Your provider´s remote tool is your front door
Sep 19th, 2019 by Jesper Kråkhede
On the 16th of August 22 local governments in Texas were hit by ransomware on the same day. The common thread was not a clever zero-day. They shared the same IT service provider and the attackers came in through the provider´s remote management tool.
Think about what such a tool is. Something that can logon to all your servers, run scripts and install software, managed from outside your network by people you have never met. If you were designing an attack you couldn´t ask for a better starting point.
What to do technically? Find out which remote tools your providers actually use. You will be surprised how many there are. Require that the management server is hardened and patched, and not something sitting on internet with just a password in front of it. Require a second factor for every logon. Make sure the provider´s accounts are personal, not shared, and that they only have access to the systems they actually manage. Log every session and send those logs to your own SOC, not only the provider´s.
And test it. Ask the provider to show you what happens when one of their technicians´ accounts is stolen. If the answer is that the attacker gets access to all their customers at once, you have a problem.
The front door is only as strong as the weakest key holder.