Why remote access is a risk
A remote viewing or control program lets someone else operate your PC as if they were sitting at it. That is exactly what a vendor needs to help quickly. It is also exactly what an attacker wants. In practice, two things often go wrong.
The first is old access that was never cleaned up. A vendor installs a program that can connect without asking, so they can also work in the evening. Years later it is still there, with the same password, while nobody remembers who has access. If that password leaks at the vendor, your PC is open.
The second is the fake helpdesk. An employee first gets a flood of spam, then a call or Teams message from someone claiming to be from IT or from Microsoft. “I’ll fix it for you, could you install this program?” Within minutes the attacker controls the PC, with that employee’s rights.
Step 1: map what is running
Start with an honest overview. Check all PCs and servers for installed remote access programs. Think of AnyDesk, TeamViewer, Splashtop, RustDesk, ScreenConnect, VNC and Quick Assist, which comes with Windows. For each program, note who uses it, which devices it is on and whether it can connect without the user’s permission.
Programs nobody recognises often turn up. Do not treat that as a detail: an unknown remote program is something to investigate straight away.
Step 2: clean up and choose one route
Remove what is no longer needed. For the rest, the fewer different programs, the easier they are to monitor. Ideally, all remote support runs through one tool managed by your IT partner. Vendors who need to log in then get a temporary session through that route, instead of their own program on your PCs.
If a vendor can only work with their own tool, for example for a machine or till system, limit that program to that one device. And make sure it is not always open.
Step 3: agree terms with each vendor
Record per vendor how they connect. A few rules of thumb:
- Access only after an appointment or a ticket, not on the vendor’s own initiative.
- The employee gives permission per session and can see what happens.
- No shared accounts: each technician logs in under their own name, with two-step verification.
- A vendor gets access to Microsoft 365 only with the rights they really need, and never as a permanent administrator without reason.
- When the relationship ends, access is closed the same day, just like for an employee who leaves.
Also ask how the vendor secures their own access. They often have access to many customers at once, which makes them an attractive target.
Step 4: protect your staff from fake helpdesks
Technology helps, but the most important rule is simple: nobody installs a program because someone calls unexpectedly and asks them to. Agree how your real IT partner gets in touch, and that staff who are in doubt hang up and call back on the known number. Include this in your security awareness training.
You can also add technical barriers. Without local admin rights, an employee cannot simply install software. And if Quick Assist is not used, you can remove it from PCs through Intune.
What Floor ICT does
Floor ICT finds out which remote programs are on your PCs and servers, including forgotten ones, and agrees with you which can go. We route all remote support through one managed tool, with user permission per session and a log of who connected when. For each vendor we record how and when they get access, and we close access that is no longer needed. As your MSP, we keep that overview up to date. Which vendor gets access, and to which system, remains your decision.