It’s natural for IT workers to first ensure that frontline and supporting workers in an organization have a secure and productive way of performing their usual tasks remotely. After all, a reduction in the business’ ability to provide its products and services correlates pretty quickly to a drop in revenue, cashflow and profitability. Without this financial sustainability, the IT department has no organization to support.
But if your IT Pros are also working remotely, what additional considerations and tools are available that are relevant to them?
1. Secure administrative accounts
This is security basic applies no matter where you are working from. IT Pros often use accounts with a high level of access, necessary to perform their tasks. Consider making these accounts separate from the logins they use to do regular work, that doesn’t require administrative privileges. This helps to protect those privileged accounts from being used by malware which acts as the current user, helping to minimize the impact of such an attack. It’s also vital that administrative accounts for Cloud services at least use a form of multi-factor authentication, and ideally are protected by conditional access scenarios. Conditional access helps to identify and block risky log-in events as they occur.
See How it works: Azure Multi-Factor Authentication
Learn about Conditional Access
2. Restrict administrative access
Instead of an administrative account having privileged access to a system all the time, there are a few methods for turning this on only when needed.
With a Virtual Machine in Azure, just-in-time access can be used to block network ports used for management tasks (such as RDP and SSH) until access is requested and approved. Learn more at Secure your management ports with just-in-time access.
Azure Managed Applications also have a just-in-time access capability. Learn more at Request just in time access.
Privileged Identity Management allows time-based privileged access to resources and to Azure Active Directory. It also includes tracking justification for that access, notifications when activated and an audit history. For PIM options applicable to Azure, Azure AD, Office 365 and SaaS applications, see What is Azure AD Privileged Identity Management.
And for Windows Server, there are several options for securing privileged access, including just-in-time local administrator account passwords and privileged access workstations. For scenarios and guidance, visit Securing Privileged Access and also check out Just Enough Administration for PowerShell.
3. Secure scripts and secrets
Many modern administration tasks are done at scale with code-based commands, whether that’s a PowerShell script or an Azure Resource Manager Template. As IT Pros use code-based tools like Visual Studio Code, be intentional about storing scripts in a location that both facilitates use across a remote IT worker team and keeps those scripts secure. This could even be a private GitHub repository, with GitHub accounts secured by MFA.
Also, check your code (manually or programmatically) to ensure it does not contain environmental secrets such as log in credentials. Supply these as a variable when the code is run, or use a solution like Azure Key Vault for secure storage of secrets that can be referenced in your scripts. Learn more at Azure Key Vault concepts.
4. Use Windows Admin Center
Windows Admin Center is a locally deployed, browser based administration tool for the management of both on-premises and Azure Windows Server machines (physical or virtual). It uses the Windows Admin Center gateway and requires no agent to be deployed on the target server. This tool is preferable to the historic method of using an RDP session to connect to and manage a Server, and it includes role-based access control and activity logging. For more details, visit What is Windows Admin Center?
5. Use Azure Bastion
Both RDP and SSH are important remote connectivity protocols, but they’re also highly targeted by malicious attacks. In Azure, there’s an easy to use Bastion host service that provides connectivity to your Azure virtual machines via the Azure Portal, without the need for the RDP or SSH ports to be exposed to the Internet. In fact, the destination server does not even need a public IP address. Learn more at What is Azure Bastion?
Conclusion
With their high levels of access to critical systems and data, secure work methods and tools are important for IT Pros, regardless of where they are working from. It is possible to provide both an increased level of security and the access and productivity that your IT workers need. Investing the time to review this now will help to protect your organization from future malicious access attempts.
