Cybersecurity Tips for People Working From Home

Getting these right matters more for a Nigerian remote worker than for most people. Usually you have no IT department down the corridor. You may be working on your own laptop, sharing Wi-Fi with a whole compound, or switching between a MiFi and a phone hotspot when the network drops. One stolen password can lose you a client you spent months winning, and it can also empty your dollar wallet.

This guide covers what to set up first, how to protect company data when working remotely (including on a personal laptop), how to handle Wi-Fi at home and in public, and the steps to take in the first hour if something goes wrong.

Quick answer

To work from home securely, use a password manager and unique passwords, and turn on two-step verification (preferably with an authenticator app, not SMS). Install updates promptly, encrypt and lock your devices, and change your router's default admin password. Keep work files in company-approved tools only. Verify any unexpected request for money or logins through a second channel. If a device is lost or you click a bad link, tell your employer or client immediately.

Why working from home raises your security risk

An office gives you protection you don't see: managed laptops, a firewall run by someone else, colleagues who notice when an email looks off. At home all of that is down to you. For contractors and freelancers hired from Nigeria it often falls entirely on you, because the client may never send you a laptop.

The risks a Nigeria-based remote worker meets most often are practical rather than exotic:

• Shared devices and spaces. A sibling borrows the laptop, a cousin knows the Wi-Fi password, or your screen faces the parlour during a client call.
• Personal laptops doing work. Many contractors use one machine for everything: client dashboards, Netflix, school assignments and pirated software downloads.
• Patchy power and internet. Updates get postponed for weeks because the battery is low or data is expensive. Then you jump onto café or hotel Wi-Fi when your MiFi dies.
• Money accounts as targets. Your Payoneer, Grey, Wise or Upwork account is worth stealing, and so is the email address that resets it.
• Scams aimed at job seekers. Fake recruiters and fake clients specifically target people looking for remote work.

A foreign company hiring from Nigeria is trusting you with customer records, source code or financial data it can't physically watch over. Showing that you handle data carefully is part of being worth hiring.

The work-from-home security checklist

If you only have an afternoon, do these in order. The first four protect you from the most common ways accounts and devices get taken over.

The UK's National Cyber Security Centre (NCSC) gives a similar core list for individuals in its top tips for staying secure online: three random words for passwords, two-step verification, the latest updates, backups and a password manager.

Secure your accounts first

Most break-ins start with someone logging in as you, not with clever hacking. Your email account is the most valuable one you have, because it can reset the passwords for everything else.

Use long, unique passwords and a password manager

Every account needs its own password. If your Netflix password is the same as your Gmail password, one leak exposes both. The NCSC suggests joining three random words to make a password that is hard to crack but easy to type, for example (hypothetical) "kettle-harmattan-violin". It also recommends a password manager to create and remember the rest.

A password manager (Bitwarden, 1Password, Proton Pass, or the one built into Google or Apple accounts) stores your passwords behind one strong master password. If you're comparing options, see our guide to password managers for remote workers.

Turn on two-step verification everywhere that matters

Two-step verification (also called 2SV, two-factor authentication or MFA) asks for a second proof after your password, such as a code from your phone. The US Cybersecurity and Infrastructure Security Agency (CISA) explains that if someone steals your password, MFA still stops them at that second step. It lists text or email codes, authenticator apps and biometrics as the common methods.

For a Nigerian remote worker, the order of preference is usually:

1. A passkey or physical security key, where the service supports it.
2. An authenticator app such as Google Authenticator, Microsoft Authenticator or Authy.
3. SMS codes, only if nothing else is offered.

SMS is the weakest option because a criminal who gets your line moved to a new SIM (a "SIM swap") receives your codes. An authenticator app keeps the codes on your phone itself. Start with your main email account, then your work accounts (Google Workspace, Microsoft 365, Slack), then payment platforms and LinkedIn. Save the backup codes each service gives you somewhere offline. Our guide to setting up two-factor authentication walks through each platform.

Keep your laptop and phone in good shape

A secure account doesn't help much if the laptop it's opened on is compromised or stolen.

