NIST: User's Guide to Securing External Devices for Telework and Remote Access

Many people telework (also known as telecommuting), which is the ability for an organization’s employees and contractors to conduct work from locations other than the organization’s facilities. Teleworkers use various devices, such as desktop and laptop computers, cell phones, and personal digital assistants (PDA), to read and send email, access Web sites, review and edit documents, and perform many other tasks. Most teleworkers use remote access, which is the ability of an organization’s users to access its nonpublic computing resources from locations other than the organization’s facilities. Organizations have many options for providing remote access, including virtual private networks, remote system control, and individual application access (e.g., Web-based email).

Telework devices can be divided into two categories: personal computers and consumer devices (e.g., cell phones, PDAs, video game systems). Each telework device is owned by the organization or an external entity, either a teleworker or a third party. This publication provides recommendations for securing external devices used for telework and remote access. Many organizations limit the types of external devices that can be used for remote access and which resources they can use, such as permitting teleworker-owned laptops to access a limited set of resources and permitting all other external devices to access Web-based email only. This allows organizations to limit the risk they incur from external devices. When a telework device uses remote access, it is essentially a logical extension of the organization’s own network. Therefore, if the telework device is not secured properly, it poses additional risk to not only the information that the teleworker accesses but also the organization’s other systems and networks. For example, a telework device infected with a worm could spread the worm through remote access to the organization’s internal computers. Therefore, telework devices should be secured properly and have their security maintained regularly.

http://csrc.nist.gov/publications/nistpubs/800-114/SP800-114.pdf