A compromised account can be enough to open the door to sensitive data, even if your teams are legitimately working remotely. In Geneva, securing remote access is therefore not simply a matter of choosing between VPN (virtual private network), remote office and cloud services. You also need to know who is connecting, from which device and with what rights. It is normal to want to protect the resources of your SME without adding unnecessary constraints to daily life.
This guide helps you define an access method adapted to your uses and the sensitivity of your data. You will discover how to strengthen identity verification, limit authorizations to what is strictly necessary and better understand devices used off-premises. We will review the main options and concrete measures to be put in place, taking into account FADP, the Swiss federal law on data protection, and data sovereignty issues. The objective: controlled remote access, reliable and easy to use for your teams.
Key Points
- Identify the access really necessary for your teams and avoid unnecessarily exposing the internal resources of your SME.
- Strengthen every connection by verifying identity, device used and rights granted, without relying on multi-factor authentication alone.
- Compare VPN, remote desktop and cloud access to choose an approach adapted to your uses and your resources.
- Apply a progressive approach to securing remote access in Geneva: inventory, data classification, access rules, deployment and review.
- Integrate the issues of FADP and Swiss data sovereignty into your choices, with support adapted to the needs of your SME.
Table of Contents
Why secure remote access for your SME in Geneva?
Remote access is a connection established off-premises to view a company account, application or resource. This could be an employee who opens their files from home, a member of management who consults their email while traveling or a service provider who works on a system. For a general presentation of the concept, see What is remote access?. The challenge for your SME is to enable these professional uses without leaving resources accessible that do not need to be.
Mobility is legitimate, but it does not justify unlimited access to the internal network. Imagine that an account is compromised after the disclosure of its password: if this account also opens confidential folders or administration tools, the incident can go beyond messaging. A lost device poses another risk if a session remains open or files are saved locally. Finally, rights that are too broad can give a person access to documents that they do not need for their role. Securing remote access Geneva therefore begins with visibility: knowing who is connecting, to what and for what reason.
The protection must also remain practicable. A procedure that is too cumbersome can push teams to look for workarounds, while well-defined access allows them to work without multiple requests and interruptions. This is about reducing exposure, not preventing mobility. The technical choices benefit from being part of a cybersecurity and IT management approach, adapted to the real uses of the company.
What remote access should an SME identify?
Establish an inventory that covers employees, management and service providers. For each, note which cloud applications, servers, shared files, or desktops are accessible. Link each access to a role, a specific professional need and a person responsible for its validation. This overview helps identify forgotten accounts, temporary access that has become permanent and rights that no longer correspond to the functions.
- Who uses the access, and who is responsible for it?
- What resource is accessible, and for what task?
- Is access still necessary and limited to the anticipated need?
Why does the Geneva context matter?
An SME can organize work between its offices, home and travel within the canton. The needs of a team based in Geneva are not necessarily those of a company in Meyrin, Vernier or Lancy: the applications used, the roles and the sensitivity of the data vary. The method must therefore start from your activities, rather than applying the same rule to everyone.
The location and processing of data also deserve particular attention. The FADP constitutes the Swiss federal framework for the protection of personal data. LIPAD concerns in particular the Geneva public sector and private entities responsible for a public task. Their application depends on the context: avoid drawing a general legal conclusion from the place of connection alone. For your cloud services, identify where the data is hosted and what access is possible. This verification contributes to a coherent approach to the security and sovereignty of Swiss data.
How to protect every connection: identity, device and resource
A remote connection is secured by verifying three elements, in this order: the identity of the person, the device used and the requested resource. Successful authentication alone should not open the entire information system. This logic makes it possible to grant access proportionate to the role and the task, then to re-evaluate it when needs evolve.
- Verify identity. Assign a named account to each person and activate multi-factor authentication (MFA) to request additional proof, in addition to the password. Depending on the application, this proof can help limit the consequences of a stolen password, but it does not replace well-defined rights or access monitoring.