Install updates, even when power is a problem

Updates fix security holes that attackers already know about. The NCSC advises installing the latest software and app updates for exactly this reason. In Nigeria the usual excuse for skipping them is power: nobody wants a Windows update to die halfway through when NEPA takes light.

The fix is to schedule updates for when you know you'll have power for an hour, such as when the inverter is fully charged or the generator is on. Turn on automatic updates for your browser and apps, which install quickly. If data cost is the problem, run big operating system updates over home broadband or on a cheaper night data plan rather than putting them off for a month.

Encrypt and lock your devices

Laptops get stolen from cars, danfos, hostels and homes. Encryption means a thief who takes your laptop can't read the files on it. Windows has BitLocker or "Device encryption" (depending on your edition), and Macs have FileVault. Android phones and iPhones encrypt automatically once you set a PIN.

Also set your screen to lock after a few minutes, and lock it yourself (Windows key + L, or Control + Command + Q on a Mac) every time you walk away. This matters most if you share your home with children, relatives or housemates.

Keep the built-in protection switched on

Windows Security (Microsoft Defender) and the macOS built-in protections are enough for most people, provided they stay on and up to date. CISA also recommends running antivirus and keeping firewalls enabled on home computers. Avoid cracked software and "free" paid apps from random sites. Pirated installers are a common way malware gets onto personal laptops.

Back up your work

Ransomware, a spilled drink or a power surge can wipe weeks of work. Back up to cloud storage such as Google Drive or OneDrive, or to an external drive you unplug afterwards, as the NCSC recommends. For client files, back up only to the storage your client approves (more on that below).

Make your home Wi-Fi, MiFi and public connections safer

Your router is the front door to everything you do online.

Lock down your router or MiFi

CISA's home network security guidance recommends three things that apply directly to the routers and MiFi devices sold in Nigeria:

• Change the factory admin username and password, because defaults are often printed on the device or published online.
• Update the router's firmware from the manufacturer or your ISP.
• Use the strongest Wi-Fi encryption the device offers, ideally WPA3 (WPA2 if WPA3 isn't available), and make sure the firewall is turned on.

Change the Wi-Fi password itself too if half the compound already knows it. If your router offers a guest network, put visitors and smart TVs on it and keep your work laptop on the main one. For a fuller setup, read our guide to keeping your home office network secure.

Be careful with café, hotel and co-working Wi-Fi

Free Wi-Fi in a café, airport lounge or hotel is shared with strangers, and you can't be sure who runs it. If your MiFi runs out of data and you need to keep working, your own phone's hotspot with a password is usually the safer choice. If you must use public Wi-Fi, use your company's VPN if it provides one, stick to sites that show the padlock (HTTPS), and avoid logging in to payment accounts. A VPN is not a cure-all, and free VPN apps carry their own risks. See how to use a VPN safely for remote work.

How to protect company data when working remotely

Protecting company data means keeping your employer's or client's information (customer details, code, documents, passwords, recordings) inside the systems they control, and making sure nobody else can see, copy or lose it through you. In many cases this matters more to the company than your own security does.

Keep work data in approved tools only

Use the tools the company gives you: its Google Workspace or Microsoft 365 account, its Slack, its password vault, its ticketing system. Don't forward work emails to your personal Gmail. Don't download customer lists to your desktop "to work offline". Don't save client files in your personal WhatsApp or Telegram. Every copy outside the company's systems is a copy it can't protect or delete.

Using your own laptop for work

Many Nigeria-based contractors work on their own laptops, which is often called "bring your own device" (BYOD). The NCSC's guidance on BYOD makes the point clearly: the company owns the data on your device even though you own the device. How well that data is protected depends on how much management the device owner allows.

In practice this means:

• Some companies will ask you to install device management software (for example Microsoft Intune or Jamf). Ask what it can see and whether it can wipe the whole device or only work apps, then decide.
• If you share the laptop with family, create a separate, password-protected user account used only for work.
• Keep a separate browser profile for work logins so personal extensions and saved passwords don't mix with client accounts.
• When a contract ends, delete the client's files and sign out of its accounts, and tell the client you have done so.

Whether you are a contractor or an employee through an employer of record affects who supplies the equipment and who carries the responsibility. Our guide on contractor versus employee arrangements explains the difference.

