Work From Anywhere, Securely: Laptops, Phones and Public Networks
Security Awareness · intro · 16 min read · last reviewed 2026-10-20
Secure remote work in practice: harden home routers, encrypt laptops, lock down phones, handle public Wi-Fi and travel, and report incidents fast.
TL;DR
- Secure remote work depends mostly on the device: full-disk encryption, a screen lock, current updates and remote wipe turn a stolen laptop into an expense instead of a breach.
- CISA says a home router is probably not secure out of the box; change the admin password, update firmware and turn off WPS, UPnP and remote management.
- The FTC says public Wi-Fi is usually safe because of widespread encryption, but HTTPS still reveals which sites you visit and does not prove a site is genuine.
- A consumer VPN shifts trust from the network to the VPN provider, according to the FTC; it does not stop phishing or malware.
- Report a lost device, an entered password or unexpected MFA prompts immediately, because early reporting limits the damage.
Working securely from anywhere comes down to three habits: a device that protects itself when it leaves your hands, a network you treat as untrusted wherever you are, and a fast report when something goes wrong. Get those right and the location matters far less than most remote-work policies suggest.
The device carries most of the risk. A laptop or phone with full-disk encryption, a screen lock, current updates and remote wipe survives being stolen from a cafe table. Without those, a lost bag becomes a data breach. Networks matter less now that most traffic is encrypted, but they still leak.
If you write your company's remote-work policy, the module checklists below double as the baseline to ask staff to meet.
Lock down the home office first
Home is where remote workers spend most of their hours, and it is the network they trust most without checking. CISA's own telework FAQ asks whether a home router is secure out of the box and answers "Probably not". The router your provider installed years ago is often still running its original settings.
Router hygiene
CISA's home network security tip lists the changes that matter most:
- Change the router's administrator password. Default credentials are often publicly known.
- Keep the firmware current. Check the manufacturer's site, or turn on automatic updates if the router supports them.
- Use WPA3 Personal where your router and devices support it. CISA's video conferencing tips accept WPA2 or WPA3 and say to disable legacy WEP and WPA.
- Turn off WPS, UPnP and remote management unless you have a specific need. WPS has a PIN design flaw that speeds up brute-force attacks.
CISA also suggests a Wi-Fi name that identifies neither you nor the router brand.
Separate work from personal
The cleanest setup is one device for work and another for everything else. The UK National Cyber Security Centre (NCSC) tells employers to remind staff to lock screens when unattended, "especially if there are children or housemates present".
If you must use a personal computer for work, check your company's policy first, as CISA advises. Then give work its own user account on that machine, never an account shared with family.
Smart devices on the same network
Doorbells, cameras, speakers and smart TVs sit on the same Wi-Fi as your work laptop. The NCSC's smart devices guidance says to change any default password, switch on automatic updates, turn on two-step verification in the device's app, and switch off remote access you do not need. Many routers offer a guest network. Putting smart devices and visitors on it keeps them off the network your work laptop uses.
CISA also recommends that you move, mute or disable virtual assistants and home security cameras during sensitive calls.
Common mistakes
- Treating the router as an appliance that never needs attention.
- Letting family members "just quickly" use the work laptop.
- Leaving a smart camera pointed at the desk where you take confidential calls.
Action checklist
Make the laptop protect itself
Assume your laptop will be lost or stolen at some point. The NCSC puts it plainly: staff are more likely to have their devices stolen or lose them away from the office. The goal is that a thief gets hardware, not data.
Full-disk encryption
Encryption means the disk is unreadable without your login. It is the single control that turns a stolen laptop from a breach into an expense.
- Mac: Open System Settings, click Privacy & Security, then FileVault. Apple's FileVault guide notes that Apple silicon and T2 Macs encrypt automatically, and FileVault adds the requirement for your login password. Store the recovery key somewhere other than the Mac itself.
- Windows: Go to Settings, then Privacy & security, then Device encryption. Microsoft's page explains that Device Encryption turns on BitLocker automatically, but not if you set up with a local account. Pro, Enterprise and Education editions also offer full BitLocker.
On a company-managed laptop, IT usually enforces encryption and holds the recovery key.
Updates, screen lock and firewall
Turn on automatic updates for the operating system and browser, and restart when prompted. The FTC's own advice on public Wi-Fi includes keeping your operating system, browser and security software current with automatic updates.
Set the screen to lock after a few minutes idle, and lock it yourself every time you stand up.
Keep the built-in firewall on. CISA says the operating system firewall is one you should enable "even if you have an external firewall", such as the one in your router.