- Identify the device. Keep a list of authorized equipment and clarify who manages it. A work computer monitored by the company does not have the same level of control as a personal device that is shared, lost or no longer used.
- Authorize the necessary resource. Apply the principle of least privilege: each person only accesses the data and tools required by their tasks. A collaborator who consults a shared folder does not necessarily need access to administration settings.
Control must be adapted to the sensitivity of the resource. You can provide stricter checks for applications containing sensitive data than for common work tools. THE NIST guide to teleworking and remote access security presents useful recommendations for structuring the protection of personal connections and devices.
Prevention benefits from being supplemented by proactive monitoring, that is to say the continuous observation of systems to spot anomalies before they cause an interruption. For example, an unusual connection or an attempt to access a resource not normally used may warrant an audit. The objective is to detect deviations and be able to examine them, without confusing any atypical activity with a confirmed incident.
How to reduce the risks associated with user accounts?
Favor nominative accounts, rather than shared identifiers, in order to link each access to a person and a function. When changing roles or leaving, plan a step to review and withdraw rights that are no longer necessary. For an SME, this responsibility can be assigned to an internal manager, with a trace of requests and validations.
- Remove temporary access as soon as the need ends.
- Review permissions after internal mobility.
- Strengthen verification based on application and data sensitivity.
What role do Swiss devices and data play?
A personal device can be practical, but the company sometimes has less control over its configuration and use. Define which equipment can access sensitive resources and who is responsible for their management. For each cloud service, also identify where the data is hosted and what access is associated with it. These elements help integrate Swiss data sovereignty into your decisions, taking into account the applicable framework, including FADP.
To structure these controls according to your uses and resources, Flux Group’s IT and cybersecurity expertise can support you. Discuss with our team about securing your access.
VPN, remote office or cloud access: which approach for your SME?
The choice depends first on the tasks to be accomplished and the location of resources. An VPN connects the user to the company network; a remote office gives access to a remotely hosted work environment; a cloud application can be accessed directly. These approaches do not cover the same scope and do not result in the same dependencies. To choose, consider the applications used, the internal resources required, and what needs to remain accessible if part of your infrastructure is unavailable.
| Approach | Scope of access | Accessible resources | Internal network dependence |
|---|---|---|---|
| VPN | Connection to the company network, according to established rules | Internal services accessible from the network, for example a file server | Important: the resources concerned must be available on the internal network |
| Remote Desktop | Access to a remotely hosted work environment | Applications and files offered in this environment | Important: the remote environment and its resources must work |
| Direct access to a cloud application | Targeted connection to a service | The application concerned, without general access to the internal network | Less direct: access depends on cloud service and Internet connection |
When is an VPN or remote desktop relevant?
An VPN should be considered when a business process still uses a tool hosted on the company network, for example an internal application that is not otherwise accessible. We must then take into account the services that must communicate with each other: a connection to the network can provide access to several resources, depending on its configuration. The perimeter must therefore correspond to the need, rather than opening up the network as a whole for convenience.
Remote office may be suitable if teams need a common environment to work with internal software. It centralizes the work environment, but its operation depends on the resources that host it and their accessibility. This option may also require adapted organization if employees use different tools or need local functions, such as printing.
When to prioritize targeted access to applications?
If a task relies on a specific cloud service, direct access to this application can avoid having to pass the user through the internal network. Evaluate the functions needed for each role and the business rules available in your environment. Microsoft Entra ID P1 can be taken into account in an Microsoft environment analysis, without assuming the functionalities actually configured in your SME.
There securing remote access Geneva is therefore not based on a single solution. Some SMEs may maintain an VPN for internal resources and favor targeted access for cloud applications. Compare the operating constraints, the resources to maintain and the consequences of an interruption. The choice will be fairer if it follows the concrete needs of each activity rather than a general preference for a technology.
