Secure Remote Working

Key Control Areas

When to Use

This pattern applies to every organisation with remote or hybrid workers -- which is now the majority. It is particularly critical for: financial services firms where regulators expect equivalent security controls regardless of work location, organisations processing sensitive personal data where GDPR breach risks increase with remote access, healthcare organisations accessing patient records remotely, legal and professional services firms handling confidential client materials, government organisations with classification requirements, any organisation that experienced security incidents during the 2020 rapid remote working deployment and needs to mature their architecture, and organisations migrating from VPN to ZTNA.

When NOT to Use

Organisations where all work is performed on-premises with no remote access requirements do not need this pattern -- but such organisations are increasingly rare. Very small organisations (under 10 staff) may implement remote security through simpler means: managed laptops with full disk encryption, cloud-based identity with MFA, and cloud-native applications that don't require VPN -- essentially achieving ZTNA-like outcomes without formal ZTNA infrastructure. Organisations with extremely sensitive environments (classified government, air-gapped OT) may prohibit remote access entirely rather than architect security controls around it.

Typical Challenges

The biggest challenge is user experience versus security: every additional security control (MFA prompts, VPN reconnection, compliance checks that block access) generates friction that users try to circumvent. Over-engineered security for remote access drives shadow IT -- users find unsanctioned ways to access what they need. BYOD programmes struggle with the boundary between corporate control and personal privacy: employees resist MDM on personal devices, particularly full device management. Split tunnelling decisions are politically charged: security teams want full tunnel for visibility, users want split tunnel for performance, and the right answer depends on the organisation's cloud adoption posture. Home network security is largely uncontrollable: corporate devices share networks with compromised IoT devices, family members' unpatched machines, and default-password routers. Endpoint compliance checking creates a chicken-and-egg problem: the device must connect to check compliance, but shouldn't connect if non-compliant. VPN to ZTNA migration is complex and lengthy: applications must be onboarded individually, and the transition period requires operating both architectures simultaneously. Printing and physical document security at home is difficult to enforce and easy to forget.

Threat Resistance

Secure Remote Working addresses the expanded attack surface of distributed workforces. Credential phishing targeting remote workers is mitigated by phishing-resistant MFA (FIDO2/passkeys) and conditional access that detects anomalous sign-in patterns (IA-02, CA-07). Device theft or loss is mitigated by full disk encryption, remote wipe capability, and session tokens that expire without device compliance verification (SC-28, CM-06, AC-19). Man-in-the-middle attacks on untrusted networks are mitigated by encrypted tunnels, certificate-based authentication, and HSTS enforcement (SC-08, SC-12, AC-17). Data exfiltration through personal devices or cloud storage is mitigated by DLP policies, container separation on BYOD, and monitoring of data movement patterns (AC-04, AC-19, SI-04). Lateral movement from compromised remote endpoints is limited by ZTNA architecture that never places remote devices on the corporate network, combined with micro-segmentation of application access (SC-07, AC-06). Home network attacks (ARP poisoning, DNS hijacking, IoT-based lateral movement) are mitigated by endpoint isolation controls, encrypted DNS, and endpoint protection that operates independently of network security (SI-03, SC-08). Insider threat from remote workers is addressed through session monitoring, DLP, and behavioural analytics that detect anomalous data access patterns regardless of user location (SI-04, AU-02, AC-04).

Assumptions

The organisation has an identity provider capable of conditional access policies (Azure AD/Entra ID, Okta, or equivalent). MDM capability exists or is being deployed for corporate devices. Internet connectivity is available at remote locations (not always guaranteed -- consider offline access requirements). HR policies support remote and hybrid working. Budget exists for remote access infrastructure (VPN/ZTNA, MDM, endpoint protection). Users have been trained on remote working security expectations.

Developing Areas

• SASE (Secure Access Service Edge) convergence is the dominant architectural trend for remote working security, combining ZTNA, CASB, SWG, and SD-WAN into a unified cloud-delivered service. However, most vendor offerings are still assemblages of acquired products rather than natively integrated platforms. Organisations deploying SASE report inconsistent policy enforcement between components, separate management consoles for different functions, and integration gaps that require manual workarounds. True single-pass architecture where all security functions inspect traffic once is the stated goal but not yet the reality for most vendors.
• VPN-less zero trust network access is the target architecture for most organisations, but the migration path from legacy VPN is proving longer and more complex than anticipated. Applications must be individually onboarded to ZTNA, legacy protocols (SMB file shares, thick client applications, RDP) often lack native ZTNA support, and the learning curve for identity-aware access policies is steep. Most organisations are operating VPN and ZTNA in parallel for 18-36 months during transition, doubling the operational burden and creating policy inconsistencies between the two access methods.
• Remote endpoint posture attestation before resource access is becoming a standard capability in conditional access platforms, but the depth and reliability of posture checks vary significantly. Surface-level checks (OS version, encryption enabled, AV present) are straightforward, but meaningful posture assessment -- verifying that EDR is actively protecting rather than just installed, confirming that OS security features like Secure Boot and HVCI are operational, and detecting jailbroken mobile devices that spoof compliance -- requires deep device integration that is inconsistent across platforms and MDM vendors.
• Home network security represents an uncontrolled threat surface that corporate security architectures must accept rather than solve. Consumer routers with default credentials, unpatched IoT devices, and family members' compromised machines share the same network as corporate endpoints. While endpoint isolation features (Windows Defender Firewall public profile, macOS stealth mode) provide some protection, the reality is that corporate devices on home networks are exposed to local network attacks that would be blocked by enterprise network security controls. Emerging approaches include DNS-layer protection (Cisco Umbrella, Cloudflare Gateway) that extends to the home environment, but comprehensive home network security guidance for employees remains an unsettled area of policy and technology.

Related Patterns

Patterns that operate within or alongside this one. Click any to view.