Securing the ‘Third Place’ Office Policy Guidelines for Employees Working From Coffee Shops and Coworking Spaces
The modern office extends far beyond traditional cubicles or open-plan spaces. Since the concept of remote work became popularised in the COVID and post-COVID era, employees now find themselves working from their homes, libraries, bustling coffee shops, and even vacation destinations. These environments, often called “third places,” offer flexibility and convenience but can also introduce risks to company IT systems.
With remote work now a permanent reality, businesses must adapt their security policies accordingly. A coffee shop cannot be treated like a secure office, as its open environment exposes different types of threats. Employees need clear guidance on how to stay safe and protect company data.
Neglecting security on public Wi-Fi can have serious consequences, as hackers often target these locations to exploit remote workers. Equip your team with the right knowledge and tools, and enforce a robust external network security policy to keep company data safe.
The Dangers of Open Networks
Free internet access is a major draw for remote workers frequenting cafes, malls, libraries, and coworking spaces. However, these networks rarely have encryption or strong security, and even when they do, they lack the specific controls that would be present in a secure company network. This makes it easy for cybercriminals to intercept network traffic and steal passwords or sensitive emails in a matter of seconds.
Attackers often set up fake networks that look legitimate. They might give them names such as “Free Wi-Fi” or give them a name resembling a nearby business, such as a coffee shop or café, to trick users. Once connected, the hacker who controls the network sees everything the employee sends. This is a classic “man-in-the-middle” attack.
It is critical to advise employees never to rely on open connections. Networks that require a password may still be widely shared, posing significant risks to business data. Exercise caution at all times when accessing public networks.
Mandating Virtual Private Networks
The most effective tool for remote security is a VPN. A Virtual Private Network encrypts all data leaving the laptop by creating a secure tunnel through the unsecured public internet. This makes the data unreadable to anyone trying to snoop.
Providing a VPN is essential for remote work, and employees should be required to use it whenever they are outside the office. Ensure the software is easy to launch and operate, as overly complex tools may be ignored. Whenever possible, configure the VPN to connect automatically on employee devices, eliminating human error and ensuring continuous protection.
At the same time, enforce mandatory VPN usage by implementing technical controls that prevent employees from bypassing the connection when accessing company servers.
The Risk of Visual Hacking
Digital threats are not the only concern in public spaces since someone sitting at the next table can easily glance at a screen. Visual hacking involves stealing information just by looking over a shoulder, which makes it low-tech but highly effective and hard to trace.
Employees often forget how visible their screens are to passers-by, and in a crowded room full of prying eyes, sensitive client data, financial spreadsheets, and product designs are at risk of being viewed and even covertly photographed by malicious actors.
To address this physical security gap, issue privacy screens to all employees who work remotely. Privacy screens are filters that make laptop and monitor screens appear black from the side, and only the person sitting directly in front can see the content. Some devices come with built-in hardware privacy screens that obscure content so that it cannot be viewed from an angle.
Physical Security of Devices
Leaving a laptop unattended is a recipe for theft. In a secure office, you might walk away to get water or even leave the office and expect to find your device in the same place, untouched. In a coffee shop, that same action can cost you a device, since thieves are always scanning for distracted victims and are quick to act.
Your remote work policy should stress the importance of physical device security. Employees must keep their laptops with them at all times and never entrust them to strangers. A laptop can be stolen and its data accessed in just seconds.
Encourage employees to use cable locks, particularly if they plan to remain in one location for an extended period. While not fool proof, locks serve as a deterrent, especially in coworking spaces where some level of security is expected. The goal is to make theft more difficult, and staying aware of the surroundings helps employees assess potential risks.
Handling Phone Calls and Conversations
Coffee shops can be noisy, but conversations still travel through the air. Discussing confidential business matters in public is risky, as you never know who might be listening. Competitors or malicious actors could easily overhear sensitive information.
