Working from anywhere means something at the office is reachable from outside it. Done carefully that is routine. Done casually it is one of the most common ways attackers get in — exposed remote desktop is a standard route to a ransomware incident.
The thing not to do
Do not put Remote Desktop directly on the internet. It is scanned for constantly and automatically. If your setup involves forwarding port 3389 on the router, that is the arrangement to change first, before anything else in this guide.
Reasonable options
- Move the thing itself, not the access. If files are the reason, a proper cloud file service removes the need for remote access entirely, and the security becomes someone else's full-time job rather than your occasional one.
- A VPN. Creates a private tunnel into the office network. Well understood, and most business routers include one.
- A managed remote-access tool (TeamViewer, Splashtop and similar). Easiest when someone must control a specific machine — a program that only runs on that computer, say. Pay for the business version and turn on every access control it offers.
- Remote Desktop behind a VPN. Fine. Behind, not instead of.
Non-negotiable, whichever you choose
- Two-factor authentication on remote access. A password alone is not enough for a door into your business.
- Individual accounts. A shared login means no idea who did what, and no way to remove one person's access.
- Remove access when people leave, on the day. This is forgotten constantly.
- Keep it updated. Anything reachable from the internet is the first thing to patch, not the last.
- Lock out repeated failures so an automated guessing attack gets nowhere.
On personal computers
Someone connecting from a home machine brings that machine's problems with them. If it must happen, at minimum require an up-to-date system and turn on any check your remote tool offers. Where the data is sensitive, providing a company laptop is cheaper than the alternative.
If any of this is beyond where you want to go on your own, a Koadi technician can take it from here — remotely anywhere in the US, or on-site in New Jersey, New York and Pennsylvania. Describe the problem in your own words and someone who does this every day will pick it up.