Setting up secure remote access: the steps for a Geneva SME
To move forward without disrupting activities, organize the project as a series of documented decisions. Designate a person to coordinate validations, involve application managers and allow time to process team feedback. Securing remote access in Geneva must remain proportionate to the resources of your SME: start with the most sensitive uses, then extend the measures when their operation is understood.
- Take inventory. Identify the affected accounts, services, devices and groups. Also note access managed by a service provider and applications known to the teams, even if they do not yet appear in the IT documentation.
- Classify. For each resource, indicate the data and activities involved, as well as the possible consequences of unavailability or inappropriate access. This analysis helps to set a processing order.
- Set the rules. Document who can approve, modify, and revoke access. Also specify how to handle an urgent request, change of role or temporary exception.
- Deploy. Start with a representative pilot group and agree on testing criteria: access to necessary applications, understanding of instructions, and ability of support to resolve common difficulties.
- Revise. After deployment, document issues encountered and adjustments made. Then plan reviews, in addition to checks triggered by a departure, reorganization or IT evolution.
How to carry out a useful inventory?
Centralize the results in a register accessible to those responsible, with an update date and a status for each point to be treated. Highlight accounts without an identified manager, authorizations inherited from old functions and access whose justification is uncertain. To prioritize, together consider the sensitivity of the data, the importance of the activity, and the ease of correcting the problem. Avoid modifying critical access without documenting dependencies, so as not to interrupt a business process.
How to deploy without blocking daily work?
Announce changes early and provide short instructions, with a point of contact for questions. During testing, collect feedback from users and support, then fix any issues before expanding. Also prepare a procedure in the event of an incident, for example the loss of a device or the suspicion of a compromised account: who receives the report, who decides on immediate measures and how to inform the people concerned?
What Swiss benchmarks should be included in the approach?
For personal data, examine the processing context with regard to FADP. The Geneva LIPAD falls under a different framework, particularly for public institutions and certain entities responsible for a public task. Do not infer a legal obligation from the mere presence of an employee in Geneva: check the texts and indications from the competent authorities depending on your organization. Also document the location of the data and the conditions of access to the services concerned. Hosting in Switzerland can contribute to data sovereignty, without alone demonstrating the conformity of all processing. Support in IT and cybersecurity can help to integrate these decisions into a coherent approach.
Securing remote access in Geneva: Flux Group support
Securing access is part of the overall functioning of your SME. The choices must correspond to the responsibilities of the teams, the tools used and the resources available to administer IT. Flux Group SARL, an independent company based in Geneva, combines the expertise of Flux ICT and Flux Defense to examine these dimensions in a coordinated manner. The objective is to clarify priorities and construct an appropriate approach, without unnecessarily burdening employees with their work.
What support for a business in Geneva and Switzerland?
Support can link infrastructure management to IT support and cybersecurity. Flux ICT provides knowledge of the company's IT environment, while Flux Defense helps examine protection issues. This complementarity helps match security decisions to operational constraints: teams must be able to use their tools, and those responsible must understand how access is managed.
To prepare this analysis, it is useful to specify the internal roles: who knows the needs of the services, who administers the tools and who validates the decisions having an impact on employees? By bringing these perspectives together, you can distinguish priority actions from improvements that can wait, and then organize their implementation according to your SME's resources. THE IT and cybersecurity services of Flux Group are part of this approach, with attention paid to the context of each company.
This proximity concerns companies in Geneva, Meyrin, Vernier, Eaux-Vives, Collogny, Grand-Lancy and Petit-Lancy. Needs are not uniform from one organization to another: team structure, business tools and work habits influence choices. The support therefore aims to inform decisions and coordinate IT and cybersecurity, rather than applying an identical configuration to all SMEs.
How to prepare a first discussion on your access?
To make the discussion concrete, you can bring together a few benchmarks, without having to carry out a complete audit first. Describe the teams involved, the remote working situations and the applications essential to your activities. Also note planned changes, for example the adoption of a new tool, a reorganization or an evolution of IT responsibilities.
