The Tool That Fixes Can Also Break
An RMM is remote code execution with high privilege across many organisations. What follows from stating it plainly.
Security
Securing the tool
An internal compromise affects one organisation. A provider compromise affects everybody they serve.
7 notes
Securing the RMM Itself
The controls that belong on the console, in rough order of value, most of which cost configuration rather than money.
Credential Handling Inside the Platform
Service providers hold the keys to many organisations. Where those keys sit, and the practices that make the holding defensible.
Supply Chain: Your Vendor Is Your Exposure
A compromise at the platform vendor reaches every customer at once. What that means for selection, and what you can actually control.
Separating Monitoring From Administration
Watching and changing are different activities with different risk. Most deployments grant both to everybody.
Detecting Misuse of Your Own Tool
Whether the misuse comes from an attacker with stolen access or from inside, the signals are the same. What to watch.
What To Do If the Platform Is Compromised
The plan worth having before it is needed, because the first hours determine how far it reaches.