Remote work infrastructure for organisations

Why Remote Work Infrastructure Is No Longer a Choice?

When your team works from home, a coffee shop, or another city, you can no longer rely on the physical walls of the office for security. Remote work infrastructure is not just about "giving employees internet and a laptop"; it's a set of policies, tools, and technical configurations that ensure your employees can access organizational resources from anywhere without putting data at risk.

In this article, we provide a practical roadmap for implementing remote work infrastructure: from designing secure access to device management and choosing collaboration tools. Our focus is on technical details and common mistakes organizations face during implementation.

1. Secure Access: The Backbone of Remote Work Infrastructure

The first and most important part is how employees connect to the organization's network. There are three main approaches, each suitable for a specific scenario.

Traditional VPN (Site-to-Site and Remote Access)

If your organization still uses physical infrastructure or a dedicated data center, a VPN based on IPsec or WireGuard is the standard choice. For example, with WireGuard, you can set up a VPN server on a small instance in less than 10 minutes:

# Install WireGuard on Ubuntu 22.04
sudo apt update && sudo apt install wireguard

# Generate private and public keys
wg genkey | tee privatekey | wg pubkey > publickey

# Configure /etc/wireguard/wg0.conf
[Interface]
Address = 10.0.0.1/24
SaveConfig = true
ListenPort = 51820
PrivateKey = <your private key>

# Enable and start
sudo systemctl enable wg-quick@wg0
sudo systemctl start wg-quick@wg0

Important note: Never use the PPTP protocol. This old protocol is easily broken and is still seen in some Iranian organizations. If your employees connect from public networks (like coffee shops), be sure to use IPsec with AES-256 encryption or WireGuard.

Zero Trust Network Access (ZTNA)

For organizations using cloud tools, the ZTNA model is a more modern alternative. In this model, instead of full network access, each user only gets access to the specific application they are authorized for. Tools like Cloudflare Access or Tailscale make this easy. Main advantage: if a laptop is compromised, the attacker only has access to that specific application, not the entire network.

Common Mistake: Forgetting Two-Factor Authentication

The biggest mistake in remote work infrastructure is relying on simple passwords. If your VPN only works with username/password, you've essentially left the back door open for attackers. Be sure to enable MFA (Multi-Factor Authentication). For WireGuard, you can use tools like wireguard-mfa or combine it with FreeRADIUS. For cloud services, enabling MFA at the organization level (not just per user) is mandatory.

2. Collaboration Tools: Choosing the Right One Based on Real Needs

After security, it's time for team collaboration. The temptation to use "all available tools" is high, but you should choose based on needs.

Messaging and Video Conferencing

For daily communication, tools like Rocket.Chat (open-source and installable on your own server) or Mattermost are good options. If your team works with Microsoft 365, Teams is the natural choice. For video conferencing, Jitsi Meet is an open-source solution you can install on your own server and have full control over data.

Technical note: If your team has more than 20 people, be sure to check your server's upload bandwidth. An HD video call consumes about 2-3 Mbps upload. For 20 simultaneous users, you need at least 50 Mbps dedicated upload.

Project Management and Documentation

For task management, tools like OpenProject or Redmine (open-source) or Jira (commercial) are suitable. For shared documentation, installing an instance of Nextcloud with the OnlyOffice plugin allows real-time document editing without data leaving your server.

Common Mistake: Ignoring Logs and Monitoring

Many organizations install collaboration tools but don't log any activities. If a disgruntled employee deletes data or a user account is compromised, without logs you can't figure out what happened. At minimum, enable the following:

• Login/logout logs with IP and timestamp
• Logs of changes to sensitive files
• Alerts for failed login attempts (more than 5 times)

3. Device Management: BYOD or Company-Issued Devices?

One of the most challenging parts of remote work infrastructure is managing the devices employees use. You have two main approaches:

Approach One: Company-Issued Devices

In this model, the organization purchases and configures laptops and phones. Advantage: full control over software and security settings. You can use MDM (Mobile Device Management) like Micro Focus ZENworks or open-source tools like Fleet. These tools allow you to:

• Remotely wipe the device if it's lost or stolen
• Install authorized software and block unauthorized ones
• Apply security updates centrally

Approach Two: BYOD (Personal Devices)

If the budget is limited and employees work with personal devices, you should use Containerization techniques. That means organizational data is kept in an isolated environment (like a work profile on Android or Microsoft Intune App Protection). In this case:

• Store organizational data with full encryption
• Restrict copy/paste from work environment to personal environment
• Block camera and screen recording access in the work environment

Common Mistake: Ignoring Operating System Updates

Many organizations hand out employee devices and never follow up. If a laptop with old Windows 10 (without the latest patches) connects to the VPN, it's essentially an entry point for attackers. Establish a policy that devices connecting to the organizational network must have a minimum OS version. At the network level, you can use NAC (Network Access Control) to automatically disconnect non-compliant devices from the network.

4. Bandwidth and Network Infrastructure: The Forgotten Prerequisite

Remote work infrastructure without adequate bandwidth is like a highway with one lane. Before implementation, do these calculations:

1. Estimate the number of concurrent users (e.g., 50 people)
2. Average usage per user: video conferencing (2 Mbps), file exchange (1 Mbps), regular work (0.5 Mbps)
3. Required bandwidth: 50 × 3.5 = 175 Mbps

This number is only for outbound traffic. If your server is in a data center, you need to ensure the data center's upload bandwidth (not just download) supports this volume. Many organizations only pay attention to download and end up facing problems in practice.

Solution: Using CDN and Local Caching

If your team uses web-based tools, installing a reverse proxy like Nginx with local caching can reduce repetitive traffic (like logos, JS libraries). Simple example:

# Configure caching in Nginx
location ~* \.(jpg|jpeg|png|gif|ico|css|js)$ {
    expires 7d;
    add_header Cache-Control "public, immutable";
    proxy_cache_valid 200 7d;
}

5. Backup and Recovery: The Insurance of Remote Work Infrastructure

If an employee loses their laptop or a ransomware attack occurs, regular backups are your only savior. For remote work infrastructure, follow these rules:

• The 3-2-1 rule: at least 3 copies of data, on 2 different types of media, 1 copy off-site
• Daily backups of critical servers (VPN, file server, database)
• Monthly recovery testing: a backup that hasn't been tested isn't a backup

For MySQL databases, you can use mysqldump with cron scheduling:

# Daily backup at 2 AM
0 2 * * * mysqldump -u backup_user -p'password' --all-databases | gzip > /backup/db_$(date +\%Y\%m\%d).sql.gz

6. Documentation and Training: The Human Side of the Story

Remote work infrastructure isn't just technical. If employees don't know how to use the VPN or why they shouldn't write passwords on paper, all your configurations are useless. Prepare a simple document with these sections:

• How to connect to the VPN (with screenshots)
• Password policy (at least 12 characters, change every 90 days)
• Who to contact in case of problems (IT ticket)
• Rules for using personal devices (if BYOD)

Also, hold a 30-minute online training session and make the recording available. This prevents 80% of support issues.

Summary: Implementation Roadmap

To implement remote work infrastructure, follow this order:

1. Needs assessment: how many users, what tools, what security level
2. Choose access model: traditional VPN or ZTNA
3. Set up collaboration tools with security as priority
4. Define device management policy (BYOD or company-issued)
5. Check bandwidth and optimize
6. Implement backup and recovery testing
7. Documentation and employee training

If you're looking for reliable hosting for your VPN servers, collaboration tools, or file servers, ServerNet offers cloud hosting and dedicated server services that can serve as the foundation of your remote work infrastructure. But remember: tools matter, but policies and training determine final success.

Remote work infrastructure is not a one-time project; it's an ongoing process. Review security settings every month, check logs, and get feedback from your team. By doing this, your organization will not only be ready for remote work but also more resilient against future threats.