Prepare, if you have them, the current access rules, the questions reported to support and the difficulties encountered by employees. Poorly functioning access, an unclear procedure or an authorization whose responsibility is difficult to establish are useful elements to examine. This will allow you to direct the discussion towards the points that matter most to your business.
An appropriate approach begins by understanding your context. From there, priorities can be discussed methodically and taking into account the realities of your team.
Make access control a lasting reflex
The next step does not necessarily involve transforming everything. Choose a concrete starting point: clarify who validates access, plan their review or document the procedure to follow in case of doubt. By assigning these responsibilities, you prevent the rules from depending solely on one person's memory or a one-off intervention. Securing remote access Geneva then becomes a followed practice, which evolves with the teams, tools and needs of the company.
Also keep an operational objective: protect resources without unnecessarily complicating the work. Rules understood and applied are more useful than a system that is difficult to follow. An exchange adapted to your context can help you define realistic priorities and move forward methodically.
With a progressive approach and clear responsibilities, your teams can work remotely with greater peace of mind, while your company maintains control of its access and data.
Frequently asked questions about remote access
Is VPN enough to secure remote access for an SME?
No, an VPN alone does not protect all elements of a connection. It secures the passage to the network, but security also depends on the accounts, devices and rights configured. If an employee changes role, for example, their previous access must be re-examined even if they still use the same VPN. Also check that the rules match the resources that actually need to be accessible.
Is multi-factor authentication necessary for teleworking?
It is highly recommended for accounts used remotely, especially those that provide access to sensitive data or systems administration. It adds proof of identity to the password, but does not neutralize all risks. Also provide a clear procedure if a person loses their phone or can no longer validate their connection, in order to restore access without resorting to shared accounts.
How to secure remote access to an IT service provider?
Give the service provider a named account and limit their access to the systems necessary for the planned intervention. Define who authorizes the connection, what resources are affected, and how to end access when the work is complete. For example, an intervention on a server does not automatically justify access to human resources files. Keep a record of the request and its validation according to your internal procedures.
Is a remote desktop more secure than VPN?
Not automatically. The level of protection depends on configuration, accessible resources, and account and device management. A remote office may be suitable if employees need to find a centralized working environment, while an VPN can meet internal network connection needs. Compare actual usage and verify that permissions are limited to what is necessary.
Does FADP apply to remote access of a Geneva SME?
The FADP concerns the processing of personal data in Switzerland, but the mere fact that access is remote does not make it possible to determine all the rules applicable to a situation. Examine the data involved, the roles of your company and the processing carried out. For a specific legal question, rely on official information or qualified counsel. Geneva LIPAD has a distinct field, linked in particular to public institutions and certain public tasks.
How to protect Swiss data when teams work remotely?
Start by identifying where the data is hosted, who can access it, and which services process it. Review these items for each application in use, including tools added by a team without central validation. Location in Switzerland can contribute to data sovereignty, but is not sufficient to establish the conformity of all processing. Document your choices and relate access to professional needs.
How often should remote access rights be reviewed?
Review them when changing roles, leaving, arriving or ending a service provider mandate, as well as after adding or replacing an application. Also plan a periodic review adapted to your resources and their sensitivity, without waiting for an incident to reveal forgotten access. This method is useful to SMEs in Geneva, Meyrin, Vernier, Eaux-Vives, Collogny, Grand-Lancy and Petit-Lancy, while remaining adaptable to each organization.
Article by
Delyan TZONEV
Passionate entrepreneur and manager, I am CEO of Flux Group and Hype Swiss. I support companies in their digital transformation thanks to innovative solutions in IT, telecommunications and software development. My goal is to design high-performance technologies that simplify the daily lives of businesses and support their growth.
Disclaimer
The articles published on the Flux Group blog aim to share our expertise, our field experience and best practices in IT, cybersecurity, cloud, telecommunications and digital transformation of SMEs.
