Remote Access to a Computer: How to Work Safely on Your Office PC from Home, Which Methods Exist and Why a Port Open to the Internet Is an Invitation to Hackers

An accountant needs to finish a report from home, but the 1C database is on the office computer. A manager on a business trip wants to open a document stored on the server. A son living abroad wants to help his parents in Tbilisi with their laptop. All these cases call for remote access — the ability to see the screen and control a computer over the internet. Technically it's not difficult, but carelessly configured remote access has become one of the main doors for intruders and ransomware. Let's look at the methods available and how to use them safely.

The main remote access methods

• Remote control apps. Popular applications show a computer's screen on another device via the developer's server. They're easy to install and work even when the computer has no public address. They suit one-off help and a small number of machines.
• Remote desktop over VPN. An employee first connects to a secure tunnel into the office network, then to their work computer using Windows' built-in tools. This is the reliable option for offices: the computers aren't visible from the internet.
• A terminal server or the cloud. When several people work remotely, it's often easier for them to connect to one server or cloud service rather than to their own office PCs.
• Cloud file storage. If you only need access to documents rather than the whole computer, it's simpler to sync the relevant folders through the cloud with the right access rights.

The main mistake — an open port

The most dangerous "quick" method is forwarding the remote desktop port on the router straight to the internet. Within hours, the computer starts being attacked by automated programs that guess passwords across the whole internet around the clock. If the password is weak or the account doesn't lock after failed attempts, it will be guessed sooner or later. The attacker then disables the antivirus, encrypts every file, including 1C databases and network folders, and demands a ransom. We see exactly this scenario regularly in small offices. The rule is simple: remote access services must not be reachable directly from the internet — only through a VPN or a trusted service with two-factor protection.

"Tech support" scammers

A separate danger is calls and messages from people posing as staff from a bank, the provider, Microsoft or a security service. They persuade you to install a remote access program and read out a code, after which they have full control of the computer, log in to online banking and transfer money. Real banks and companies never ask you to install a remote control program over the phone. Elderly relatives are a frequent target, so it's especially important to explain this rule to them and, if needed, set up access so only a trusted family member can connect.

How to make remote access safe

• A VPN for the office instead of open ports; access via personal accounts, not a shared password.
• Two-factor authentication in remote control apps and on the VPN.
• Long, unique passwords and lockout after several failed sign-in attempts.
• An allow list — only specific accounts or devices can connect.
• Updates for the operating system, remote access software and router firmware.
• Sign-in logs — periodically checking who connected and when.
• Backups stored separately: if something goes wrong, the data can be restored.

Technical details

For remote desktop to work, the computer must be on and not go to sleep — this is configured in the power settings or with wake-on-LAN. Internet speed at the office end affects comfort: upload speed needs to be adequate. If the provider hands out an address behind shared NAT, as mobile operators often do, incoming VPN connections won't work and another option is needed — a static address from the provider or a cloud service. For 1C, it's important that the database isn't opened directly over the network through the internet, but that work goes through remote desktop or publishing.

What our technician does

1. Finds out what's needed: who has to connect, to what, from where, and how many users.
2. Checks the current router and computer setup and closes dangerous open ports.
3. Sets up a VPN or a suitable remote access program with two-factor protection.
4. Creates personal accounts and configures passwords, lockouts, power settings and backups.
5. Shows users how to connect and explains how to recognise scammers.

A real example

A small accounting firm in Vake decided to give an employee on holiday access to the office computer and opened the remote desktop port on the router. Three weeks later every file on the computer and on the network drive was encrypted, with a ransom demand on the screen. Fortunately the firm had an old copy of the database, and some of the data could be recovered. After the recovery, our technician closed all forwarded ports and set up a VPN with personal accounts and two-factor protection, daily backups to a separate drive and to the cloud, and lockout against password guessing. Staff now work from home without the risk of it happening again.

Call a technician

If you need remote access to office or home computers, or aren't sure your current setup is safe, we'll come to any district of Tbilisi around the clock. Learn more on our computer setup, local network setup and virus removal pages.