Erasing WFH security blind spots without killing startup growth

Izabella Stueflotten is a GRC Professional and VP of Digital…

Leaving the office, you grab your phone to respond to the remaining emails on your way home. It might seem innocent, but there are several hidden commercial risks with bringing your work home with you. The obvious mistake is that you’ve probably forgotten to activate your VPN (Virtual Private Network). You use a VPN so that your data traffic is encrypted (i.e. it cannot be intercepted along the way by someone else sitting on the train or bus). The less obvious, and more damaging risk happens when you get home. You switch on your shared home computer to continue working, and log in using your work credentials, unknowingly putting your organisations data at risk.

The way this happens is through malware that is installed on your personal device, that is not managed by your organisation. While businesses take steps to ensure all their corporate-issued devices are up to date, patched and running the latest anti-virus software to name a few things, you don’t necessarily keep up with these stringent demands on a home computer. Your business on the other hand, might even be managing the actual traffic being allowed to reach your computer at the office. Long story short, an enterprise has a completely different set of security criteria to live up to.

The Teenager, TikTok, and the invisible threat

At home, by contrast, your teenager might have clicked on a link from TikTok, Instagram or similar, that secretly downloaded malware to your computer. To your teenager, it looked like nothing happened, so no alarm was raised. However, in that eerie silence, the malware is stealing entire authenticated web sessions and using these to log in to your corporate device remotely. Because it is stealing the active session, it completely bypasses any MFA (Multi-Factor Authentication) too.

This is exactly why we advocate disabling and actively blocking corporate network access from unmanaged, private devices (or unmanaged endpoints in tech-speak).

Some clever organisations take it a step further and create designated remote work portals where only limited information is shared or accessed. You won’t have access to more data than what you need to do what you’re supposed to do. This way, the business can minimise their attack surface, whilst ensuring employees see (only) the data they explicitly need to complete their tasks.

Understanding your attack surface

Your attack surface consists of all the places where a threat actor/hacker might be able to breach your data and organisation. Imagine being able to put on an invisibility cloak so that a threat actor can’t see (part of) you and thereby isn’t able to attack. That’s what minimising your attack surface is about.

Startups thrive on being agile, but using dozens of unlinked software platforms creates a massive, chaotic attack surface (which, if you recall, is what we’re trying to reduce). When team members freely sign up for various unmonitored SaaS tools (these tools are then called Shadow IT – because they are there, in the shadows and uncontracted), keeping track of sensitive company data becomes an impossible chore.

We are big fans of remote work and to solve the above problem, we operate with a central Identity Provider (think Okta or Microsoft Entra ID) and link this to productivity platforms like M365 or Google Workspace. Now you have a central identity provider that links directly to anything you connect to.

SSO (Single Sign-On) is on as standard for the SaaS, which also streamlines control and thereby makes onboarding and offboarding employees and others a breeze. Think of it this way: your HR team keeps track of the employees through the IdP (Identity Provider) that is directly linked to the productivity platform. The moment an employee leaves the company, HR revokes their central identity, and access to every single linked platform is automatically terminated. Trying to manage hundreds of employees scattered over several teams and locations without IdP is just about as easy as herding cats.

Ditching the sticky notes: the power of single sign-on (SSO)

If you force your team to remember several different, highly complex passwords for all kinds of different software platforms, they are going to do one of two things. They’ll either scribble them down on a sticky note (best-case scenario this is hidden under their keyboard – worst case it is stuck to their monitor), or they will reuse the name of their childhood pet, a numerical year, and a predictable exclamation point at the end. What it is, is a data breach waiting to happen.

By using Single Sign-On (SSO) you strip away all the complexity. Instead of forcing your employees to perform mental gymnastics every morning just to access a file or check an alert, SSO gives them one secure, automated master key. An employee logs in exactly once at the start of their day, using the IdP I spoke about earlier. That is, it.

