Secure Remote Work for Small Businesses: VPN, Passwords and Two-Factor Authentication

In mid-March 2020, as COVID-19 spread, many agencies and businesses, including small ones, had staff work from home. A rapid shift to remote work easily exposes information security gaps: personal computers, home Wi-Fi, weak passwords. Here are basic measures you can apply right away.

Why remote work is risky

The US cybersecurity agency CISA, in alert AA20-073A of 13/3/2020 on enterprise VPN security, listed some risks when many employees work remotely at the same time:

• Attackers may step up phishing aimed at remote workers to steal login credentials.
• VPNs and endpoint devices that aren't patched are easy to exploit.
• Organizations that don't use multi-factor authentication for remote access are more vulnerable to attack.
• The number of VPN connections is limited; if overloaded, employees may be unable to work.

1. VPN: use it properly

A VPN creates an encrypted tunnel between the employee's computer and the company network. Some notes:

• Only use a VPN provided by the company or trusted software, and avoid free VPN apps of unknown origin.
• Update the VPN server, network equipment and client software regularly.
• Check the maximum number of simultaneous connections and the load capacity before the whole team connects at once.
• Grant only the access needed for the job, and don't open the entire internal network.

If the business is too small to run a VPN, consider cloud-based work services that already have strong authentication, rather than opening remote access directly to office computers.

2. Strong passwords and password management

• One separate, long, hard-to-guess password per service; long phrases are often easier to remember than short random strings.
• Use a password manager to store and generate passwords, instead of writing them on paper or in text files.
• Don't share passwords through group messages; use the password manager's sharing feature.
• Change a password immediately if you suspect it has been exposed.

3. Two-factor (two-step) authentication

Two-factor authentication adds a factor beyond the password, for example a code from a phone app or a security key. When a password is exposed, attackers still find it hard to get into the account. Enable it for:

• Company email and admin accounts (Google, Microsoft, hosting, domain names).
• Accounting software, customer management and cloud storage.
• The business's social media and advertising accounts.

If possible, prefer codes from an authenticator app over codes sent by SMS.

4. Devices and home network

• Update the operating system, browser and antivirus software.
• Turn on disk encryption and automatic screen lock.
• Change the default password on the Wi-Fi modem and use WPA2 encryption or higher.
• Separate work data from personal data if possible, and don't let others in the household share the work computer.
• Back up important data regularly to a safe place.

5. Be alert to scams

During the pandemic, COVID-19 information was exploited for scams. Teach staff to:

• Not click unfamiliar links or attachments, even if the email seems to come from a health agency or management.
• Confirm through another channel (a phone call) when receiving a request to transfer money or provide a password.
• Report immediately to the person in charge of IT when in doubt.

Get authoritative pandemic information from sources such as the Ministry of Health or WHO.

6. Simple internal rules

Write a one-page policy: which devices may be used, where data is stored, who grants access, and who to report incidents to. NIST SP 800-46 Rev. 2 is a reference on remote work security if you need more detailed guidance.

2026 update: Remote work and hybrid work have become common. Multi-factor authentication and passkeys are supported by many services. Check the current guidance from the providers you use.

FAQ

Are small businesses required to use a VPN?

Not required. What matters is that remote access is protected with strong authentication and kept fully updated. A VPN is one of the options.

Does two-factor authentication bother staff?

It only adds a few seconds per login, in exchange for a significant reduction in risk when a password is exposed.

What if we need help setting it up?

You can contact HVSC's Technology team to discuss your specific needs.

Reference sources

• CISA — Alert AA20-073A: Enterprise VPN Security: https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-073a
• NIST — SP 800-46 Rev. 2: https://csrc.nist.gov/pubs/sp/800/46/r2/final
• Google — Turn on 2-Step Verification: https://support.google.com/accounts/answer/185839
• WHO: https://www.who.int