We strive to provide reliable, up-to-date and relevant information at the time of publication. However, technologies, regulations and service offerings are evolving rapidly. The published content is therefore provided for informational purposes and does not constitute personalized, legal, tax, financial or technical advice.
Each company has specific needs, we recommend that you seek professional support before making a decision or implementing a solution presented in our articles.
The opinions, recommendations and comparisons published on this blog reflect our analysis and experience. When we talk about partners or publishers such as Microsoft, Swisscom or Infomaniak, our objective is to present the solutions objectively, highlighting their advantages as well as their limitations depending on the different contexts of use.
Flux Group cannot be held responsible for any direct or indirect consequences resulting from the use of the information published on this blog. Links to external sites are provided to complete the information; their content is the responsibility of their respective publishers.
© Flux Group – All rights reserved.
Our services
If you wish to be supported in the choice, deployment or optimization of your IT solutions, the Flux Group experts are at your disposal. We support SMEs in Geneva, Switzerland and Pays de Gex in their Microsoft 365, cybersecurity, cloud, telecommunications, managed IT services and IT infrastructure projects.
Questions fréquentes
What remote access should an SME identify?
Establish an inventory that covers employees, management and service providers. For each, note which cloud applications, servers, shared files, or desktops are accessible. Link each access to a role, a specific professional need and a person responsible for its validation. This overview helps identify forgotten accounts, temporary access that has become permanent and rights that no longer correspond to the functions.
Why does the Geneva context matter?
An SME can organize work between its offices, home and travel within the canton. The needs of a team based in Geneva are not necessarily those of a company in Meyrin, Vernier or Lancy: the applications used, the roles and the sensitivity of the data vary. The method must therefore start from your activities, rather than applying the same rule to everyone. The location and processing of data also deserve particular attention. The FADP constitutes the Swiss federal framework for the protection of personal data. LIPAD concerns in particular the Geneva public sector and private entities responsible for a public task. Their application depends on the context: avoid drawing a general legal conclusion from the place of connection alone. For your cloud services, identify where the data is hosted and what access is possible. This verification contributes to a coherent approach to the security and sovereignty of Swiss data. A remote connection is secured by verifying three elements, in this order: the identity of the person, the device used and the requested resource. Successful authentication alone should not open the entire information system. This logic makes it possible to grant access proportionate to the role and the task, then to re-evaluate it when needs evolve. Control must be adapted to the sensitivity of the resource. You can provide stricter checks for applications containing sensitive data than for common work tools. The NIST Guide to Telework and Remote Access Security provides helpful recommendations for structuring the protection of personal connections and devices. Prevention benefits from being supplemented by proactive monitoring, that is to say the continuous observation of systems to identify anomalies before they cause an interruption. For example, an unusual connection or an attempt to access a resource not normally used may warrant an audit. The objective is to detect deviations and be able to examine them, without confusing any atypical activity with a confirmed incident.
How to reduce the risks associated with user accounts?
Favor nominative accounts, rather than shared identifiers, in order to link each access to a person and a function. When changing roles or leaving, plan a step to review and withdraw rights that are no longer necessary. For an SME, this responsibility can be assigned to an internal manager, with a trace of requests and validations.
What role do Swiss devices and data play?
A personal device can be practical, but the company sometimes has less control over its configuration and use. Define which equipment can access sensitive resources and who is responsible for their management. For each cloud service, also identify where the data is hosted and what access is associated with it. These elements help integrate Swiss data sovereignty into your decisions, taking into account the applicable framework, including FADP. To structure these controls according to your uses and resources, Flux Group’s IT and cybersecurity expertise can support you. Talk to our team about securing your access. The choice depends first on the tasks to be accomplished and the location of resources. An VPN connects the user to the company network; a remote office gives access to a remotely hosted work environment; a cloud application can be accessed directly. These approaches do not cover the same scope and do not result in the same dependencies. To choose, consider the applications used, the internal resources required, and what needs to remain accessible if part of your infrastructure is unavailable.