Suddenly, logging in becomes completely seamless. They go from platform to platform without tens of annoying login prompts with various passwords. When you make security invisible and painless for your team, you also eliminate the temptation for them to bypass corporate infrastructure or sneak into dangerous shadow IT solutions out of sheer desperation.

For the business, reducing this friction is a major commercial competitive advantage. Whilst your employees enjoy a smooth workday, your IT and HR teams can manage user access from a single pane of glass. Onboarding new talent becomes effortless and offboarding a departing employee transforms from a chaotic game of herding cats into an instantaneous, automated process. SSO proves that you do not have to compromise on robust governance to maintain a fast, agile, and resilient organisation.

Building a human firewall on a budget

Some basic digital hygiene like this doesn’t require a multi-million budget. All it requires is that you turn your remote employees into a robust human firewall. Start by looking at the basic router in the employee’s home. Most employees are not aware that their router comes with a generic, default admin password and that this makes them easy targets for hackers. As a responsible organisation, you should provide clear, jargon-free step-by-step instructions and checklists for employees when onboarded (and enforce a company rule for already-existing employees). These lists should show employees how to update their router password and firmware.

Combined with zero-trust network protocols you protect the business from vulnerabilities from the local home network. Zero-trust protocols are like an overzealous bodyguard with amnesia. They need continuous validation of your ID, across every device, user, and machine-to-machine data flow, not just letting you in because they’ve seen you before.

Lastly – enforce a company VPN. Don’t expect your employees to pay for it themselves, either. Manually switching on a VPN when they grab their laptops to finish off a report on the train or bus is a fantasy. They’ll forget, they’re in a rush, or they simply can’t be bothered because “it won’t happen to me” or “I have nothing to hide”.

This is precisely why enforcing corporate VPNs is a total gamechanger for businesses. By taking the decision entirely out of human hands and automating the connection, you make sure that every single bit of data traffic leaving a device is fully encrypted by default.

True or not? Would you feel safer sharing data with a company with robust security or one that was a bit more friendly and casual about what they let through? If I was sharing sensitive data, I know what I would want. And that’s how security frameworks act as a genuine commercial competitive advantage. By proving to your clients that your organisation is fully resilient, safe, and ready to scale.

So, what are you waiting for? Go create that checklist, enforce VPNs and use zero-trust protocols.

Here is a simple home router security checklist every employee can follow:

Change the default admin password immediately

Log into your router (usually by typing 192.168.1.1 or 192.168.0.1 in your browser). Use the default username/password printed on the router sticker if you’ve never changed it. Create a strong, unique password (at least 12 characters, mix of letters, numbers, and symbols). Never use the same password as your Wi-Fi.

Update your router’s firmware

In the router admin settings, look for ‘Firmware Update,’ ‘Software Update,’ or ‘Router Update.’ Check for and install the latest version from the manufacturer (common brands: TP-Link, Netgear, Asus, Linksys). Do this at least every 3 months – it patches known security holes hackers exploit.

Change your Wi-Fi network name (SSID) and password

Give your Wi-Fi a unique name that doesn’t reveal your identity (avoid ‘SmithFamilyWiFi’). Create a strong Wi-Fi password (different from the admin password). Use WPA3 encryption if your router supports it (or at least WPA2). Disable WPS if the option exists.

Disable remote management/admin access from the internet

In the router settings, turn off ‘Remote Management’, ‘Remote Admin,’ or ‘WAN Access to Router.’ This prevents hackers from trying to log in to your router from outside your home.

Enable automatic updates where possible and restart regularly

Turn on any automatic firmware update feature. Restart your router once a week (or at least monthly) to clear temporary vulnerabilities and apply updates properly.

Bonus: Guest network for visitors/kids

Set up a separate ‘Guest’ Wi-Fi network for visitors, smart TVs, or kids’ devices. This keeps your main work devices isolated if something gets compromised on the guest network.

For more startup news, check out the other articles on the website, and subscribe to the magazine for free. Listen to The Cereal Entrepreneur podcast for more interviews with entrepreneurs and big-hitters in the startup ecosystem.