Vendor remote access

Somebody outside connecting to something inside

Equipment vendors support their machines remotely, software suppliers diagnose faults, and integrators configure things without travelling. It is efficient and it is a path into the environment from outside it.

The blog entry on contractors covers the relationship. This is about the technical arrangement.

Five properties

Initiated by you. The vendor requests, you enable. A connection the vendor can open at will is not a controlled session.

Through one route. A single defined path rather than a tool per vendor, each installed by whoever needed it that week.

Authenticated individually. A named account per engineer, not a shared vendor login.

Observed or recorded. Somebody watching, or a session record. For high-consequence systems, both.

Time-limited and closed. Automatically, rather than by somebody remembering.

Every vendor brings their own

Most environments accumulate several remote access tools, each installed for one supplier, each with its own accounts and its own update cycle, and none of them owned by anybody.

Inventorying them is a morning and usually finds one nobody knew was running. Consolidating onto a single route is a project and is worth it, because it converts an unknown number of paths into one that can be watched.

The always-on link to a machine

Some equipment vendors expect a permanent connection for monitoring. That is a legitimate business arrangement and it is a permanent path that has to be treated as one: segmented, logged, and covered by contract terms.

Where the machine handles covered information and the vendor cannot accept those terms, the choice is between the monitoring service and the requirement, which is a decision to take deliberately rather than by default.

The three in the morning problem

A machine is down, the engineer is available, and the person who enables access is asleep. Every organisation solves this somehow, and the usual solution is a standing credential that defeats the arrangement.

The better answer is a rota: two or three people who can enable a session out of hours, with the request and the approval recorded even if the approval is a text message. Slower than a permanent credential and considerably faster than the incident it prevents.

Monthly, ten minutes

What is currently open, what was opened this month, and who approved each. The review reliably finds something left open, which is the commonest finding in this area and the easiest to prevent.

What to be able to show

The list of vendors with access. The route each uses. The named accounts. The approval records. And the monthly review, dated.

That set answers most of what an assessor will ask about external access, and assembling it after the fact is considerably harder than keeping it.

Vendor accounts outlive vendor relationships

A supplier changes, a contract ends, an engineer moves on, and the account remains because nobody was told to remove it.

Tie vendor account removal to the contract end date in whatever system tracks contracts, rather than to somebody remembering, and the class of problem largely disappears.

Access to their machine, not to your network

A vendor supporting one machine needs to reach that machine. Access arrangements that place them on the production network generally, for convenience, grant considerably more than the support requires.

Scoping it costs configuration time once and is the difference between a bounded arrangement and an unbounded one.

Proportionate, and tell them

Session recording for access to systems handling covered information is reasonable and should be stated in the contract and to the engineer at the start of the session.

The blog entry on what staff are told applies here too: announced is both lawful in more places and more effective than the alternative.

Use it yourself once a quarter

Request access through your own process as a vendor would and see how long it takes and what it grants. The exercise finds the standing credential somebody created to make it faster.

Elsewhere in the shop floor

• What the three levels are, and which appliesThe level is set by your contract, not by your size. Most suppliers handling controlled unclassified information are at the second.
• Reading the clause that binds youReading the clause that binds you. What the requirement says, what it means in practice, and what an assessor will ask.
• Which systems are in scopeWhich systems are in scope. What the requirement says, what it means in practice, and what an assessor will ask.
• Self-assessment, and why the scores driftedSelf-assessment, and why the scores drifted. What the requirement says, what it means in practice, and what an assessor will ask.
• Who assesses you, and how each kind worksWho assesses you, and how each kind works. What the requirement says, what it means in practice, and what an assessor will ask.
• What the standard does not requireWhat the standard does not require. What the requirement says, what it means in practice, and what an assessor will ask.
• Machines older than the requirementsA control written for a server, applied to a lathe with a shared login, a decade-old operating system and a USB port.
• Drawings, job packets and paperDrawings, job packets and paper. What the requirement says, what it means in practice, and what an assessor will ask.
• Removable media, and why bans failRemovable media, and why bans fail. What the requirement says, what it means in practice, and what an assessor will ask.
• Technical data packages and what they containTechnical data packages and what they contain. What the requirement says, what it means in practice, and what an assessor will ask.
• Segmentation, and what it does not solveSegmentation, and what it does not solve. What the requirement says, what it means in practice, and what an assessor will ask.
• What insider risk actually coversWhat insider risk actually covers. What the requirement says, what it means in practice, and what an assessor will ask.
• What detection can and cannot establishWhat detection can and cannot establish. What the requirement says, what it means in practice, and what an assessor will ask.
• Monitoring, and where the law constrains itMonitoring, and where the law constrains it. What the requirement says, what it means in practice, and what an assessor will ask.
• The fortnight around a departureThe fortnight around a departure. What the requirement says, what it means in practice, and what an assessor will ask.
• Privileged access, and who reviews itPrivileged access, and who reviews it. What the requirement says, what it means in practice, and what an assessor will ask.
• False positives, and what they costFalse positives, and what they cost. What the requirement says, what it means in practice, and what an assessor will ask.
• The documents an assessor reads firstThe documents an assessor reads first. What the requirement says, what it means in practice, and what an assessor will ask.
• What counts as evidenceWhat counts as evidence. What the requirement says, what it means in practice, and what an assessor will ask.
• The findings that recurThe findings that recur. What the requirement says, what it means in practice, and what an assessor will ask.
• Plans of action, and their limitsPlans of action, and their limits. What the requirement says, what it means in practice, and what an assessor will ask.
• What the assessment week is likeWhat the assessment week is like. What the requirement says, what it means in practice, and what an assessor will ask.
• The certificate, and what it coversThe certificate, and what it covers. What the requirement says, what it means in practice, and what an assessor will ask.