How do we monitor an external accountant's remote access to our PCs?
Make the access narrow and visible first, then watch it. Agree in writing which PCs the accountants may reach, through which tool, at which times and with which accounts, ideally a named account per person with multi-factor authentication. Prefer a remote-access tool you control, with session logging, over one the accountant installed; enable it for the month-end window and switch it off afterwards. Keep the finance PCs on a segment that cannot reach the rest of the network. Ask the firm how it protects its own systems, because their compromise becomes yours. Then watch the pattern: the remote sessions appear on the network as connections from an outside address to specific internal hosts at specific times. NetSenX shows those connections and, if a session starts reaching other internal hosts, flags lateral movement, on every plan; a remote tool's regular check-ins outside the agreed window show up as beaconing. NetSenX does not manage who has access.
Read next
Related questions
- What happens if our outsourced IT provider or bookkeeper is hacked?
- How do I find old remote-access tools that suppliers left on our servers?
- How do we control and monitor third-party vendor access to our network?
- What does NIS2 supply-chain security mean in practice for a small company?
- How would we notice that a former employee's device is still connecting?
← All 45 questions on Zero trust, identity and segmentationAll topics