Watch your screen, calls and paper

Check what's behind you and on your screen before any video call. The NCSC's advice on securing online meetings suggests checking your surroundings, using a background blur, keeping meeting apps updated and never posting meeting links publicly. When you share your screen, share a single window, not the whole desktop, so a customer's details or a private chat don't appear. Use headphones for calls in a shared home, and don't leave printed customer information lying around.

Don't paste confidential data into AI tools or random websites

Copying a customer email thread, a contract or a chunk of source code into a public AI chatbot, an online PDF converter or a free grammar checker can send that data to a third party. Use only the AI tools your employer has approved, in the way it has approved. If there's no policy, ask before you paste.

Know the basics of Nigerian data protection law

Nigeria's Data Protection Act 2023 (NDPA) sets rules for organisations that handle personal data, overseen by the Nigeria Data Protection Commission (NDPC). According to Udo Udoma & Belo-Osagie's summary of the Act's breach rules, section 40 requires a data processor that becomes aware of a breach to notify the organisation that engaged it. The data controller must notify the NDPC within 72 hours of becoming aware of a breach that risks people's rights and freedoms. The NDPC runs an online breach reporting service, linked from its resources page.

For you as an individual remote worker, the lesson is simple. If you think customer or company data has been exposed through your device or account, report it to your employer or client straight away. They may have legal reporting deadlines, and hiding a problem makes it worse for everyone. Your foreign employer will also have obligations under its own country's laws (such as UK GDPR in Britain). Your contract or the company's security policy is the place to check what applies to you. This is general information, not legal advice.

Spot phishing and scams aimed at remote workers

Phishing is a message (email, text, WhatsApp or call) designed to trick you into clicking a link, opening a file, sharing a password or sending money. The NCSC notes that criminals use information people post online, including on social media, to make these messages more convincing. That is a real risk when your LinkedIn profile announces your new remote job.

The US Federal Trade Commission lists common warning signs: messages that look like they're from a company you know, claims of suspicious logins or unpaid invoices, requests to confirm personal or payment details, and urgent warnings that an account will be suspended. Its main advice is to contact the company through a number or website you already know is genuine, not the details in the message.

For remote workers, watch especially for:

• A message "from your manager" on WhatsApp or a new email address asking you to buy gift cards, change a supplier's bank details or share a login.
• A fake login page for Google, Microsoft, Slack or your payment platform.
• "Your Payoneer/Upwork account is on hold, verify now" messages.
• Recruiters who interview only by text chat, or who ask you to pay for training or equipment.

Confirm any unusual request on a channel you already trust, such as the company Slack or a known phone number. For more detail, see how to avoid phishing while working remotely, and for job-specific tricks, our page on how to spot remote job scams in Nigeria.

What to do if something goes wrong

Speed matters more than embarrassment. Companies generally treat a mistake reported quickly far better than one discovered later.

1. Tell your employer or client immediately. Use the contact you wrote down in advance (manager, IT or security team). Say what happened, when, and which accounts or data might be affected.
2. If you clicked a link or entered a password, change that password from a different, clean device and sign out of all sessions. The FTC also advises updating your security software and running a scan if you opened something that may have installed malware.
3. If your laptop or phone is lost or stolen, ask the company to revoke access and wipe work apps. Change your email and payment passwords. Use Find My Device (Android/Windows) or Find My (Apple) to lock or erase it.
4. If your SIM suddenly stops working, contact your mobile network at once, because this can signal a SIM swap. Then check your email and bank accounts.
5. If money is involved, contact your bank or payment platform immediately.
6. Write down what happened, including times and screenshots, in case the company needs them for its own reporting.

Example (hypothetical): a secure setup for a contractor in Ibadan

Tolu (a hypothetical example) has just started as a remote customer support contractor for a UK software company. She uses her own laptop, shares a flat with her younger brother, and switches between a MiFi and her phone hotspot.

In one Saturday afternoon she:

• Turns on authenticator-app verification for her Gmail, the company's Google Workspace account, Zendesk, Slack and Payoneer, and stores the backup codes on paper in a drawer.
• Installs Bitwarden and replaces the three passwords she had been reusing.
• Creates a separate Windows user account called "Work" with its own password, and turns on device encryption.
• Logs in to her MiFi's admin page, changes the default admin password and the Wi-Fi password, and installs the firmware update while the inverter is full.
• Saves her manager's phone number and the company's IT email in her phone under "Security contact".

