Remote work is more convenient and accessible than ever before, and cybersecurity practices are evolving rapidly to reflect this new reality. If you work for a legacy company, your policies were most likely designed for an office-based system. If you’re running a start-up, creating security protocols might seem like a daunting process. Crafting a modern, flexible network can be complicated, especially if you plan to hire globally and need to account for different types of equipment and connections. Fortunately, there are a few basic principles that will provide a stable foundation for your team.
Your guide to network security for remote workers.
1. Create acceptable use policies for systems and devices
Managing a distributed workforce requires a great deal of trust, and it’s important to set expectations in writing. Acceptable use policies (AUPs) are standard in business environments because they explain what the company’s computer network is designed for and which behaviors are and aren’t allowed. The main goal is to keep data secure as employees interact with the network and use company-provided equipment.
This might sound like an outdated concept at a time when more people are working remotely and using devices they already own, but these changes make AUPs even more important. Many companies still provide their employees with computers and need to lay out some ground rules. An AUP can also be written or updated to reflect new bring-your-own-device (BYOD) and mobile device management (MDM) policies to protect any company data your team accesses.
The details of an AUP will vary by organization, but there are a few key components:
- A list of permitted devices
- Guidelines for separating and securing personal and company data
- Security software requirements, including malware protection, backup tools, and authenticators
- Details about necessary IT access for updates and monitoring
- Procedures for reporting and wiping lost or stolen devices
- Steps for removing access to company data after a violation or when an employee leaves the organization
Keep the document as brief as possible—no more than two pages—and have employees submit an acknowledgement that they’ve read the information and understand the rules around compliance, as well as potential consequences for violating them.
2. Provide access to a VPN and secure cloud
While many people have secure Wi-Fi at home, you need a plan that protects all users and network connections, whether an employee is working at a local library or café or working in another country. A virtual private network (VPN) provides additional security, even on a shared network. The VPN encrypts data and masks device location, making it harder for someone to hack into the system and access data they’re not entitled to.
Most importantly, a good VPN will include a kill switch that closes connections in case of a service interruption. This might sound inconvenient, but it’s a useful feature that prevents data loss when a connection is deemed to be unsecured.
Using a centralized storage system can also be a valuable security tool. Not only will you have backup versions of important files, but you’ll also have greater control over who can access those files. First, set up multi-factor authentication (MFA) to grant people access to the cloud. Then, decide what capabilities each user should have. Should they have view-only access, or will they need to be able to share and edit files?
3. Establish access levels to key systems and software
No matter how you choose to provide equipment and network access to your team, you need a clear hierarchy for all users so you know what they should have access to. “Least privilege” is the standard for determining authorization. This means identifying which features are absolutely necessary for each employee to do their job effectively.
For example, you may want all workers to be able to create and save files and perform routine program updates for their individual devices, but you probably don’t want them to install new software or make changes to the operating system. Your IT team should manage administrator-level duties, like software installations, troubleshooting problems, and major operating system updates. Remote work being done on a variety of devices can make role-based access complicated, but it’s necessary to audit all devices and users within the system to determine what’s appropriate for each employee.
If your employees are using a BYOD policy, it’s safe to assume that some programs will have overlapping uses, like videoconferencing for work and virtual gatherings with friends and family. It’s important to acknowledge the overlap and support your team’s needs for interaction and stable relationships on and off the clock, so make sure any tools that can do double-duty are as secure as possible. It’s worth investing in paid versions of programs that allow for secure, password-protected meeting links, and reminding employees that they should be the only ones handling company data and employer-provided equipment.
Managing user access levels on Oyster
Managing the admin of a growing global workforce certainly isn’t a one-person job. It’s a team effort. But for security reasons, you’re probably a bit hesitant to give the entire team full account access.
Each member of your team has different roles and responsibilities, and therefore requires different permissions. One of your users might only need to approve time off and expense requests, while another may need added permissions to access payroll data or personal information.
At Oyster, we want to empower your users to work collaboratively, while minimizing security risk. The new Team Manager role allows you to easily set manager-level permissions to action time-off and expense requests—so you can all work together, securely.
Oyster’s Team Manager role helps your users to:
- Minimize security risk and reduce stress: With the ability to set the right permissions for your Team Managers, you get peace of mind that work is being done safely and securely.
- Share the workload across your team: With adjustable permissions, you can enlist more of your team to tackle the admin work. (Rather than bearing all the tasks yourself.)
- Manage permissions easily: No need to be a security expert. It’s super easy to work in Oyster's platform. In a few clicks, you can set and adjust user-level access.
When you’re using a global employment platform, these are the types of details that make your job a whole lot easier. As your team grows, you need a scalable solution that will still keep your security in check—and Oyster’s Team Manager role does just that. Find out more.
About Oyster
Not sure where to start with securing data across a distributed workforce? Have questions about crafting a clear, compliant authorized use policy? We’re here to help. Oyster is a global employment platform designed to enable visionary HR leaders to find, hire, pay, manage, develop, and take care of a thriving distributed workforce. Oyster lets growing companies give valued international team members the experience they deserve, without the usual headaches and expense.
Oyster enables hiring anywhere in the world—with reliable, compliant payroll, and great local benefits and perks.
