.

Device management that lets you remotely wipe a lost machine and confirm compliance. Non-negotiable once you have more than a handful of people.

Least-privilege access, reviewed periodically. Most organisations grant access on joining and never revisit it, so people accumulate permissions for years.

A joiners-movers-leavers process that actually runs. Accounts belonging to people who left are a persistent and entirely avoidable exposure.

The VPN question

Many organisations reflexively require a VPN for everything and treat it as the security control.

A VPN encrypts traffic between the device and your network. That was valuable when internal services were unencrypted and sat behind a perimeter. Today most services are accessed over encrypted connections regardless, and the VPN adds latency, breaks things, and gives people a reason to work around it.

It remains useful for reaching genuinely internal systems. It is not a general-purpose security measure, and treating it as one produces a false sense of protection.

The more coherent model is identity-based: authenticate the person and the device on every request, rather than trusting anything because of where it connects from.

The human layer

Phishing is the main threat and remote work makes it easier, because people cannot turn to a colleague and ask "did you get this too?"

Give people a fast, blameless way to report something suspicious, and respond quickly. The organisations that get breached are frequently the ones where someone noticed and did not want to look foolish.

Attacks impersonating internal requests — an urgent message apparently from a manager — work better remotely because the normal verification channel is missing. Establish an out-of-band check for anything involving money or credentials, and make it socially acceptable to use it.

What is mostly theatre

Mandatory VPN for accessing public web services. Adds nothing, costs goodwill.

Requiring people to secure their home router in ways you cannot verify and they cannot necessarily implement.

Annual click-through training that nobody remembers. Short, frequent, specific beats long and annual.

Screen recording and activity monitoring framed as security. It is surveillance with a security label, and it does not address any of the actual risks above.

Practical items people forget

Privacy screens for anyone working in shared space. A stated rule about who may be within earshot of confidential calls. Clear guidance on personal device use. A documented procedure for a lost or stolen laptop that someone can follow at 11pm on a Saturday, because that is when it will happen.