How do we detect misuse of our RMM tool in client networks?
Watch for remote sessions that do not match your technicians' work: unusual hours, unusual target machines, many machines in a short time, or sessions followed by new connections inside the client network. Start in the tool itself: enable its audit log, alert on new admin accounts and on scripts pushed to many devices, and review it weekly. Compare sessions with your ticket system. On the network side, a sensor in each client network sees what happens after a session starts: a host suddenly connecting to many others, scanning, or sending data out. NetSenX flags lateral movement and new sessions that do not fit a host's normal, on every plan, in each client's own tenant.
Read next
Related questions
- What should an MSP monitor to detect a compromise of its own tools?
- How can an MSP add night and weekend coverage for clients without hiring?
- What can an MSP promise clients about after-hours security monitoring?
- How should an MSP describe security monitoring in a contract without promising a SOC?
- Who is liable if a monitored client is breached?