How do you protect your personal data when working remotely as a technical support professional?

For complete protection, I would recommend using a virtual machine on a personal computer to eliminate any possibility of an operating system failure.

Though VPN can certainly be a great option if that is set up with the company that you work for other services like Cloudflare can work in a cloud based environment. I would not suggest using a 3rd party VPN unless vetted by the IT department that you have.

VPN tends to slow down your network connection. However, there are solutions like WireGuard that provide one of the highest speed and safety levels in the VPN world. Make sure to only use VPN approved by your InfoSec/IT Ops team. If you have troubles configuring it, don't follow random suggestions on Google, better reach out to your company's IT guys for help. More cutting-edge VPN alternative would be working within tunnels like Cloudflare Argo included into their Zero Trust feature. Tunnel daemon opens outbound-connections only and doesn't require opening any inbound ports.

Always staying up to date is critical as this can help prevent zero days and keep the hardware functioning as intended. Keep in mind that it can also cause issues as well and best to be prepared to fix or roll back non security updates if you have problems.

Use only safe sources for your software updates, like Apple App Store, Microsoft Store, Google Play Store, official vendor's website, etc. Consult with your IT Ops / InfoSec team if unsure. Also, when you receive an update notification for your operating system, don't rush installing it. Better wait at least 2 weeks to avoid bumping into unexpected bugs that could appear post the update.

I agree that MFA or 2FA are good options and a password manager like 1password are essential but even better is a password less environment when available.

On top of strong passwords and MFA/2FA, ideally you would use passwordless authentication like SSO and physical devices like YubiKey for authentication. Moreover, physical keys haven't been compromised yet, thus provide exceptional security for your accounts. Important to note that no authentication method is 100% secure as long as malicious actors can get access to your browser session cookies that store your login information for all services where you are logged in. It's safer to log out of each website or SaaS service after you have finished working with it. Avoid downloading and opening suspicious files from unknown senders in the first place! If you've downloaded it already, scan it with antivirus and services like VirusTotal.

BitLocker is a powerful tool to allows a Windows environment to encrypt hard drives on the endpoint layer. Within our department and our company, we use BitLocker to encrypt hard drives on our endpoints, because it is easier to support with our desktop team and the implementation is much simpler - most tasks can be ran on Task Scheduler and command lines and PowerShell scripts. Actually we stepped away from pgp products such as Symantec Desktop Encryption because it is not a perfect assimilation with AD managed Windows accounts - oftentimes when users sign in with a new Windows password, the PGP SSO fails to cache users' new password - causing end user issues and amassing extra incident tickets in our team SLAs.

As a bare minimum, always make sure you're using a website or services with HTTPS protocol with a padlock icon next to the web address. Meaning, the data you send and receive is encrypted. It is a must to use the default hard drive encryption feature of your operating system. Otherwise, if your device ever gets stolen someone may easily read the files that may contain sensitive data.

Staying up to date with attack types can be super helpful in the remote environment. Always updating your training and phishing tests can help you stay up to date.

I completely agree with this sentiment. As an IT professional, we should be constantly educating ourselves on the latest trends and best practices. Good security starts with being informed.

Having a dedicated VM in the cloud for each client is the best route. At a cost of 40$ per month, you can have a cloud VM that works with only one client and limits the surface area of an attack to that one client and VM. You do not have to worry about other clients' data or even your own data being exposed while using that VM for your admin tasks. It also allows for the VM to be extremely locked down as it doesn't need to do everything it just needs to be able to support the one customer.