EDR and managed devices, explained plainly
Company laptops often run an EDR agent (endpoint detection and response). Think of it as antivirus that also records what programs do, so the security team can spot an attack in progress and isolate the machine remotely. Do not disable it, even when it slows a build.
A "managed device" is one enrolled in the company's management system. That lets IT push updates, enforce encryption, and lock or wipe the device if you report it lost. If you are choosing an endpoint product for a small team, the EDR and XDR comparison lays out the categories.
Physical security
Shoulder surfing works on trains, planes and in coworking spaces. A privacy screen filter narrows the viewing angle so only the person in front can read it. Never leave the laptop on a cafe table while you order.
Common mistakes
- Storing the encryption recovery key in a file on the same laptop.
- Postponing updates for weeks because a restart is inconvenient.
- Asking IT to remove the EDR agent because it uses CPU.
Action checklist
Treat the phone as a work device, because it is
Your phone holds your email, chat, authenticator app and the codes that prove you are you. It is the most valuable device you carry, and the easiest to lose.
The basics
- Update the OS as soon as updates arrive, and replace phones that no longer receive them.
- Use a strong passcode plus Face ID, Touch ID or fingerprint unlock. A six-digit code beats four digits; an alphanumeric code beats both.
- Install apps only from the official store. On Android, Google Play Protect checks installed apps for harmful behaviour, including apps from other sources, but the safest path is to not sideload at all.
- On iPhone, turn on Stolen Device Protection. Apple's documentation says that away from familiar locations it requires Face ID or Touch ID, with no passcode fallback, to view saved passwords or erase the phone. Changing your Apple Account password also triggers an hour-long security delay. It needs iOS 17.3 or later and must be on before the phone goes missing.
Work profiles, BYOD and MDM
BYOD (bring your own device) means using your personal phone for work. Done well, it uses a split. An Android work profile keeps work apps in a separate space marked with a briefcase icon. Google states that the organisation manages the work apps and data while "your personal apps, data, and usage remain private."
MDM (mobile device management) is the system your employer uses to configure, update and, if needed, wipe work devices or the work part of your device. The NCSC notes that employers can use MDM to set devices up with a standard configuration. If your company asks you to enroll a personal phone, ask what it can see and whether a wipe removes only work data. A good policy answers both in writing.
SIM-swap risk
In a SIM swap, a criminal convinces your carrier to move your number to their SIM. Every text code then goes to them. The FBI's Internet Crime Complaint Center recorded 1,611 SIM-swap complaints with losses of more than $68 million in 2021, up from 320 complaints across 2018 to 2020.
The FBI's advice: keep your phone number off public profiles, never give your carrier PIN to someone who calls you, and use stronger MFA such as authenticator apps or security keys. Ask your carrier what account PIN or port-out protection it offers. Then move important accounts off SMS codes, as explained in why SMS MFA is not MFA. If your service suddenly drops to "SOS only", treat it as an emergency. The SIM-swap scam profile and the SIM-swap recovery steps cover what to do next.
Common mistakes
- Running a phone that stopped receiving security updates years ago.
- Installing a "productivity" app from a link in a chat message.
- Keeping SMS as the only second factor on your work email.
Action checklist
Public, hotel and airport Wi-Fi: what actually protects you
The FTC now says that because of widespread encryption, "connecting through a public Wi-Fi network is usually safe." Usually is not always.
What HTTPS does and does not protect
HTTPS encrypts what you send and receive with a website. Someone on the same network cannot read your password, your messages or the page you are on. The EFF explains that intermediaries still see the site name, though not the path. Anyone monitoring a Wi-Fi network can build a list of the sites you visit.
HTTPS also says nothing about whether the site is honest. The FTC warns that scammers create fake websites and encrypt them so they look safe. A padlock means the connection is private, not that the other end is trustworthy. To keep the domain names private too, see encrypted DNS and Private Relay.
When a VPN helps, and when it is marketing
A company VPN connects you to your employer's internal systems. The NCSC describes it as an encrypted connection that authenticates the user or device and encrypts data in transit. If your employer provides one, use it as instructed. Many companies are moving toward zero trust access instead, where each app checks you directly; the ZTNA entry explains the difference.
A consumer VPN sends your traffic through a company's servers. The FTC's guidance on VPN apps is blunt: a VPN "just shifts trust from those networks to the VPN app provider". It does not make you anonymous. The FTC also warns that not all VPN apps actually encrypt your traffic, and that many free ones sell ads or share data.
