Tuesday, 8:15 a.m. A recruiter at a Montréal staffing agency opens her laptop at the kitchen table. Her son borrowed it last night for homework. The router her internet provider installed years ago still has its factory password. On screen: forty candidates' résumés.
Nothing dramatic, on the surface. But multiply those small gaps across twenty hybrid employees, and your corporate network now stretches into twenty kitchens, a few coffee shops and a cottage or two up north. As the Canadian Centre for Cyber Security puts it, remote work can weaken an organization's security efforts if you don't take precautions.
The good news: securing remote work doesn't mean watching your staff's every move. It mostly takes the right devices, locked-down access and a few simple rules. Here's where to start.
TL;DR
- The home office is part of your network: devices, access and behaviour all need written rules.
- A company-issued, centrally managed laptop is still the easiest option to secure.
- Multi-factor authentication on every remote access path is non-negotiable, and no Remote Desktop (RDP) should face the internet.
- Quebec's Law 25 applies at the kitchen table just as it does at the office: a lost laptop can become a confidentiality incident.
Your perimeter moved home
At the office, several protections work without anyone noticing: a managed firewall, a separate guest network, colleagues who notice when something looks off. At home, most of them vanish. The usual risks:
- The shared device used by kids or a partner, complete with games, browser extensions and sketchy downloads.
- The home router that's never been updated and may be end-of-life.
- Public Wi-Fi at the coffee shop, the airport or the rental cottage.
- Paper: printed client files, notes, documents tossed in the recycling.
- Eavesdroppers: a confidential call taken in an open-concept condo or on the train.
None of these risks is exotic. That's exactly why attackers lean on them.
Devices: company-issued, personal or browser-only?
The first structural decision is the device. There are three models, and most small businesses combine two.
| Model | Company control | Residual risk | Best for |
|---|---|---|---|
| Company-issued, managed laptop (MDM, e.g. Intune) | High: encryption, updates, antivirus enforced | Low | Staff who handle personal or financial information |
| Personal device with protected apps (MAM) | Medium: only company data is managed | Medium | Email and Teams on a personal phone |
| Browser or virtual desktop access | Medium: no data stored on the device | Medium to high if the device is infected | Contractors, occasional access |
The Cyber Centre recommends company-provided devices where possible. On any machine that holds company data, require at least:
- full-disk encryption (BitLocker or FileVault);
- a monitored endpoint detection and response (EDR) tool;
- automatic updates for the operating system and software;
- a standard user account without admin rights;
- automatic screen lock after a few minutes.
Remote access: MFA first, then VPN
The Cyber Centre's baseline controls are clear: all remote access to the corporate network goes through a VPN with two-factor authentication. In practice, multi-factor authentication also protects email, shared drives and every cloud app. If you're still weighing your options, our guide to choosing the right MFA compares them.
Three rules round it out:
- No Remote Desktop (RDP) exposed directly to the internet. It's one of the classic ransomware entry points.
- Conditional access. In Microsoft 365 or Google Workspace, you can require a managed device, block certain countries or demand extra verification for unusual sign-ins.
- Named accounts. No shared "remote" VPN account used by five people.
Example: an insurance brokerage in Sherbrooke gave staff access to its management software through a Remote Desktop port open to the internet, protected by a password alone. Moving to a VPN with MFA, then closing the port, took a single day of work.
Home networks and public places
You don't manage your employees' routers, but you can give them a short to-do list:
- change the router's admin password and the Wi-Fi password to a strong passphrase;
- turn on WPA2 or WPA3 encryption and install firmware updates;
- replace an end-of-life router that no longer gets updates, as the Cyber Centre recommends;
- put smart devices (TV, cameras, thermostat) on the guest network.
On the road, the rule is simple: no sensitive data over public Wi-Fi without a VPN. Tethering to a phone is often safer than the coffee shop network. And a privacy screen costs far less than a data leak.
People: phishing, fraud and reporting
Remote work is isolating. At the office, you turn around and ask, "Did you really send me this?" At home, the person is alone with the message. Fraudsters know it, and lean on fake tech support calls, booby-trapped Teams invitations and urgent wire requests in the CEO's name.
Two habits to build:
- Second-channel verification. Any request to pay, change banking details or reset a password gets confirmed by calling a known number, never the one in the message. Our article on business email compromise and CEO fraud walks through the procedure.
- Easy, blame-free reporting. A "Report" button in Outlook or Gmail and a named person to call. A click reported in five minutes is manageable; a click hidden for three days becomes an incident.
Law 25 at home
Quebec's private-sector privacy law doesn't stop at the office door. Your company remains responsible for the personal information it holds, wherever the employee happens to be working. Organizations in other provinces face similar expectations under their own privacy laws.
In practice:
- Paper containing personal information gets stored securely and shredded, not dropped in the blue bin.
- Screens shouldn't be visible to family members or roommates while staff work on files.
- A lost or stolen laptop can be a confidentiality incident. It must be logged in your incident register and, if it presents a risk of serious injury, reported promptly to the Commission d'accès à l'information and to the people concerned. An encrypted drive greatly reduces that risk.
To cover the rest of your obligations, see our Law 25 cybersecurity checklist, and run edge cases past your legal counsel.
Your remote work policy checklist
- A list of approved devices (company and personal) and permitted uses for each.
- Encryption, EDR and automatic updates on every company laptop.
- MFA on email, VPN and every cloud application.
- No exposed RDP; conditional access configured.
- Written guidance for home routers and public Wi-Fi.
- A second-channel verification procedure for payment requests.
- A report button and a contact person everyone knows.
- Rules for paper, printing and screen privacy.
- A lost-or-stolen device procedure tied to the incident register.
Not sure your Microsoft 365 or Google Workspace settings actually protect your remote staff? Our Microsoft 365 and Google Workspace audit checks authentication, conditional access and external sharing, then hands you a prioritized list of fixes.
Frequently asked questions
Can an employer monitor a remote employee's computer?+
To a degree, on company-owned devices. Monitoring must serve a legitimate purpose, stay proportionate and be clearly disclosed to employees, ideally in a written policy. In Quebec, Law 25 also imposes transparency obligations on the personal information you collect. Check your approach with legal counsel before rolling out any monitoring tool.
Do we still need a VPN if everything lives in Microsoft 365 or Google Workspace?+
Not always. If no server or software remains in the office, multi-factor authentication, conditional access and device management protect your data, not the VPN. A VPN becomes useful again as soon as staff need an on-premises file server, a locally hosted accounting system or an office printer.
Can an employee work remotely from another country?+
Technically yes, but plan for it. Sign-ins from abroad often trigger security alerts, and many companies block foreign countries by default. Set up an approval process, a temporary conditional access exception and a legal check, particularly around Law 25's rules on personal information leaving Quebec.