When is an VPN or remote desktop relevant?
An VPN should be considered when a business process still uses a tool hosted on the company network, for example an internal application that is not otherwise accessible. We must then take into account the services that must communicate with each other: a connection to the network can provide access to several resources, depending on its configuration. The perimeter must therefore correspond to the need, rather than opening up the network as a whole for convenience. Remote office may be suitable if teams need a common environment to work with internal software. It centralizes the work environment, but its operation depends on the resources that host it and their accessibility. This option may also require adapted organization if employees use different tools or need local functions, such as printing.
When to prioritize targeted access to applications?
If a task relies on a specific cloud service, direct access to this application can avoid having to pass the user through the internal network. Evaluate the functions needed for each role and the business rules available in your environment. Microsoft Entra ID P1 can be taken into account in an Microsoft environment analysis, without assuming the functionalities actually configured in your SME. Securing remote access in Geneva is therefore not based on a single solution. Some SMEs may maintain VPN for internal resources and prioritize targeted access for cloud applications. Compare the operating constraints, the resources to maintain and the consequences of an interruption. The choice will be fairer if it follows the concrete needs of each activity rather than a general preference for a technology. To move forward without disrupting activities, organize the project as a series of documented decisions. Designate a person to coordinate validations, involve application managers and allow time to process team feedback. Securing remote access in Geneva must remain proportionate to the resources of your SME: start with the most sensitive uses, then extend the measures when their operation is understood.
How to carry out a useful inventory?
Centralize the results in a register accessible to those responsible, with an update date and a status for each point to be treated. Highlight accounts without an identified manager, authorizations inherited from old functions and access whose justification is uncertain. To prioritize, together consider the sensitivity of the data, the importance of the activity, and the ease of correcting the problem. Avoid modifying critical access without documenting dependencies, so as not to interrupt a business process.
How to deploy without blocking daily work?
Announce changes early and provide short instructions, with a point of contact for questions. During testing, collect feedback from users and support, then fix any issues before expanding. Also prepare a procedure in the event of an incident, for example the loss of a device or the suspicion of a compromised account: who receives the report, who decides on immediate measures and how to inform the people concerned?
What Swiss benchmarks should be included in the approach?
For personal data, examine the processing context with regard to FADP. The Geneva LIPAD falls under a different framework, particularly for public institutions and certain entities responsible for a public task. Do not infer a legal obligation from the mere presence of an employee in Geneva: check the texts and indications from the competent authorities depending on your organization. Also document the location of the data and the conditions of access to the services concerned. Hosting in Switzerland can contribute to data sovereignty, without alone demonstrating the conformity of all processing. Support in IT and cybersecurity can help to integrate these decisions into a coherent approach. Securing access is part of the overall functioning of your SME. The choices must correspond to the responsibilities of the teams, the tools used and the resources available to administer IT. Flux Group SARL, an independent company based in Geneva, combines the expertise of Flux ICT and Flux Defense to examine these dimensions in a coordinated manner. The objective is to clarify priorities and construct an appropriate approach, without unnecessarily burdening employees with their work.
What support for a business in Geneva and Switzerland?
Support can link infrastructure management to IT support and cybersecurity. Flux ICT provides knowledge of the company's IT environment, while Flux Defense helps examine protection issues. This complementarity helps match security decisions to operational constraints: teams must be able to use their tools, and those responsible must understand how access is managed. To prepare this analysis, it is useful to specify the internal roles: who knows the needs of the services, who administers the tools and who validates the decisions having an impact on employees? By bringing these perspectives together, you can distinguish priority actions from improvements that can wait, and then organize their implementation according to your SME's resources. Flux Group’s IT and cybersecurity services are part of this approach, with attention paid to the context of each company. This proximity concerns companies in Geneva, Meyrin, Vernier, Eaux-Vives, Collogny, Grand-Lancy and Petit-Lancy. Needs are not uniform from one organization to another: team structure, business tools and work habits influence choices. The support therefore aims to inform decisions and coordinate IT and cybersecurity, rather than applying an identical configuration to all SMEs.
