Distributed teams changed what security controls are available. Network-based protections apply to a shrinking share of activity, and device management is harder when hardware is personal or scattered. What remains effective is identity, a small device baseline, and processes that survive someone working from an airport.

Identity carries the weight

Every access decision should depend on verified identity rather than network location. Single sign-on through one identity provider with phishing-resistant MFA, conditional access rules where available, and prompt deprovisioning when someone leaves. Being on a VPN proves nothing about who is at the keyboard.

A minimal device baseline

  • Full-disk encryption enabled — the single most valuable control for lost or stolen hardware.
  • Automatic operating system and browser updates, not deferred indefinitely.
  • Screen lock with a short timeout.
  • A password manager, so credentials are not stored in browsers or documents.
  • Remote wipe capability for devices holding company data.

Be honest about what a VPN does

A VPN protects traffic in transit and provides access to internal resources. It does not verify identity, does not protect a compromised device, and does not make a phishing page safe. Where it exists to reach internal systems, keep it — but do not treat connection to it as a security state.

Personal devices

If personal devices access company data, decide explicitly what is permitted and what is required. Application-level controls that separate work data — containerised mail, browser profiles, managed applications — are frequently a better fit than full device management, which people resist on hardware they own.

Make the secure path the convenient one

People route around controls that slow them down, and those workarounds are invisible until an incident. If file sharing is awkward, files end up in personal accounts. If access requests take days, credentials get shared. Fixing the friction is a security intervention, and frequently a more effective one than adding another control.

Practise the leaver process

Distributed teams make offboarding easy to do incompletely. Write the checklist, assign it, and verify it: identity provider disabled, sessions revoked, devices wiped or returned, shared credentials rotated, and third-party accounts transferred. Then check a month later that it actually happened.