Remote working IT for HR managers — 4 mistakes to fix today

Remote working IT for HR managers should prioritise identity, device management and secure access: enforce Microsoft 365 MFA, manage endpoints and close exposed services. Start by fixing the single most urgent exposure — open RDP — then follow NCSC guidance and a 4-point programme to protect payroll and staff records.

Mistake 1 — Remote Desktop published to the public internet

Leaving RDP or similar remote-desktop services open to the internet is the highest-risk pattern for HR systems because those services expose credential entry points and file access. In our experience, Remote Desktop published straight to the public internet is still, today, the single most common cause of ransomware entry we clean up. It should not exist any more, but it does. If a business has an RDP port open to the world, that is the this-week fix. Practical steps: close public RDP, restrict remote access to a VPN or zero-trust gateway, and put conditional access rules in place so HR users can only connect from managed devices.

Mistake 2 — Relying on consumer-grade remote tools or split VPNs

Many teams use consumer VPNs, home routers or split-tunnel setups that allow HR traffic out over unsecured networks. That increases the chance of credential interception or lateral movement once a device is compromised. To reduce risk, require corporate VPNs or a managed cloud access proxy, ensure full-tunnel where sensitive HR apps are used, and disable local file sharing for remote sessions.

Do not allow personal VPN accounts for HR access.
Enforce company-managed VPN clients with up-to-date encryption (IKEv2/IPsec or OpenVPN/OpenConnect).
Use network segmentation so HR systems are isolated from general office resources.

Mistake 3 — Unmanaged devices and weak endpoint controls

HR staff often access sensitive records from laptops, tablets and phones. If those devices are unmanaged — lacking disk encryption, endpoint protection or timely patching — they become the weakest link. A sensible baseline is device encryption, automated patching, an endpoint agent reporting to a central console, and a clear bring-your-own-device (BYOD) policy. For help operationalising those steps, read our remote-working checklist which shows what to require from devices before they access personnel or payroll systems.

Where possible, prefer company-managed devices for payroll access and use app-level controls (conditional access, CASB) so data access is revoked if a device falls out of compliance.

Mistake 4 — Weak identity and MFA configuration for HR apps

Identity is the control plane for remote HR systems. Weak passwords, missing multifactor authentication (MFA) and permissive SSO rules make it trivial for attackers to escalate. Enforce MFA for all HR admin accounts, remove legacy authentication methods, and use conditional access to block sign-ins from risky locations or unmanaged devices. Where Microsoft 365 is in use, enable security defaults or Conditional Access policies and require modern authentication for mail and file access.

Cost of leaving them unfixed

Fixing these issues is cheaper and faster than recovering from a breach. Leaving exposed RDP, unmanaged endpoints or weak identity controls in place risks ransomware, payroll fraud and data breaches that can cost months of downtime, regulatory fines and reputational damage. In practical terms, many of the immediate mitigations (closing RDP, enabling MFA, tightening VPN rules) can be implemented within days to weeks and avert much larger remediation bills later.

FAQ

How urgently should we close an open RDP port on our HR systems in the UK?

Close it immediately — aim to remove public RDP exposure within a week (7 days); in our experience that’s the this-week fix that most reduces ransomware entry risk.

Can HR managers enable remote access without changing payroll software?

Yes — you can secure remote access by adding MFA, endpoint checks and conditional access around existing payroll apps without replacing them, typically in staged steps done over a few weeks with IT support.

What minimum checks should be in place before staff access HR records remotely?

Require MFA, device encryption, an endpoint agent showing patching status, and access only from managed or compliant devices; revoke access automatically when a device is non-compliant.

Who should own remote access changes — HR or IT?

IT should implement the technical controls; HR must own the access policies, user privileges and staff communications so changes are enacted correctly and staff understand new steps.