Letting remote staff work in client accounts from home

Your remote staff sign in to a client’s social, ad or store dashboard from a computer at home. Before they start, your agency decides four things: which accounts they may use from home, which computers, how they sign in, and which files may stay on the computer. Once they start, you keep checking two things: the state of each computer, and whether you can show later who signed in and when. How staff sign in and what permissions they get aren’t yours alone to set. You decide those with the client, because the client owns the account.

Which kind of remote access this is

NIST SP 800-46 Rev. 2, NIST’s guide to telework security for organizations, sorts remote access into four types: tunneling, portals, remote desktop access, and direct application access. In direct application access, the worker reaches an application straight from their device, and the application handles its own security, such as encryption and sign-in. NIST’s example is webmail opened in a browser. Remote staff opening a client’s ad dashboard in a browser work the same way.

Their traffic goes from home to the platform and never passes through your agency’s network. So unless staff sign in through a tool your agency runs, the platform’s history is the only record of who opened which client account.

NIST also suggests tiers. An organization may give its own computers access to many resources and personal computers access to fewer. It may also bar telework that involves certain information, such as sensitive personal data.

Four things to decide before staff start

Which accounts may be used from home

Start from your list of client accounts, one row per client and platform. For each account, note whether it holds personal information, such as store orders, customer lists for ad audiences or direct messages. Note too whether staff get in by invitation or with a shared login.

Then draw a line. Following NIST’s tiers, you might keep accounts that hold customer data off home computers, or allow viewing only. Also decide whether to tell each client that staff will work on its account from home.

Which computers

NIST recommends a telework security policy that says which kinds of devices may be used for each kind of remote access. So decide whether staff must use a company computer or may use their own.

A personal computer may also be used by family members. NIST SP 800-114 Rev. 1, NIST’s guide for teleworkers themselves, says each person who uses the computer should have a separate standard user account with a password. That keeps each person’s files and browser settings apart.

If the browser stays signed in, anyone who opens that browser under the same user account lands in the client’s account. With a separate, password-protected work account, family members use their own account and their own browser.

How staff sign in

If the platform lets the client invite your staff (delegated access), each person uses their own login. The client’s password never reaches the home computer.

With a shared login, staff type the client’s password on the home computer. On a personal computer, your agency can’t see or remove passwords the browser has saved. NIST SP 800-114 tells teleworkers to turn off browser auto-fill for usernames and passwords. Otherwise anyone else using the computer could sign in to sites as them.

CISA’s Telework Essentials Toolkit tells IT teams to require multi-factor authentication for remote access. On client platforms, it goes by names such as two-step verification: a second check beyond the password, such as a code on a phone. The client decides whether a shared login uses two-step verification, and sets the permission level of each invitation. Your agency can ask for invitations below admin level. You can also require staff to turn on two-step verification for their own logins.

Which files may stay on the computer

Ad reports and order lists can be downloaded from client dashboards. NIST SP 800-46’s options for such data include encrypting it on the device, or not storing it there at all and keeping it centrally. CISA’s toolkit tells teleworkers to avoid storing sensitive information on personal devices.

So decide which files staff may download, where they keep them and when they delete them. Include what gets deleted on the day a person rotates off a client. The account handover checklist covers the rest of that day.

Two things to check after staff start

The state of each computer

These checks come from NIST SP 800-114 and the CISA toolkit.

1. Antivirus software is installed and running. Malware on the computer can read what staff type into a client dashboard.
2. The operating system, browser and other software get updates promptly. An unpatched flaw stays open to attack.
3. Staff lock the screen when they step away. Anyone who walks up to an unlocked computer can act as that person.
4. The home Wi-Fi uses WPA2 or WPA3 encryption, and the router’s default password has been changed. This keeps others nearby from reading the traffic.

On a personal computer, these are things staff do, not settings you control. NIST notes that agreements requiring workers to secure their devices generally can’t be enforced automatically. So go through the checks on screen with each person on day one. Then repeat them on a set schedule.

Whether you can show who signed in, and when

After a wrong post or setting, what you can usually show the client is the platform’s history. With invitations, it names each person, as far as the platform keeps history. With a shared login, it names only the login, so you can’t tell which remote staff member acted.

So go back to the account list. Decide whether accounts with a shared login should be used from home at all. Agree with each client on who at your agency may view the platform’s history, so someone can pull the record on the day of a wrong post.

CISA also tells teleworkers to know how to report suspicious activity. Decide who remote staff contact when something looks wrong, and when your agency tells the client.