Workstation

A workstation is a user-facing computer or virtual desktop used to access business systems, data, and applications. In information security, it is treated as an endpoint that must be inventoried, secured, monitored, updated, and governed throughout its lifecycle.

A workstation is primarily used by an individual user for daily work, while a server provides services or resources to other systems. Endpoint is a broader term that can include workstations, laptops, mobile devices, virtual desktops, and other user-accessible devices.

Workstations are important because they are common access points for users, credentials, files, applications, and organizational data. Strong workstation controls help reduce malware, unauthorized access, data exposure, and policy violations while supporting evidence for security and compliance standards.

Common workstation risks include missing patches, weak passwords, local administrator misuse, malware infection, phishing-related compromise, unencrypted storage, unauthorized software, insecure remote access, lost or stolen devices, and insufficient logging or monitoring.

Organizations should secure employee workstations by maintaining an accurate inventory, applying hardened configurations, enabling encryption, enforcing access controls, using endpoint protection, patching systems regularly, restricting unauthorized software, monitoring security events, and defining clear acceptable use expectations.

A workstation security policy should cover ownership, approved use, secure configuration, authentication, encryption, patching, endpoint protection, software installation, remote access, removable media, logging, incident reporting, physical protection, and procedures for onboarding, reassignment, and disposal.

Workstation controls support GRC by linking technical safeguards to governance expectations, risk management activities, and compliance evidence. They help demonstrate that devices accessing organizational systems are known, protected, reviewed, and maintained according to documented security requirements.

Typical Information Security & GRC requirements for workstations include asset inventory, secure baseline configuration, timely patching, access control, encryption, endpoint protection, monitoring, incident response procedures, user accountability, and documented evidence that controls are operating effectively.

Workstations should be patched on a risk-based schedule, with critical security updates applied as quickly as operationally feasible. Organizations commonly define patch timelines by severity, test updates where needed, and track completion to ensure devices remain protected.

Remote workstations should be managed with the same or stronger controls as office-based systems. This includes secure access, device health validation, encryption, patch management, endpoint protection, logging, data handling rules, and procedures for lost, stolen, or noncompliant devices.