Remote Access

Remote access is the process of connecting to a system or device from another location, whether on another desk in the same room or another asset located across the world. Remote connectivity enables people to work productively from anywhere by granting them access to company resources (e.g., files/storage, cloud infrastructure, data centers, operational technology, etc.).

Here are some examples of remote access within work environments:

• A user may work from home while connecting into their company’s network and resources.

• An IT technician might leverage remote support capabilities to install updates and troubleshoot problems on an end user’s computer. This enables them to service the device without needing to go to it in person.

• A supervisor may use remote access and controls to monitor and perform actions in an industrial or factory setting, without being on the location.

• An IT user could perform admin tasks on servers operating on-premises or in the cloud—regardless of where that user resides.

Remote access software enables telecommuting and remote work / work from a distant location. Various remote access technologies are used to enable the following use cases and more:

• User access to files, applications, networks, etc. that reside on remote assets

• Customer support for troubleshooting and fixing software and hardware issues

• IT troubleshooting and support (i.e. remote support) for corporate resources and devices (including unattended maintenance)

• Administration for servers, clouds, and data centers

• Vendor / contract support for various devices and systems

• Training use cases, such as sharing screens and helping users learn in real-time

• Industry-specific uses, such as remote access to medical devices at healthcare organizations or remote classroom support in the education sector

• OT/ICS management for maintaining industrial systems remotely

• Remote monitoring and management (RMM) for systems such as endpoints, servers, and IoT devices

• Break-glass access for emergency situations

Remote access technology confers significant benefits to businesses and users, including:

• Lowered costs and time: For instance, IT support technicians do not have to go on-site to fix a device, and employees do not have to be in the same location to collaborate, ultimately saving on travel costs and time. The ability to work remotely, such as from home, can also lead organizations to reduce their office footprints and, subsequently, achieve savings on rent and site maintenance.

• More flexibility for hybrid and remote workers: Employees who work from remote locations can still use company resources without needing to go in person to access various systems. Workers can also avoid time lost to commuting, which can be translated into increased productivity, well-being, and job satisfaction.

• Better scalability: Teams can continue to access company resources and move forward with business as usual, even as distributed systems, remote offices, and virtual infrastructure expand.

• Stronger collaboration: Teams that use remote access can better collaborate and communicate, such as through screen sharing, training, and other types of knowledge sharing, even if not located in the same geographic area.

• More rapid emergency responses: Remote access ensures that teams can respond quickly and help maintain business continuity in the face of emergency situations, such as natural disasters or power outages.

• Security and governance: When remote access controls follow industry best practices and documented policies for security, they can minimize risk and meet various compliance requirements.

Remote access connects to a system or device via technology such as a remote desktop protocol (RDP), Hypertext Transfer Protocol Secure (HTTPS), Secure Shell (SSH), or proprietary technology designed to mitigate risks. Connecting to the network in support of these protocols is often accomplished via the following technologies:

• VPNs (virtual private networks): An encrypted virtual ‘tunnel’ used to establish a digital connection between a device and a network.

• Proxy hosts: An intermediary server that can route traffic without exposing internal resources, which provides an added layer of security.

• Bastion hosts: A server that facilitates the connection between an external network and an internal/private network. It is sometimes known as a jump box.

• VDI hosts: A type of virtual machine that enables users to use virtual desktops with provisioned applications and files.

• Jump Clients: Agents that can be installed on devices to facilitate access to these devices when needed. Jump clients are particularly helpful for IT teams to facilitate unattended remote access.

• Jump Points: A system that can be installed on one machine within a remote network and then used as a relay to give other devices secure remote access.

These technologies rely on authentication and authorization processes to ensure the IT user / identity is who they claim to be and only has access to the appropriate resources.

Many organizations use specialized software to facilitate remote access sessions and promote work-from-anywhere collaboration between two or more remote parties, such as colleagues or an IT administrator and an end user. A few key features offered in remote access software include:

• Secure access, point-to-point

• Screen sharing / remote control for viewing and interacting with a desktop from a different location, for maintenance or other collaborative purposes

• File transfer for sharing files between computers remotely

• Security features, such as just-in-time access, encrypted tunneling, etc., to ensure remote access cannot be misused by bad actors

• Session monitoring, recording, and auditing to control and monitor session activity, share activities with another party for training or communication, and generate a comprehensive audit trail if needed.

• Integrations with other tools used across the organization, such as customer relationship management tools, collaboration tools, IT tools (e.g., ITSM), security tools (e.g., SIEM), and identity governance administration tools (e.g., Active Directory)

What Is Unattended Remote Access?

Unattended remote access / unattended remote support is when an admin or technician, such as at a service desk or help desk, accesses a device remotely without the end user present.

Although remote access can empower productivity and enable workforce flexibility, it can also open enterprises, and their users, up to risks. For instance, more than 50 percent of the ransomware incidents that Dragos responded to in 2024 involved some element of a remote service, such as a VPN appliance or remote desktop protocol (RDP) server being leveraged by adversaries.

A big part of this risk comes from enabling access outside the traditional network perimeter. Ultimately, remote access means that the ways in which people can access various business files, systems, etc., are no longer facilitated through clear-cut network perimeters. Instead, resources are accessible through an ever-changing number of virtual environments and connections, making it far more complex to defend.

Some significant security risks related to remote access include:

• Connectivity risks, as users might use a public network, a misconfigured VPN, or insecure protocols/ports to establish a remote connection. This could unintentionally expose the corporate network to unauthorized access, such as through an Adversary-in-the-Middle (AiTM) attack.

• An expanded attack surface, as more devices can connect to each other remotely and entry points grow in number.

• Malware and ransomware susceptibility, as attackers can use weak or compromised remote access pathways to install and execute malicious software.

• Credential theft, as attackers often use compromised remote access pathways to steal credentials and other valuable data.

• Third-party threats, such as supply chain attacks. Remote access often enables vendors and other external parties to connect to corporate devices and systems. This trust relationship can be misused in a supply chain attack, for instance. If remote access tools are not dedicated to an organization or the software is leaked, threat actors can co-opt legitimate tools to compromise an existing installation.

Gaining access to a system via remote access is often just the first step in an attack. The attacker can then misuse this level of access to move laterally, escalate privileges, and more.

What Is Secure Remote Access?

Secure remote access refers to the strategies and tools used to enable remote connectivity, but with a special emphasis on security. Today, this generally means leveraging a remote access security approach that is consistent with zero trust principles, or a zero trust network access (ZTNA) model. It means verifying every remote access session, not trusting by default, enforcing least privilege, implementing segmentation and microsegmentation, monitoring activity, and more.

Remote access security is imperative for privileged remote access use cases. When remote access is used to interact with sensitive resources or perform high-privilege activities, the connection should be robustly monitored and protected.

Vendor Privileged Access Management (VPAM) is the sub-discipline of secure remote access pertaining to the management and protection of how external vendors access various devices and systems.

Privileged remote access and VPAM best practices can include just-in-time (JIT) access for remote connections, session management for visibility and control over privileged sessions, etc. These methods ensure that all privileged remote access is appropriate and well-documented.