itestro - Fotolia
Bolster remote IT management with these security tips
The remote management of IT systems has become essential -- but admins need to uphold that responsibility in a way that doesn't compromise security.
Systems administrators have always benefited from remote IT management -- a capability that has become especially essential with the rise of public cloud. Now, with the COVID-19 pandemic, remote management has gone from a nice-to-have feature to a necessity, even for on-premises IT environments.
But not all remote access practices and tools are equal -- and some even pose an IT security risk. To remotely manage IT infrastructure and resources in a secure way, implement multifactor authentication (MFA), encryption and sandboxing. In addition, manage access controls to ensure IT staff members can only access the systems they need to perform their jobs.
The security challenge with remote access
Typically, admins access IT systems from a controlled environment, such as from within an office on a known and trusted network. But when IT staff works from home, access occurs with uncontrolled devices on uncontrolled networks. These devices have a higher chance of theft than a device secured in an office building, and can open the door to man-in-the-middle and other hijacking attacks unless proper measures are taken.
Many administrators prefer to use command-line interfaces or remote access software, such as virtual network computing run via simple connections like secure shell, but this is inadvisable. Even when this software uses secure connections, it can be problematic.
These approaches, for example, are uncontrolled, as an authorized user has free reign of the environment after passing the simple challenge-response security model on the perimeter. Any malicious user who manages to bypass the perimeter has full, privileged access to the system. What's more, there is no mechanism in place to track activity or changes, which can create problems during rollback or issue remediation, in the event an activity breaks something. When working remotely, IT administrators must be identifiable separately to ensure accountability for changes. Do not share credentials on any system.
OS-specific remote access tools, such as Microsoft Remote Server Administration Tools, are a secure means to access a server, but tend to present the same issues outlined above. Additionally, such tools are not platform-agnostic; they focus on one environment and fail to provide adequate support in others.
Multifactor authentication is important for any remote access capability. Examples of authentication factors include tokens, biometrics and mobile phone-based pings. MFA provides an extra layer of verification for the entity attempting access.
Control access based on IT roles
To securely enable remote access, consider the specific roles of IT staff.
A database administrator, for example, does not require -- and should not be granted -- the capability to adjust hardware settings. A developer should not have access or be able to modify the operations environment. It is a question of the right tool for the job: Each staff member should only be allowed to access the IT resources or environments for which they have responsibility.
To do this, IT needs granular tools, or a set of tools, to manage the various profiles and needs of the administrators involved. Many systems management tools only have a single administrator type, so all admins have the same level of privilege. This arrangement can pose both security and clarity issues, and make it necessary to implement application- and service-specific tools across many areas, such as database administration and Active Directory.
Encryption and other best practices
When using a client-server remote IT management system, ensure that it encrypts all data exchanged between the client and server. Do not make data accessible to anyone who taps into the data stream. For web-based remote access systems, again, ensure that data is encrypted. Mandated HTTPS transport is also a good place to start, as well as the prevention of unsecured HTTP transports. Where possible, use point-to-point VPNs for an extra security layer.
When the accessing device is unknown, a remote IT management platform must -- at minimum -- scan the device for any problems before acceptance to the network. The connection is sandboxed until this check is completed successfully. Use device sandboxing for a nonpersistent connection, as well. Create a virtual environment dedicated to the remote connection, and ensure that connection is the only activity that occurs within the environment. Once the remote access session is completed, erase the virtual environment. This prevents any potential malware on the access device from spreading into the organization. This model also ensures that no data remains on the device for malicious attackers to access.
IT organizations must build up an overall remote access platform or process based on their diverse needs. Some IT systems management vendors, such as SolarWinds, ManageEngine and HashiCorp, provide tool sets that IT can integrate and manage remotely through a dashboard. However, as mentioned above, there is still room for improvement, particularly around managing administrator privileges at a granular level, and ensuring each administrator can only access and manage the resources directly relevant to their role.