None of it costs money beyond data. It also gives her a concrete answer when the company asks how she keeps customer information safe.

Good security habits help you get hired

Foreign employers hiring from Nigeria often ask about your setup in interviews: power backup, internet backup, and increasingly how you protect data. A specific answer such as "I use a separate work profile, an authenticator app, an encrypted laptop and the company VPN on public networks" is far more convincing than "I'm careful". If you find this topic interesting, security can also become a career. Our guide to becoming a cybersecurity analyst remotely from Nigeria covers the skills and certificates involved.

Frequently asked questions

Is it safe to use my personal laptop for a remote job?

It can be, if you set it up properly and your employer allows it. Use a separate user account for work, encrypt the drive, keep it updated, and keep work files only in company-approved tools. Some employers will ask you to install device management software or will send a company laptop instead.

Is public Wi-Fi safe for remote work in Nigeria?

It's risky, because you don't control who runs the network or who else is on it. Your own phone hotspot with a password is usually safer. If you must use public Wi-Fi, connect through your company's VPN if it has one, and avoid logging in to banking or payment accounts.

Should I use SMS or an authenticator app for two-factor authentication?

Use an authenticator app or a passkey where you can. SMS codes can be stolen through a SIM swap, where a criminal gets your number moved to a new SIM. SMS is still much better than having no second step at all.

Do I need to buy antivirus software for remote work?

Usually not. Microsoft Defender on Windows and the built-in protections on macOS are adequate for most home workers if they're switched on and updated. Follow your employer's policy if it requires a specific product, and avoid pirated software, which is a common source of malware.

Can I use ChatGPT or other AI tools with company data?

Only if your employer has approved that tool for that kind of data. Pasting customer details, contracts or source code into a public AI tool may share it with a third party. Ask your manager if there's no written policy.

What should I do if my work laptop is stolen?

Report it to your employer or client immediately so they can cut off access and wipe work data. Then change your email and payment passwords from another device and use Find My Device or Find My to lock or erase the laptop. Encryption means the thief can't easily read your files.

Does Nigeria's data protection law apply to me as a remote worker?

The Nigeria Data Protection Act 2023 mainly places duties on organisations that collect and process personal data, including reporting certain breaches. As an individual worker, your main obligation is usually set by your contract: protect the data and report incidents to your employer or client quickly. For anything beyond that, get proper legal advice.

Key takeaways

• Protect your email first: a unique password, a password manager and app-based two-step verification stop most account takeovers.
• Keep your laptop and phone updated, encrypted and locked, and schedule updates around your power supply rather than skipping them.
• Change your router or MiFi admin password, use WPA3 or WPA2, and prefer your own hotspot to public Wi-Fi.
• Protecting company data means keeping it inside the tools your employer or client provides, including on a personal laptop.
• Verify any unexpected request for money, logins or bank detail changes through a channel you already trust.
• If something goes wrong, tell your employer or client immediately. Fast reporting limits the damage.

Next steps

Spend one afternoon this week on the checklist table above, starting with two-step verification on your email. Then, if you're looking for your next role, browse remote jobs open to applicants in Nigeria, where each listing shows the company, its website and where applicants may live. After a search you can use "Get email updates" to receive a free daily alert for new matching jobs. If a job offer or recruiter feels off, check it against our guide to remote job scams before you share any documents.

Sources

• Top tips for staying secure online, National Cyber Security Centre (UK)
• How to secure your online meetings, National Cyber Security Centre (UK)
• Bring your own device, NCSC device security guidance
• Phishing scams: how to spot and report them, National Cyber Security Centre (UK)
• Turn On MFA, CISA
• Home Network Security, CISA (archived, 2021)
• How To Recognize and Avoid Phishing Scams, US Federal Trade Commission
• Data Breaches: Compliance obligations under the Nigerian Data Protection Act 2023, Udo Udoma & Belo-Osagie via Afriwise
• Resources, Nigeria Data Protection Commission