Secure Remote Working

Key Control Areas

• Remote Access Architecture: VPN and ZTNA (AC-17, SC-07, SC-08, SC-12, IA-02): Remote access is the foundation. AC-17 governs remote access methods: authorised remote access technologies, connection requirements, and usage restrictions. Traditional VPN (IPsec or SSL/TLS) creates an encrypted tunnel from the device to the corporate network gateway. ZTNA (Zscaler, Cloudflare Access, Microsoft Entra Private Access) brokers per-application access based on identity and device posture, never exposing the corporate network. SC-07 enforces boundary protection: VPN split tunnelling decisions (full tunnel for security but impacts performance; split tunnel for performance but reduces visibility), ZTNA application segmentation, and firewall rules that restrict remote device access to only required services. SC-08 protects transmission confidentiality: all remote access uses encrypted tunnels (TLS 1.3, IPsec, WireGuard), with certificate-based authentication preferred over pre-shared keys. SC-12 manages cryptographic keys: VPN certificates, ZTNA trust certificates, and device identity certificates issued from a managed PKI. IA-02 authenticates remote users: phishing-resistant MFA (FIDO2/passkeys preferred) for all remote access, with conditional access policies that evaluate device compliance, location risk, and user risk signals before granting access.
• Endpoint Hardening and Device Management (CM-02, CM-06, SC-28, SI-03, CM-08): The device is the new perimeter. CM-02 establishes baseline configurations for remote endpoints: full disk encryption (BitLocker, FileVault), host firewall enabled, screen lock timeout, USB device restrictions, and local admin rights removed. CM-06 enforces configuration settings through MDM (Intune, Jamf, Workspace ONE): compliance policies that verify encryption, OS version, patch level, and security agent presence before granting access. SC-28 protects information at rest: full disk encryption ensures data is protected if devices are lost or stolen -- the most common physical security risk for remote workers. SI-03 provides malicious code protection: EDR agents (CrowdStrike, SentinelOne, Microsoft Defender for Endpoint) on all managed endpoints, with cloud-based management that works regardless of network location. CM-08 maintains the system component inventory: every device that accesses corporate resources must be enrolled, tracked, and subject to lifecycle management including secure wipe at end of life or employee departure. Unmanaged devices should only access corporate resources through virtual desktop infrastructure (VDI) or browser-based application delivery, never through direct network access.
• BYOD and Device Compliance (AC-19, CM-06, AC-20, SC-28, PE-17): BYOD requires architectural compromise. AC-19 controls access from mobile and personal devices: containerisation (Intune App Protection, Samsung Knox, Android Enterprise) that creates a managed corporate workspace on an unmanaged device, with data separation between personal and corporate. CM-06 enforces minimum device requirements: OS version, encryption enabled, no jailbreak/root, screen lock enabled, verified through device compliance checks at every access attempt. AC-20 governs use of external systems: personal devices accessing corporate resources must meet defined security baselines, with reduced access scope compared to fully managed devices (for example, email and collaboration but not access to sensitive systems). SC-28 protects corporate data on personal devices: app-level encryption for corporate data, remote wipe capability limited to corporate container only (not the entire personal device), and policies preventing copy/paste from corporate apps to personal apps. PE-17 addresses the alternate work site: guidance for home office physical security including screen privacy, device storage when not in use, and secure disposal of printed materials.