A consumer VPN helps on a network you distrust, by hiding which sites you visit from that network. It does not stop phishing, malware, or a fake login page. Claims that a VPN makes you "unhackable" are marketing. If you want one, check its permissions and read the privacy policy before trusting it with all your traffic.
Evil-twin networks and captive portals
An evil twin is a fake Wi-Fi network named like a real one. In 2025 an Australian court sentenced a man who ran evil-twin networks at airports and on domestic flights. The Australian Federal Police say his device listened for phones searching for known networks, created copies with the same names, and served a page asking for email or social media logins. Entering details did not even give internet access.
The AFP's advice applies everywhere: a network that asks for your email or social media login to get online should be avoided. Captive portals (the hotel or airport sign-in page) legitimately ask for a room number or ask you to accept terms. They should never ask for your work password. CISA's telework guidance says to verify the network name with staff before you join.
Use your phone's hotspot instead
The simplest fix for an untrusted network is to not use it. Your phone's personal hotspot gives the laptop a connection only you control.
Location risk table
| Location | Main risks | Habits that address them |
|---|---|---|
| Home | Default router settings, shared family devices, smart devices on the same network | Harden the router, keep a work-only device, put smart devices on a guest network |
| Cafe | Shoulder surfing, theft from the table, look-alike Wi-Fi names | Privacy screen, never leave the laptop, use your phone hotspot |
| Airport | Evil-twin networks, public USB chargers, distraction during theft | Confirm the network with staff, charge from a wall outlet or your own battery, keep devices on your person |
| Hotel | Shared network with other guests, devices left in the room, captive portals asking for too much | Hotspot or company VPN for work, lock devices away, never enter work credentials on a portal |
| Client site | Unfamiliar guest Wi-Fi, being overheard, unknown USB drives | Ask for guest access or use your hotspot, take calls in private, never plug in a drive you were handed |
Common mistakes
- Trusting a network because its name includes the venue's name.
- Assuming a padlock icon means the site is genuine.
- Buying a free VPN app and assuming the problem is solved.
Action checklist
Travel without handing over your data
Travel adds fatigue and time pressure to every risk above. The travel security checklist covers the personal side in detail; this module covers what matters for work.
Border crossings
Border agencies in many countries can inspect devices. In the United States, CBP says its search authority covers electronic devices. A basic search is a manual review; an advanced search, which connects equipment to copy or analyse contents, needs reasonable suspicion and senior approval. CBP reports that fewer than 0.01 percent of arriving international travelers had devices searched in fiscal year 2025. Officers examine only what is stored on the device, not data held solely in the cloud.
For employers, the practical answer is to minimise what travels and to tell staff whom to call if a device is held. Never advise employees to mislead or obstruct border officers.
Charging stations and USB
Public USB ports can, in principle, deliver malware or pull data, a risk the FCC warns about as "juice jacking". Real-world cases are rarely reported, but the precautions are cheap: use a wall outlet with your own adapter, carry a battery pack, or use a charge-only cable. If a phone asks whether to trust a connected computer, decline.
The same logic covers USB drives. The NCSC notes that removable media can introduce malware and recommends moving files through corporate storage instead.
Lost or stolen device response
- Mark it as lost. On iPhone, use Find My or iCloud.com/find and choose Mark as Lost. Apple advises you to leave out contact details if it was stolen. Do not remove it from Find My, because that removes Activation Lock. On Android, use Find Hub or android.com/find to lock or erase it.
- Report it to your employer immediately, so IT can lock or wipe it and revoke sessions.
- Call your carrier to suspend service, and report it to police if stolen.
- Change the passwords for accounts that were signed in, starting with email.
- Watch for fake "we found your phone" messages. Apple states it will never contact you to say your device has been found. The recovery scams page shows how these work.
Common mistakes
- Plugging into the USB port on a seat back or gate charger without thinking.
- Waiting a day to report a lost laptop in case it turns up.
- Removing a stolen iPhone from Find My, which helps the thief resell it.
Action checklist
Video calls and collaboration tools
Video calls leak information three ways: the wrong people join, the wrong things appear on screen, and recordings outlive their purpose.
Meeting links
CISA's video conferencing tips say to use only organisation-approved tools. For private meetings, require a password, use a waiting room, and lock the meeting once everyone has joined. Do not post meeting links on public social media. If an outside party uses an unapproved tool, join through the browser rather than installing their software.
Be suspicious of meeting invites that arrive unexpectedly and push you to download an "update" or a new client. Fake interview and recruiter invites use exactly this trick; see fake interview malware.
