Chapter 12 — Remote access and working from home
Lesson map
Lesson 12 published. Map, example, EX045.
flowchart TD
N0["Learning outcomes"]
N1["12.1 VPN"]
N2["12.2 Remote desktop"]
N3["12.3 Home networks"]
N4["12.4 Remote support"]
N5["Supporting remote users safely"]
N6["Lost laptops, VPN timeouts and home printing"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX045"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["12.1 VPN"]
N2["12.2 Remote desktop"]
N3["12.3 Home networks"]
N4["12.4 Remote support"]
N5["Supporting remote users safely"]
N6["Lost laptops, VPN timeouts and home printing"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX045"]
[Learning outcomes]
|
v
[12.1 VPN]
|
v
[12.2 Remote desktop]
|
v
[12.3 Home networks]
|
v
[12.4 Remote support]
|
v
[Supporting remote users safely]
|
v
[Lost laptops, VPN timeouts and home printing]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX045]
Learning outcomes
You will (1) provide secure remote access; (2) protect home working; (3) support remote users.
12.1 VPN
Partners reach the file server through the supplier's VPN with MFA. Each user has their own account. MFA on the VPN means a stolen password alone cannot reach the file server. Individual accounts mean each connection can be traced to a person, and a leaver's account can be disabled without affecting anyone else. A partner's slow VPN was traced to an old client version, which Nadia updated. VPN accounts are disabled the same day someone leaves, as part of the leaver steps.
12.2 Remote desktop
Remote desktop to office PCs is only available through the VPN, never directly from the internet. Remote desktop exposed directly to the internet is a common target for attackers guessing passwords. Requiring the VPN means only users who have passed MFA can reach it. Nadia confirms with the supplier that no direct access is open on the router. The one exception for a partner working from home uses this route and is recorded with a review date. Because remote desktop off is one of the ten baseline settings, the management tool reports any PC where it has been turned on outside the recorded exception.
12.3 Home networks
Staff are asked to keep their home router updated and not to share work laptops with family. Home networks are outside the firm's control, but a work laptop used by family members could pick up unwanted software. The firm cannot check staff routers, so it relies on advice and on the laptop's own protection, including the firewall, Defender and encryption. Nadia gives staff a short guide on updating their home router and keeping work devices for work. Lena sends the home-network guide to staff with a note that the firm will help anyone who is unsure how to update their router.
12.4 Remote support
When Nadia helps a remote user, she uses the supplier's remote support tool, which asks the user to accept each session. Asking the user to accept each session means nobody can connect to their laptop without their knowledge. Nadia explains what she is doing during the session and ends it when finished. The tool records each session, so the supplier can see who connected and when. She never asks a user to install a different remote tool, which is a common trick in support scams.
Supporting remote users safely
Remote users can be impersonated as easily as office users. Before starting a remote session, Nadia confirms the caller by phoning back on their known number. During the session, she explains what she is doing and ends it as soon as the task is complete.
She never asks users for their passwords; if she needs to sign in as an administrator, she uses her own admin account.
Each remote session is recorded in the ticket with its start and end time, so there is a trail of who accessed which PC and why.
Lost laptops, VPN timeouts and home printing
If a laptop is lost at a client site, the user phones the office. Nadia checks encryption status, signs the user out of all sessions, resets the password and records the event for Lena, who decides whether clients need to be told. The VPN also disconnects after a period of inactivity, so an unattended laptop does not stay connected to the office network. Finally, staff printing client documents at home are asked to collect printouts immediately and shred them when finished. Paper leaks are as real as digital ones, and a remote working guide that ignores printing leaves a gap.
Worked example
A partner reports slow VPN; Nadia finds their laptop is on an old VPN client version and updates it.
Synthetic case. Events are synthetic.
Errors and limits
Remote support tools that connect without user approval can be misused.
Exercises
- EX045 — RDP exposure. Why never expose remote desktop directly to the internet? Rubric: 3 = attacked constantly;; 2 = risky;; 1 = vague;; 0 = none.
- EX046 — Session consent. Why should users accept each remote support session? Rubric: 3 = prevents unseen access;; 2 = consent;; 1 = vague;; 0 = none.
- EX047 — Family use. Why not share work laptops with family? Rubric: 3 = data exposure and unwanted software;; 2 = risk;; 1 = vague;; 0 = none.
- EX048 — Old VPN client. Why update the VPN client? Rubric: 3 = fixes and performance;; 2 = update;; 1 = vague;; 0 = none.
Synthesis
Individual VPN accounts with MFA and approved support sessions keep remote work safe.
Continue studying — chapter 12 of 18
← Chapter 11 (draft) · Course chapter index · Chapter 13 (draft) →