How to prepare a first discussion on your access?
To make the discussion concrete, you can bring together a few benchmarks, without having to carry out a complete audit first. Describe the teams involved, the remote working situations and the applications essential to your activities. Also note planned changes, for example the adoption of a new tool, a reorganization or an evolution of IT responsibilities. Prepare, if you have them, the current access rules, the questions reported to support and the difficulties encountered by employees. Poorly functioning access, an unclear procedure or an authorization whose responsibility is difficult to establish are useful elements to examine. This will allow you to direct the discussion towards the points that matter most to your business. An appropriate approach begins by understanding your context. From there, priorities can be discussed methodically and taking into account the realities of your team. The next step does not necessarily involve transforming everything. Choose a concrete starting point: clarify who validates access, plan their review or document the procedure to follow in case of doubt. By assigning these responsibilities, you prevent the rules from depending solely on one person's memory or a one-off intervention. Securing remote access Geneva then becomes a followed practice, which evolves with the teams, tools and needs of the company. Also keep an operational objective: protect resources without unnecessarily complicating the work. Rules understood and applied are more useful than a system that is difficult to follow. An exchange adapted to your context can help you define realistic priorities and move forward methodically. With a progressive approach and clear responsibilities, your teams can work remotely with greater peace of mind, while your company maintains control of its access and data.
Is VPN enough to secure remote access for an SME?
No, an VPN alone does not protect all elements of a connection. It secures the passage to the network, but security also depends on the accounts, devices and rights configured. If an employee changes role, for example, their previous access must be re-examined even if they still use the same VPN. Also check that the rules match the resources that actually need to be accessible.
Is multi-factor authentication necessary for teleworking?
It is highly recommended for accounts used remotely, especially those that provide access to sensitive data or systems administration. It adds proof of identity to the password, but does not neutralize all risks. Also provide a clear procedure if a person loses their phone or can no longer validate their connection, in order to restore access without resorting to shared accounts.
How to secure remote access to an IT service provider?
Give the service provider a named account and limit their access to the systems necessary for the planned intervention. Define who authorizes the connection, what resources are affected, and how to end access when the work is complete. For example, an intervention on a server does not automatically justify access to human resources files. Keep a record of the request and its validation according to your internal procedures.
Is a remote desktop more secure than VPN?
Not automatically. The level of protection depends on configuration, accessible resources, and account and device management. A remote office may be suitable if employees need to find a centralized working environment, while an VPN can meet internal network connection needs. Compare actual usage and verify that permissions are limited to what is necessary.
Does FADP apply to remote access of a Geneva SME?
The FADP concerns the processing of personal data in Switzerland, but the mere fact that access is remote does not make it possible to determine all the rules applicable to a situation. Examine the data involved, the roles of your company and the processing carried out. For a specific legal question, rely on official information or qualified counsel. Geneva LIPAD has a distinct field, linked in particular to public institutions and certain public tasks.
How to protect Swiss data when teams work remotely?
Start by identifying where the data is hosted, who can access it, and which services process it. Review these items for each application in use, including tools added by a team without central validation. Location in Switzerland can contribute to data sovereignty, but is not sufficient to establish the conformity of all processing. Document your choices and relate access to professional needs.
How often should remote access rights be reviewed?
Review them when changing roles, leaving, arriving or ending a service provider mandate, as well as after adding or replacing an application. Also plan a periodic review adapted to your resources and their sensitivity, without waiting for an incident to reveal forgotten access. This method is useful to SMEs in Geneva, Meyrin, Vernier, Eaux-Vives, Collogny, Grand-Lancy and Petit-Lancy, while remaining adaptable to each organization.
Besoin d'un accompagnement IT à Genève ?
Parlons de votre infrastructure, de votre sécurité ou de votre téléphonie. Sans engagement.
Contacter Flux Group