Can an attacker pivot from a client network into the MSP's tools?
Yes, and attackers look for exactly that, because a remote management or remote access tool reaches every client at once. Protect those tools like crown jewels: multi-factor authentication, separate admin accounts per technician, restricted source addresses, logging of every session, and prompt updates of the tool itself. Review which clients each account can reach, and remove access that is no longer needed. On the network side, NetSenX flags unusual sessions and lateral movement inside each monitored client network, including sessions that start from the host running your remote-management agent at odd hours. Each client is a separate tenant, so their data stays apart.
Read next
Related questions
- How do we detect misuse of our RMM tool in client networks?
- What should an MSP monitor to detect a compromise of its own tools?
- How can an MSP add night and weekend coverage for clients without hiring?
- What can an MSP promise clients about after-hours security monitoring?
- How should an MSP describe security monitoring in a contract without promising a SOC?