How to Protect Work Accounts and Devices at Home

All Remote Work Desk Editorial Desk

At home, a work laptop may share a network with game consoles, smart speakers and family tablets. Your employer still manages its systems, while you may be responsible for the router and the physical workspace. You do not need to become a security engineer. A handful of habits, drawn from guidance by the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Trade Commission and the National Institute of Standards and Technology (NIST), provides a practical starting point for reducing common risks.

Start with your employer's rules

Before changing anything, read your organization's telework and device policies, and follow them where they differ from general advice. CISA's archived telework guidance reminds remote workers to review employer policies on personal equipment. NIST's user guide to telework and bring-your-own-device security distinguishes between devices the organization controls, devices from third parties and personally owned devices, because each carries different risks and rules. If your employer issues a laptop, it may already enforce updates and remote access settings; your job is mostly not to work around them.

Protect the accounts first

A stolen password can give an attacker access to work data. CISA recommends multifactor authentication, which adds another check beyond a password. It reduces risk, but some methods can still be phished or defeated through an attacker tricking you into approving a prompt. CISA also points to phishing-resistant methods based on the FIDO standard as a stronger option. Use unique, strong passwords in the password manager your employer approves.

Keep work and personal accounts separate. Forwarding work documents to a personal email address to print or finish them elsewhere moves company data somewhere your employer cannot protect it, and may breach policy.

Update promptly, ideally automatically

CISA's guidance on software updates is straightforward: watch for update notifications, install them as soon as practical, especially critical ones, and turn on automatic updates so devices install fixes without waiting for you. That applies to the operating system, the browser and everyday apps. Install updates through the device's own settings rather than from pop-ups on websites.

Secure the home network

The FTC's advice on home Wi-Fi covers the essentials. Use WPA3 Personal or WPA2 Personal encryption. Change both the Wi-Fi password and the router's administrator password from their defaults. Keep the router's firmware current. Turn off convenience features that make the network less secure, including remote management, Wi-Fi Protected Setup (WPS) and Universal Plug and Play (UPnP). Make sure the router's firewall is on. A separate guest network can reduce exposure from visitors' devices. Check the router's isolation settings: a separate network name alone does not prove devices cannot reach your work network. Ask IT before changing settings that affect a managed connection. If these settings are unfamiliar, your internet provider or router manufacturer usually has instructions.

Watch for messages designed to fool you

Remote workers rely heavily on email and chat, which makes them attractive targets. CISA warns about phishing messages that impersonate trusted organizations to extract personal details or credentials. A message that urges you to log in, approve a payment or install something quickly deserves a pause. Verify unusual requests through a separate channel you already know, such as calling a colleague on a number from the company directory.

Mind the physical space

Lock your screen whenever you step away, even at home. Keep work devices for work rather than lending them for homework or games. Position your screen so visitors cannot read sensitive material, and check what your camera shows before video calls. CISA's archived telework FAQ says participants should know before recording begins and that applicable law and the security of recordings need consideration. Follow your employer's consent and recording rules. On public Wi-Fi, confirm the network name with staff and follow your employer's connection rules, including any required VPN. A familiar network name alone does not establish that a connection is trustworthy.

A hypothetical example

Suppose a remote accountant gets a message that appears to come from their company's IT department, asking them to approve a sign-in prompt on their phone so a system migration can finish. They did not try to log in, so they decline the prompt, do not reply, and contact IT through the help desk number on the intranet. IT confirms the request was not genuine and investigates; its response may include resetting credentials and revoking active sessions. The decisive moment was simple: refusing a prompt they had not started.

Know your stop point

If you think a work account or device has been compromised, report it to your employer's IT or security team right away rather than trying to clean it up yourself, and follow their instructions about whether to disconnect the device. Use your organization's incident reporting process so the right team can preserve evidence and coordinate any external reporting.

The tradeoff throughout is convenience. Stronger sign-in methods, automatic updates and separate devices add friction, but they reduce exposure without making any device or account invulnerable.

Sources

CISA, Telework Guidance and Resources (archived): https://www.cisa.gov/telework CISA, Turn On MFA: https://www.cisa.gov/secure-our-world/turn-mfa CISA, Update Software: https://www.cisa.gov/secure-our-world/update-software Federal Trade Commission, How To Secure Your Home Wi-Fi Network: https://consumer.ftc.gov/articles/how-secure-your-home-wi-fi-network NIST, SP 800-114 Rev. 1, User's Guide to Telework and Bring Your Own Device (BYOD) Security: https://csrc.nist.gov/pubs/sp/800/114/r1/final