What happens if our outsourced IT provider or bookkeeper is hacked?
Their access becomes the attacker's access. An IT provider usually holds admin rights to your servers, remote-management tools on every PC and passwords to your cloud accounts; a bookkeeper may have remote access to the finance PCs and your banking portal. Attackers know this, and some large incidents have spread from one service provider to many of its customers. Prepare before it happens: list every supplier with access and what they can reach, require named accounts with multi-factor authentication, limit their tools to the systems they support, ask how they protect their own environment and how they will tell you about an incident, and write those duties into the contract, which NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. also expects as part of supply-chain security. Agree how you would cut their access in an emergency. NetSenX shows the supplier's connections into your network and flags lateral movement, scanning, beaconing and unusual outbound volume from the hosts they use, on every plan. It does not monitor the supplier's own systems.
Read next
Related questions
- How do I find old remote-access tools that suppliers left on our servers?
- How do we control and monitor third-party vendor access to our network?
- What does NIS2 supply-chain security mean in practice for a small company?
- How would we notice that a former employee's device is still connecting?
- How can we tell if a stolen password is being used?
Terms used here
- NIS2 (the EU's second Network and Information Security directive)
- The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies.
← All 45 questions on Zero trust, identity and segmentationAll topics