Can you be an admin from a beach?
Jun 20th, 2023 by Jesper Kråkhede
After my vacation, a question I have thought about: Can you be an administrator remotely, safely? From home, from a hotel, from a beach in the Maldives?
Technically, yes. But look at all the hoops that are needed to do it securely. A dedicated admin device that travels with you and is protected even on a hotel network. Strong authentication that works without your desk phone. A way to reach the management interfaces, through a VPN, a gateway or a PAM, each with its own login. Just in time activation of the admin role, and someone available to approve it. And all of it has to work over a slow connection from the other side of the world.
Each of those steps costs money to buy and people to run. And each one adds time for the admin. In a small organisation with limited resources, the temptation is to skip a few. Use the normal laptop. Leave the remote desktop port open. Keep the admin role permanently active, ‘just for the vacation’.
That is where attackers get in.
So for management: if you expect your admins to be reachable when they travel, and many organisations do, you need to pay for doing it right. Otherwise, accept that some things will have to wait until they are back.
Being reachable is a cost. Being reachable insecurely is a much bigger one.