Best Practices for Telecommuting Securely

A knowledge base article about Best Practices for Telecommuting Securely provided by the UC Berkeley IT Service Hub - Knowledge Portal

Overview

Please note: Personally-owned computers used by multiple people in the household are unlikely to meet the Campus Minimum Security for Networked Devices (MSSND) Standard. Risks to consider with home systems include:

Multiple users with administrator access allow for the download and spread of malware.
Insecure configurations leave systems vulnerable to attacks.
Home-use software may be unsupported or unpatched for vulnerabilities.
Institutional information cached on the machine may be exposed to other family members.

Therefore, we highly recommend that remote workers use university-owned and managed equipment when working from home.

If you do not have a work computer and need to access highly sensitive (P4) data, please contact security@berkeley.edu.

Digital Security

1. Keep Work Data on Work Computers

Using a personally-owned device for university business puts both you and the campus at risk. If you do not have a work computer to use at home, you must follow the practices listed below.

2. Update and Patch

Update everything on your devices, including operating systems, web browsers, and apps. Enable automatic updates on Microsoft Windows and macOS to ensure vulnerabilities are patched promptly.

3. Use Anti-Malware Software and a Firewall

Install anti-malware software and enable a firewall on your devices. Default firewall settings are usually acceptable for current Macs and PCs, but verify that they are turned on.

4. Avoid Public Wi-Fi and Use the Campus VPN

Do not use public Wi-Fi when logging into campus systems. Use the Campus Virtual Private Network (VPN) or your phone as a personal hotspot instead.

Note for VPN use: When accessing enterprise systems with moderate to high data classification (BFS, Blu, CalCentral, etc.), connect to the Full Tunnel. For general tasks like email or Zoom, use the Split Tunnel to reduce system load.

5. Protect the Data on Your Device

Sensitive or notice-triggering data must not be stored on portable devices unless absolutely necessary and strongly encrypted.

Whole Disk Encryption (Protects the entire drive):
File Encryption (Encrypts specific files/folders):
- 7-Zip (using AES 256 encryption)
- Microsoft Windows EFS

6. Frequently Save and Backup Your Work

Approved backup locations vary by data classification. Certain data can be backed up using bConnected collaboration services. If using external drives, ensure they are encrypted and unplugged after the backup is complete.

Physical Security

1. Secure Your Workspace

Never leave your device unattended. Always lock your doors and never leave your device in a vehicle—not even in the trunk.

2. Lock Up Your Laptop

Lock up your laptop when you step away, even at home. Physical incidents can happen, and securing your equipment is a primary baseline defense.

3. Password-Protect Your Devices

Create strong passphrases (multiple words). Use a unique passphrase for every device. We recommend using a password manager to store these securely. UC Berkeley offers Free LastPass Premium to faculty, staff, and students.

4. Lock Your Screens

Configure your desktop to automatically lock after 15 minutes of inactivity. Set your mobile phone to lock after no more than 15 minutes (shorter is better).

5. Use a USB Data Blocker

When using public phone charging stations, use a USB data blocker to prevent unauthorized data exchange and protect your device from malware.