Vendors sometimes need remote access to diagnose equipment, update systems, or support specialized applications.
The common mistake is converting that temporary need into a permanent tunnel with broad reach. Months later, the account remains active, the original technician has changed, and nobody remembers which systems depend on it.
Vendor access should expire by design.
Use Named Identities
Give each external person an attributable identity.
Require multifactor authentication and avoid shared vendor accounts. Confirm the employer, assignment, approver, support case, and contact path. Review identity when the vendor changes staff or subcontractors.
The vendor organization is not a single identity.
Scope The Session
Limit access to the specific system, protocol, location, and time needed for the work.
Use controlled gateways or jump hosts rather than broad network VPN access. Separate observation from configuration. Block unrelated east-west movement and sensitive data paths. Require a new approval when the scope changes.
Temporary work should not create permanent network adjacency.
Observe Privileged Work
Record authentication, session start and end, target systems, file transfer, commands or administrative actions where appropriate, and changes made.
Notify an internal owner when access begins. For high-risk work, require active supervision or dual approval. Protect logs from the system being serviced.
Monitoring should support accountability without collecting unrelated activity.
Close The Access
End the session, disable the account or entitlement, remove temporary firewall rules, revoke issued credentials, and confirm the system state. Attach the change record and validation evidence to the support case.
Periodically search for vendor access that no longer has an active owner or contract.
Run The Defense Test
Identify the external person and internal sponsor being trusted. Define how access starts and automatically ends. Restrict reach to contain compromise. Preserve session evidence. Maintain a safe recovery path if vendor changes need rollback.
Trust the approved task, not an indefinite connection.