Chapter 21 — Mobile and remote working
Lesson map
Lesson 21 published. Map, example, EX061.
flowchart TD
N0["Learning outcomes"]
N1["21.1 Off-site laptops"]
N2["21.2 Remote access"]
N3["21.3 Personal devices"]
N4["21.4 Public networks"]
N5["Device loss and long trips"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX061"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["21.1 Off-site laptops"]
N2["21.2 Remote access"]
N3["21.3 Personal devices"]
N4["21.4 Public networks"]
N5["Device loss and long trips"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX061"]
[Learning outcomes]
|
v
[21.1 Off-site laptops]
|
v
[21.2 Remote access]
|
v
[21.3 Personal devices]
|
v
[21.4 Public networks]
|
v
[Device loss and long trips]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX061]
Learning outcomes
You will (1) protect laptops used off site; (2) secure remote access; (3) handle personal devices.
21.1 Off-site laptops
Teachers work at home and on trips. Laptops off site still get updates and policies through the cloud management service. The host firewall's public profile is on, and encryption protects them if lost.
The firewall's public profile is the one that matters off site, which is why the two laptops found with it switched off were among the first baseline fixes. Encryption and the screen lock protect the laptop if it is left on a train, and management keeps it updated over a home connection.
21.2 Remote access
Staff reach the file server through a VPN with multi-factor authentication. Tomás recommends replacing the outside company's shared VPN account with individual accounts, each with multi-factor authentication, so actions are traceable and access can be removed per person.
The shared supplier account is the exception the recommendation targets, since four engineers use one password and no individual can be held to account or removed. With individual accounts, the VPN log shows which engineer connected and when, and an engineer who leaves the supplier can be removed without changing anyone else's password.
21.3 Personal devices
Some staff read email on personal phones. The trust uses the email service's app protection policies, which keep school data in managed apps and allow it to be wiped without touching personal data.
Staff were not asked to enrol personal phones in full device management, which many would refuse and which would give the trust more control than it needs. App protection limits the trust's control to the email and document apps, which is proportionate and easier to explain to staff.
21.4 Public networks
Teachers on hotel or café wireless should use the VPN for school systems. Tomás writes a short guide with three steps.
The guide fits on one card: connect to the network, start the VPN before opening any school system, and lock the laptop whenever stepping away. Tomás tests it with two teachers before a residential trip and rewrites the second step after one asks how to tell whether the VPN is connected. Café and hotel networks are where the two laptops with the public firewall profile switched off would have been most exposed before the baseline fixed them.
Device loss and long trips
If a laptop is lost on a trip, the teacher phones the school office, which contacts Dev. Dev confirms encryption in the console, signs the user out of all sessions, resets the password and records the event for the data protection officer. Tomás adds these steps to the contact card from the incident chapter so they are the same wherever the loss happens. Long trips raise a second issue: laptops away for weeks still need updates. The cloud management service delivers them over the internet, and the weekly routine checks the last check-in date of travelling laptops so any that stop reporting are followed up.
Worked example
Within a month, the outside company's four engineers have individual VPN accounts with multi-factor authentication, and the shared account is disabled.
Synthetic case. The case is synthetic.
Errors and limits
Wiping a whole personal phone to remove school data damages trust; app-level protection avoids that.
Exercises
- EX061 — Shared account fix. What changes when supplier engineers get individual accounts? Rubric: 3 = traceability and per-person revocation;; 2 = accountability;; 1 = vague;; 0 = none.
- EX062 — Personal phones. How can school email on personal phones be protected without full device control? Rubric: 3 = app protection policies with selective wipe;; 2 = policies;; 1 = vague;; 0 = none.
- EX063 — Public wireless. Write the three-step guide for teachers on public wireless. Rubric: 3 = clear steps;; 2 = partial;; 1 = vague;; 0 = none.
Synthesis
Remote work is safe when devices stay managed and access is individual and verified.
Continue studying — chapter 21 of 30
← Chapter 20 (draft) · Course chapter index · Chapter 22 (draft) →