Screen-sharing leaks
Share a single window, not your whole screen. CISA recommends that you close or minimise other windows, and hide the address bar when showing internal sites. Turn off notifications before presenting, so a private message does not pop up in front of a client. Check the background too: CISA mentions clearing whiteboards and using background blur.
Recording
Tell participants before you record, and know who owns and can access the recording. CISA suggests changing default file names and consulting counsel, since recording laws vary.
A recording of your face and voice is also raw material for impersonation. The deepfake executive fraud guide explains why process controls, not detection, stop a convincing fake on a call.
Common mistakes
- Sharing the entire desktop with a password manager or chat window open.
- Reusing one permanent meeting link for every call, including external ones.
- Recording by default and keeping recordings forever.
Action checklist
Report early: what to report and how fast
The most useful thing to do after a mistake is report it quickly. The NCSC urges employers to encourage reporting "in a positive, blame-free manner", because staff who fear reprisals report later. Early reporting limits the damage.
What to report, and when
| Event | Report within | Why speed matters |
|---|---|---|
| Lost or stolen laptop, phone or tablet | Immediately | IT can lock, wipe and revoke sessions before the device is opened |
| You entered your password on a suspicious page | Immediately | The attacker may log in within minutes |
| Unexpected MFA prompts you did not start | Immediately | Someone has your password; see MFA fatigue |
| Phone suddenly loses service | Immediately | Possible SIM swap |
| A caller claiming to be IT asks for a code or remote access | Same hour | Help-desk impersonation often targets several staff at once |
| Odd behaviour after installing something | Same day | Malware may still be spreading |
If you are a policy writer, publish one contact for all of these, reachable outside office hours, and state in writing that reporting a mistake carries no penalty. The workplace security habits guide covers how to make that culture stick, and ransomware readiness covers what happens after a report.
Common mistakes
- Trying to fix it yourself first, then reporting a day later.
- A policy that names a ticket queue nobody watches at weekends.
Action checklist
Your complete checklist
Key takeaways
- Spend your effort on the device before the network: encryption, updates and a screen lock beat any Wi-Fi trick.
- Your phone hotspot is a better answer to sketchy public Wi-Fi than most VPN apps.
- Any Wi-Fi sign-in page that asks for an email or social login is a red flag, not a formality.
- SMS codes are the weak point SIM swappers target; move work accounts to authenticator apps or passkeys.
- A blame-free, 24/7 reporting route does more for remote security than another training module.
- Travel light on data: what is not on the device cannot be lost, stolen or inspected.
Frequently asked questions
- Is it safe to work on public Wi-Fi?
- Usually, according to the FTC, because most sites and apps now encrypt traffic. The remaining risks are fake look-alike networks, sign-in pages that harvest credentials, and the network seeing which sites you visit. Confirm the network name with staff, never enter work credentials on a Wi-Fi sign-in page, and use your phone hotspot or company VPN for sensitive work.
- Do I need a VPN when working from a cafe or hotel?
- Use your company VPN if your employer requires it. A consumer VPN hides which sites you visit from the local network, but the FTC notes it only shifts trust to the VPN provider and does not make you anonymous. It does not protect you from phishing, malware or fake login pages.
- What is an evil twin Wi-Fi network?
- It is a fake network named to look like a real one, often at airports or hotels. In a case prosecuted by the Australian Federal Police, fake networks served a page asking for email or social media logins. Avoid any network that asks for those details to get online.
- How do I secure my home router for remote work?
- Change the default administrator password, update the firmware, and use WPA3 (or WPA2 if WPA3 is unavailable). CISA also recommends turning off WPS, UPnP and remote management unless you need them. Put smart devices and visitors on a guest network.
- Can my employer see my personal data if I use my phone for work?
- With an Android work profile, Google states that the organisation manages work apps and data while personal apps, data and usage remain private. Ask your employer in writing what their management system can see and whether a remote wipe removes only work data.
- Is it safe to charge my phone at airport USB ports?
- The FCC warns that public USB ports could in principle carry malware but says it is not aware of confirmed cases. The fix is cheap: use a wall outlet with your own adapter, a battery pack, or a charge-only cable, and decline any prompt to trust a connected computer.
- What should I do first if my work laptop or phone is stolen?
- Report it to your employer immediately so IT can lock or wipe it and revoke sessions. Mark it as lost in Find My or Find Hub, call your carrier and the police, then change passwords for signed-in accounts, starting with email.
Related
Research pillars
Vendor comparisons
Go deeper
Sibling guides
Glossary