• Network Security and Split Tunnelling (SC-07, AC-04, SC-08, SI-04, AC-17): Network decisions have cascading security implications. SC-07 defines the split tunnelling policy: full tunnel routes all traffic through the corporate gateway (maximum visibility and control, but impacts performance for cloud services and video conferencing); split tunnel routes only corporate-destined traffic through the gateway (better performance, but internet traffic bypasses corporate security controls); cloud-intelligent split tunnel routes traffic to sanctioned cloud services directly while tunnelling everything else (the modern compromise). AC-04 enforces information flow: DNS filtering and web proxy for remote devices (Zscaler, Netskope, Cloudflare Gateway) regardless of tunnel configuration, ensuring that security controls apply to all internet access from corporate devices. SC-08 protects data in transit: encrypted DNS (DoH/DoT), certificate pinning for corporate applications, and HSTS enforcement. SI-04 monitors remote endpoints: EDR telemetry and DNS query logs provide visibility into device behaviour regardless of network location -- essential when traffic doesn't traverse the corporate network. AC-17 restricts remote access: geo-blocking for remote access from high-risk countries, impossible-travel detection, and time-based access restrictions for sensitive systems.
• Collaboration Platform Security (AC-22, SC-07, AU-02, SC-28, AC-04): Collaboration tools are the primary data channel for remote workers. AC-22 controls publicly accessible content: preventing accidental sharing of internal documents via public Teams/Slack channels, restricting external guest access to collaboration platforms, and applying data classification labels to shared content. SC-07 protects platform boundaries: federation controls (which external domains can communicate with internal Teams/Slack), meeting security (waiting rooms, lobby controls, recording notifications), and file sharing restrictions. AU-02 logs collaboration platform activity: message and file access auditing for compliance and investigation, meeting attendance records, and external sharing events. SC-28 protects collaboration data at rest: platform-level encryption (customer-managed keys where available), data residency controls for regulated data, and retention policies aligned with records management requirements. AC-04 controls information flow through collaboration platforms: DLP policies that detect and block sharing of sensitive data (credit card numbers, personal data, confidential classifications) through chat, file sharing, and meeting recordings.
• Data Loss Prevention for Remote Workers (AC-04, MP-02, SC-28, SI-04, AC-19): Data leaves the building with the worker. AC-04 enforces DLP policies: endpoint DLP that monitors and controls data movement to USB drives, personal cloud storage, personal email, and print. Cloud DLP (Microsoft Purview, Netskope, Zscaler) that monitors data flowing through sanctioned and unsanctioned cloud services. MP-02 controls media access: USB storage restrictions (block, read-only, or encrypt-only), Bluetooth file transfer controls, and printer restrictions on remote devices. SC-28 protects data at rest on remote devices: encrypted local storage, time-limited offline access to sensitive documents, and automatic cache clearing for classified materials. SI-04 monitors for data exfiltration: anomaly detection on file download volumes, large email attachments to personal addresses, and unusual cloud storage synchronisation patterns. AC-19 restricts data access from personal devices: preventing download of sensitive documents to BYOD devices, enforcing view-only access for classified materials, and watermarking documents accessed from unmanaged devices.
• Identity and Conditional Access (IA-02, AC-02, IA-05, CA-07, AC-06): Identity is the control plane for remote access. IA-02 authenticates remote users with phishing-resistant MFA: FIDO2 security keys or passkeys for high-value access, authenticator apps as minimum standard, SMS deprecated. Conditional access evaluates multiple signals: device compliance (is the device managed, encrypted, patched?), location (known network vs unknown, domestic vs international), user risk (sign-in risk score from identity protection), and application sensitivity (standard apps vs crown jewels). AC-02 manages accounts for remote access: dedicated admin accounts that cannot be used remotely (privileged access from PAWs only), service account restrictions, and contractor account lifecycle management. IA-05 manages authenticators: certificate-based device authentication (the device proves its identity, not just the user), token binding to prevent credential theft replay, and passwordless authentication roadmap. CA-07 provides continuous monitoring: session risk re-evaluation during long sessions, step-up authentication when risk signals change, and automatic session termination when device compliance lapses. AC-06 enforces least privilege: remote workers get access to the applications they need, not the entire network -- ZTNA's fundamental advantage over VPN.