Employees should avoid discussing sensitive matters in these “third places.” If a call is necessary, they should step outside or move to a private space, such as a car. While headphones prevent others from hearing the other side, the employee’s own voice can still be overheard.
Creating a Clear Remote Work Policy
Employees shouldn’t have to guess the rules. A written policy clarifies expectations, sets standards, and supports training and enforcement.
Include dedicated sections on public Wi-Fi and physical security, and explain the reasoning behind each rule so employees understand their importance. Make sure the policy is easily accessible on the company intranet.
Most importantly, review this policy annually as technology changes. As new threats emerge, your guidelines must also evolve to counter them. Make routine updates to the policy, and reissue the revised versions to keep the conversation about security alive and ongoing.
Empower Your Remote Teams
While working from a “third place” offers flexibility and a morale boost, it also requires a higher level of vigilance. This makes prioritising public Wi-Fi security and physical awareness non-negotiable, and you must equip your team to work safely from anywhere.
With the right tools and policies, you can manage the risks while enjoying the benefits of remote work. Success comes from balancing freedom with responsibility, and well-informed employees serve as your strongest line of defence. Protect your data, no matter where your team works.
Is your team working remotely without a safety net? We help businesses implement secure remote access solutions and policies, ensuring your data stays private, even on public networks. Call us today to fortify your remote workforce.
More from our blog
3. A credibility wrapper: “assessment”, “interview pack”, or “onboarding”
Airswift flags link/attachment requests and urgency tactics as common red flags. The story is usually something like: “Download this assessment,” “Review these onboarding steps,” or “Log in here to schedule.” Tag Apps Make decisions visible and repeatable by tagging apps. Microsoft explicitly calls tagging apps as sanctioned or unsanctioned an important step, because it lets you filter, track progress, and drive consistent action over time. 4. The pivot: money, sensitive info, or account takeover Scammers impersonate well-known companies and then ask for things legitimate employers typically don’t: payment for “equipment” or early requests for personal information. Another variation is more subtle: “verification” steps that are really designed to steal identity details or compromise accounts. 5. Pressure to keep moving If someone hesitates, the scam leans on urgency: “limited slots,” “fast-track hiring,” “complete this today.” That’s why Forbes frames the key skill as slowing down and checking details, because the scam depends on momentum. Red Flags Checklist for Staff Here are the red flags to look out for. Red flags in the job posting The role is oddly vague or overly broad. Generic responsibilities, unclear reporting lines, and “we’ll share details later” language are common in fake listings. The company's presence doesn’t match the brand name. Thin company pages, inconsistent logos/branding, or a web presence that feels incomplete are worth pausing on. The process is “too easy, too fast.” If the listing implies immediate hiring with minimal steps, treat it as suspicious. Red flags in recruiter behaviour They push you off LinkedIn quickly. Moving to WhatsApp/Telegram or personal email early is a common tactic. They use a personal email address or unusual contact details. Be specifically cautious of recruiters using free webmail accounts instead of a company domain. They avoid verification. If they dodge basic questions, treat that as a signal, not a scheduling issue Hard-stop requests Any request for money or fees. Application fees, equipment purchases, “training costs”, gift cards, crypto, that’s a hard stop. Requests for sensitive personal info early. Bank details, identity documents, tax forms, or “background checks” before a real interview process is established. Requests for verification codes. If anyone asks you to read back a one-time code sent to your phone/email, assume they’re trying to take over an account. Requests for non-public company information like org charts, internal system details, client lists, invoice processes and security tools. Look out for requisitions for anything beyond what a recruiter would reasonably need. Stop Scams With Simple Defaults LinkedIn recruitment scams don’t succeed because staff are careless. They succeed because the outreach looks normal, the process feels familiar, and the next step is always framed as urgent. The fix isn’t turning everyone into an investigator. It’s setting simple defaults that make scams harder to complete: slow down before clicking, verify the recruiter and role through official channels, keep conversations on-platform until identity checks out, and treat money requests, code requests, and early personal data demands as hard stops. When those habits are standardised, the scam loses its leverage.