In this guide · 8 sections
- 01Why home offices are a company security issue
- 02Home router: the five settings to check
- 03Family PCs and shared devices: keep work separate
- 04Printing, paper and screens at home
- 05Calls in cafés, co-working spaces and public places
- 06What employers should provide
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
Change the home router's admin password and keep its firmware updated. Do work only on a company laptop or a separate user account, never a shared family login. Keep confidential printouts to a minimum and shred them, and take sensitive calls where others can't overhear or see the screen.
Why home offices are a company security issue
A home network is shared with children's tablets, smart TVs, game consoles and visitors' phones. Any of those can be infected, and a compromised home router can watch or redirect traffic for every device behind it.
That isn't theoretical. In a Ministry of Digital Development and Information release from the 2026 Committee of Supply, the government said that in 2025 Singapore took part in a global operation which found attackers had infected over 2,700 Singapore devices, including routers, as part of a botnet. Under the PDPA, your business is still responsible for protecting customer data when staff handle it at home.
Home router: the five settings to check
The same MDDI release says all residential routers sold in Singapore must already meet Level 1 of CSA's Cybersecurity Labelling Scheme, which includes unique default passwords, vulnerability management and keeping software updated. CSA will raise the requirement to Level 2, with stronger encryption, secure storage and authentication, expected to come into force by end 2027. Older or imported routers may predate these rules.
Change the router's admin password
This is the password for the router's settings page, not the Wi-Fi password. Use a long, unique one and store it in a password manager.
Update the firmware, or turn on automatic updates
Log in to the router app or settings page and check for updates. If the maker no longer releases updates for your model, plan to replace it.
Use WPA2 or WPA3 with a strong Wi-Fi password
Avoid open networks or old WEP settings. Change the Wi-Fi password if many past visitors know it.
Put guests and smart devices on a guest network
Most routers can run a separate guest Wi-Fi. Keep work devices on the main network and everything else on the guest one.
Turn off remote management and WPS
Unless your ISP needs them, switch off remote admin access from the internet and the WPS push-button pairing feature.
If the router came from your broadband provider, its app or support line can usually do the update and password change. Our guest Wi-Fi guide covers guest networks in more detail.
Printing, paper and screens at home
Paper is easy to forget. A printed payroll list on the dining table or customer forms in the recycling bin can be a data breach just like a hacked mailbox.
- Print confidential documents only when you really need paper, and collect them straight away from shared printers.
- Store work papers in a drawer or folder, not on a shared desk.
- Shred printouts containing personal data instead of putting them in household recycling.
- Lock the screen (Windows key + L, or Control + Command + Q on a Mac) whenever you step away.
- Position the screen so it isn't visible from a window or doorway.
Calls in cafés, co-working spaces and public places
Working from a café or co-working space adds two risks: being overheard, and untrusted Wi-Fi.
Working in public
What employers should provide
Staff can't secure what they don't know about. The employer's part is short: a company device or clear rules for personal devices, MFA on every work account, antivirus and automatic updates, a password manager, a simple way to report a lost device or suspicious email, and a one-page home-working checklist like the one in this guide. CSA's Better Cyber Safe Than Sorry series has short videos on strong passwords, 2FA and software updates you can share with staff.
Our remote team IT set-up guide covers the company side in more detail: devices, accounts, file sharing and support.
Do it yourself or get help?
Most of this is a 30-minute job per person: router password and firmware, a separate user account, and the habits above. The hard part is getting everyone to do it and keeping it going.
Our Security Awareness Training (S$390) covers home working, phishing, passwords and safe AI use, with a short quiz for staff. Antivirus & Endpoint Protection Rollout (S$390) installs managed protection on every work device, including those at home, so you can see which ones are protected and up to date.
Frequently asked questions
Log in to the router's settings or app and change the admin password, install firmware updates or turn on automatic updates, use WPA2 or WPA3 with a strong Wi-Fi password, put guests and smart devices on a guest network, and turn off remote management and WPS. If the router no longer gets updates, replace it.
Not really. Other family members may install software or click malicious links, and saved passwords in a shared browser expose company accounts. Use a company laptop if possible. If you must use a personal computer, create a separate password-protected user account for work, keep antivirus and updates on, and use MFA on all work accounts.
Yes. According to the Ministry of Digital Development and Information, all residential routers sold in Singapore must meet Level 1 of CSA's Cybersecurity Labelling Scheme, covering unique default passwords, vulnerability management and software updates. CSA plans to raise the requirement to Level 2, expected by end 2027. Older or imported routers may not meet these standards.
Most work apps encrypt traffic, so public Wi-Fi is less dangerous than it once was, but fake hotspots and nearby snoopers are still risks. For anything sensitive, use your phone's mobile hotspot instead, keep the laptop's firewall on, and never leave the device unattended. Take confidential calls in private, not in the café.
The business remains responsible under the PDPA for protecting personal data its staff handle, wherever they work. In practice that means the employer should provide secure devices or clear device rules, MFA, antivirus and training, while staff follow the home-working checklist. A lost printout at home can be a reportable breach just like a hacked account.