When to Use

This pattern applies to every organisation with remote or hybrid workers -- which is now the majority. It is particularly critical for: financial services firms where regulators expect equivalent security controls regardless of work location, organisations processing sensitive personal data where GDPR breach risks increase with remote access, healthcare organisations accessing patient records remotely, legal and professional services firms handling confidential client materials, government organisations with classification requirements, any organisation that experienced security incidents during the 2020 rapid remote working deployment and needs to mature their architecture, and organisations migrating from VPN to ZTNA.

When NOT to Use

Organisations where all work is performed on-premises with no remote access requirements do not need this pattern -- but such organisations are increasingly rare. Very small organisations (under 10 staff) may implement remote security through simpler means: managed laptops with full disk encryption, cloud-based identity with MFA, and cloud-native applications that don't require VPN -- essentially achieving ZTNA-like outcomes without formal ZTNA infrastructure. Organisations with extremely sensitive environments (classified government, air-gapped OT) may prohibit remote access entirely rather than architect security controls around it.

Typical Challenges

The biggest challenge is user experience versus security: every additional security control (MFA prompts, VPN reconnection, compliance checks that block access) generates friction that users try to circumvent. Over-engineered security for remote access drives shadow IT -- users find unsanctioned ways to access what they need. BYOD programmes struggle with the boundary between corporate control and personal privacy: employees resist MDM on personal devices, particularly full device management. Split tunnelling decisions are politically charged: security teams want full tunnel for visibility, users want split tunnel for performance, and the right answer depends on the organisation's cloud adoption posture. Home network security is largely uncontrollable: corporate devices share networks with compromised IoT devices, family members' unpatched machines, and default-password routers. Endpoint compliance checking creates a chicken-and-egg problem: the device must connect to check compliance, but shouldn't connect if non-compliant. VPN to ZTNA migration is complex and lengthy: applications must be onboarded individually, and the transition period requires operating both architectures simultaneously. Printing and physical document security at home is difficult to enforce and easy to forget.

Threat Resistance

Secure Remote Working addresses the expanded attack surface of distributed workforces. Credential phishing targeting remote workers is mitigated by phishing-resistant MFA (FIDO2/passkeys) and conditional access that detects anomalous sign-in patterns (IA-02, CA-07). Device theft or loss is mitigated by full disk encryption, remote wipe capability, and session tokens that expire without device compliance verification (SC-28, CM-06, AC-19). Man-in-the-middle attacks on untrusted networks are mitigated by encrypted tunnels, certificate-based authentication, and HSTS enforcement (SC-08, SC-12, AC-17). Data exfiltration through personal devices or cloud storage is mitigated by DLP policies, container separation on BYOD, and monitoring of data movement patterns (AC-04, AC-19, SI-04). Lateral movement from compromised remote endpoints is limited by ZTNA architecture that never places remote devices on the corporate network, combined with micro-segmentation of application access (SC-07, AC-06). Home network attacks (ARP poisoning, DNS hijacking, IoT-based lateral movement) are mitigated by endpoint isolation controls, encrypted DNS, and endpoint protection that operates independently of network security (SI-03, SC-08). Insider threat from remote workers is addressed through session monitoring, DLP, and behavioural analytics that detect anomalous data access patterns regardless of user location (SI-04, AU-02, AC-04).

Assumptions

The organisation has an identity provider capable of conditional access policies (Azure AD/Entra ID, Okta, or equivalent). MDM capability exists or is being deployed for corporate devices. Internet connectivity is available at remote locations (not always guaranteed -- consider offline access requirements). HR policies support remote and hybrid working. Budget exists for remote access infrastructure (VPN/ZTNA, MDM, endpoint protection). Users have been trained on remote working security expectations.

Developing Areas

• SASE (Secure Access Service Edge) convergence is the dominant architectural trend for remote working security, combining ZTNA, CASB, SWG, and SD-WAN into a unified cloud-delivered service. However, most vendor offerings are still assemblages of acquired products rather than natively integrated platforms. Organisations deploying SASE report inconsistent policy enforcement between components, separate management consoles for different functions, and integration gaps that require manual workarounds. True single-pass architecture where all security functions inspect traffic once is the stated goal but not yet the reality for most vendors.
• VPN-less zero trust network access is the target architecture for most organisations, but the migration path from legacy VPN is proving longer and more complex than anticipated. Applications must be individually onboarded to ZTNA, legacy protocols (SMB file shares, thick client applications, RDP) often lack native ZTNA support, and the learning curve for identity-aware access policies is steep. Most organisations are operating VPN and ZTNA in parallel for 18-36 months during transition, doubling the operational burden and creating policy inconsistencies between the two access methods.
• Remote endpoint posture attestation before resource access is becoming a standard capability in conditional access platforms, but the depth and reliability of posture checks vary significantly. Surface-level checks (OS version, encryption enabled, AV present) are straightforward, but meaningful posture assessment -- verifying that EDR is actively protecting rather than just installed, confirming that OS security features like Secure Boot and HVCI are operational, and detecting jailbroken mobile devices that spoof compliance -- requires deep device integration that is inconsistent across platforms and MDM vendors.
• Home network security represents an uncontrolled threat surface that corporate security architectures must accept rather than solve. Consumer routers with default credentials, unpatched IoT devices, and family members' compromised machines share the same network as corporate endpoints. While endpoint isolation features (Windows Defender Firewall public profile, macOS stealth mode) provide some protection, the reality is that corporate devices on home networks are exposed to local network attacks that would be blocked by enterprise network security controls. Emerging approaches include DNS-layer protection (Cisco Umbrella, Cloudflare Gateway) that extends to the home environment, but comprehensive home network security guidance for employees remains an unsettled area of policy and technology.