The five layers to lock down
Every remote team we secure gets structured the same way. Each layer builds on the one before it.
1. Identity
Identity is the highest-leverage control in remote work security. If you only have time for one thing this quarter, do this.
- Multi-factor authentication on every account, not just admins: Use Microsoft Authenticator with number-matching, or a hardware key like a YubiKey for senior staff. Skip SMS. SIM swap attacks make it the weakest option.
- Conditional access policies: Block sign-ins from anonymous IPs, from countries you don’t do business in, and from devices that aren’t compliant with your standard. Report-only mode first, then live.
- Privileged Identity Management: No one should be a global admin all day. Elevate to admin only when needed, log the reason, and step back down.
2. Devices
A locked-down cloud reached from an unpatched laptop is only as secure as the laptop.
- Enrol every device in Microsoft Intune (or your MDM equivalent). Corporate devices via Autopilot, BYOD through App Protection Policies so you can wipe just the corporate data when someone leaves.
- Enforce full disk encryption: BitLocker for Windows, FileVault for Mac. A stolen laptop then becomes a hardware loss, not a data breach.
- Patch on a defined schedule: Set a maximum age for pending security updates. Devices out of compliance lose cloud access until they catch up.
3. Data
Identity keeps attackers out. Data protection contains the damage when someone gets in, or when a well-meaning employee shares the wrong file.
- Change the default sharing setting in SharePoint and OneDrive from “Anyone with the link” to “Specific people.” This one change stops the majority of accidental external leaks.
- Apply sensitivity labels: Public, Internal, Confidential, Highly Confidential. Keep it to four. Sensitivity labels enforce encryption and restrictions even when files leave the tenant.
- Turn on Data Loss Prevention policies: Microsoft Purview ships with pre-built DLP templates for Australian regulated data (Medicare numbers, tax file numbers, ABNs). Route alerts to a mailbox someone actually reads.
4. Network access
Traditional VPN was built for a world where remote work was the exception. In a remote-first business, it’s slow, hard to maintain, and often less secure than what it’s replacing.
- Move to Zero Trust access where every connection is authenticated, authorised, and encrypted regardless of where it’s coming from. Microsoft Entra ID, Cloudflare Zero Trust, and Cisco Duo all offer solid Zero Trust setups.
- Segment access by role and application, not by network location. Marketing shouldn’t be able to reach the finance folder just because they’re on the same VPN.
- Enforce DNS filtering on every device (not just those on the office network). Blocks malicious domains before the browser ever loads them.
5. People
Technical controls carry most of the load, but the human layer is where the interesting attacks land.
- Run quarterly phishing simulations with follow-up training for anyone who clicks. Change the scenario each time. Real attacks vary.
- Publish a short, plain-English security handbook for staff. What to do if a suspicious email arrives, what to do if a laptop is lost, who to call after hours. Two pages beats a 40-page policy nobody reads.
- Make it easy to report something suspicious. A dedicated “report phishing” button in Outlook. A Teams channel for security questions. Reduce the friction on doing the right thing.