Security · Zero Trust & Secure Architecture · 05
Secure remote access
Secure remote access designs and verifies how staff, administrators, partners and vendors reach the environment from outside it: VPN, zero-trust network access, remote desktop gateways, cloud application access and the third-party connections that support often leave open. It is needed when remote access was expanded quickly and never hardened, when vendors have standing access nobody reviews, when an insurer or customer asks how remote access is controlled, or when an incident entered through an exposed remote service. The work produces an inventory of every remote path and who uses it, a target design that applies strong authentication, device checks and least privilege to each, the retirement of paths that should not exist, and the monitoring that shows remote access being used as intended.
Scope
What the review covers.
- Inventory of remote access paths: VPN, gateways, exposed services, vendor connections
- Authentication, device posture and authorization on each path
- Vendor and partner access: scope, duration, monitoring, review
- Exposed service review and attack surface reduction
- Target design and migration, including zero-trust network access where appropriate
- Logging, monitoring and periodic review
Deliverables
What you receive.
| Deliverable | Form |
|---|---|
| Remote access inventory | Every path, its users and its controls |
| Target design | Controls per path and the paths to retire |
| Vendor access procedure | Request, scope, duration, review |
| Verification and monitoring plan | Evidence that access is controlled |
Prerequisites
What we need from you.
- Access to firewalls, gateways, identity provider and cloud consoles
- The list of vendors and partners with remote access
- External attack surface scan results, or agreement to perform one
Related
Where this sits.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days
Questions
Asked before engaging.
Do we have to replace our VPN?
Not necessarily. A VPN with strong authentication, device checks and tight authorization can be the right answer. The design follows the risk, not the fashion.
How do you handle vendor access?
Scoped, time-limited, authenticated and reviewed. Standing vendor access without an owner is a finding.
What about exposed remote desktop?
It is one of the most common entry points in ransomware incidents. The inventory finds it; the design removes or protects it.