ThemeTools, space & tech
CardCard 62 of 65
Questions5 to explore

Security

Password, backups & viruses

Security in a distributed team is harder to manage than in an office, and the consequences of getting it wrong travel fast.

In an office, a lot of security is physical: a locked door, a controlled network, someone who notices an unfamiliar face. In a hybrid team, those controls do not exist. People log in from home networks, cafés, and airports. They store files on personal devices. They receive phishing emails on the same laptop they use for work.

Password hygiene, two-factor authentication, backups, and clear rules about what goes where are the basics. They are not glamorous, but ignoring them creates real exposure. A single weak password or an accidentally shared document can cause problems that far outweigh the effort of getting security right.

The team's approach to security needs to be both clear and realistic. If the rules are too onerous, people route around them. If the rules are well-matched to the actual risks, people tend to follow them.

Make it explicitWrite down the team's minimum security requirements: password management, two-factor authentication, backup practice, and what to do if something goes wrong.

How strong hybrid teams handle it

The same building block, handled well. These are patterns from teams that work well across locations, offered as illustrations to react to, not rules to copy.

Password manager for everyone

Strong hybrid teams standardise on a password manager rather than leaving it to individual preference. It removes the trade-off between strong passwords and remembering them, and makes offboarding cleaner.

Two-factor on everything critical

Two-factor authentication on email, cloud storage, and key tools is the single most effective security step most teams can take. Setting it up once across the team takes an afternoon and prevents a category of incidents.

Backup check as a routine

Teams that schedule a periodic backup check (quarterly is enough) do not discover that backups have silently failed only when they need them. The check is five minutes; the recovery is much longer.

Clear offboarding security steps

When someone leaves, access to shared tools and files should be revoked promptly. Teams that have a written offboarding checklist that includes security steps do not leave former members with live access by accident.

Questions for your team

Use these on your own or in a group. There are no right answers, only better conversations.

Does everyone on the team use a password manager and two-factor authentication for the core tools?
Where are the team's critical files backed up, how often, and when did we last verify the backup actually works?
What is the process when a team member leaves, to remove their access to shared systems?
How do we handle security on personal devices that are also used for work?
What would we do if a team member's account was compromised, and do we know who to contact first?

Watch for

Security rules that are too complicated or too restrictive do not get followed. People find workarounds that feel convenient and create exactly the exposure the rules were meant to prevent.
Shared passwords (one login for the whole team) are common in small teams and create a serious offboarding problem: when someone leaves, the password needs to change and nobody ever changes it.
Backups are set up and then forgotten. The backup process failing silently is far more common than people realise, and the failure is usually discovered only in a crisis.