Keeping Work Data Safe at Home: Security Basics for Remote Workers

When you work from home, you are the IT department. Remote projects often handle confidential information — unreleased AI models, client documents, personal data — and contracts expect you to protect it. The basics take an afternoon to set up.

Passwords and two-factor

Use a password manager and a different strong password for every work account. Turn on two-factor authentication with an authenticator app where possible. These two steps stop the most common account takeovers.

Your device

• Keep the operating system and browser updated; turn on automatic updates.
• Use a screen lock with a short timeout.
• Don't let others in the house use your work account or browser profile.
• Encrypt the disk if your system supports it (most do).

Networks

Your home Wi-Fi should use a strong password and current encryption (WPA2 or WPA3). Avoid confidential work on public Wi-Fi; if you must, use a phone hotspot instead. Some employers require a VPN for access to their systems — that's for security, and different from using a VPN to disguise your location, which breaks most platforms' rules.

Phishing

Scammers target remote workers with fake login pages and urgent messages that appear to come from the project or payment provider. Don't sign in through links in unexpected messages; go to the site yourself. Never share one-time codes with anyone. See how to spot remote job scams.

Confidential material

Don't screenshot, download or copy project material unless instructed. Don't paste it into outside AI tools. Close work tabs when screen-sharing in other calls. Most contract terminations for confidentiality breaches start with something that seemed harmless.

A one-afternoon security setup

1. Install a reputable password manager and move your work accounts into it.
2. Change any reused passwords to unique ones generated by the manager.
3. Turn on two-factor authentication for email, payment and project accounts.
4. Enable automatic updates and disk encryption on your computer.
5. Set a screen lock of five minutes or less.
6. Create a separate user account or browser profile for work.

Done once, these steps protect you for years with almost no ongoing effort.

Recognising phishing

Warning signs include urgency ('your account will be closed today'), a sender address that doesn't match the company's domain, links whose address doesn't match the text, and requests for codes or passwords. When in doubt, close the message and go to the site directly.