Skip to content
3rd Element Consulting

Resource

How We Protect Our Own Access to Your Environment

Your IT provider has administrative access to nearly everything you run. That makes the provider's own security part of yours. Before you ask how a provider will secure your environment, ask how it secures its own access to it.

Dawn SizerDawn Sizer · CEO and Co-Founder, 3rd Element Consulting ·
Schedule an IT Environment Review

Why this matters

An IT provider manages many businesses through the same set of tools and accounts. That's what makes managed IT efficient, and it's also what makes a provider a target. The remote management tools IT providers use have been used by attackers to reach many client businesses at once. A provider whose own access is weak isn't one weak link. It's a weak link attached to every client it serves.

How we do it

  • MFA on everything. Every account our team uses, including the tools we use to reach client environments, requires multi-factor authentication. No exceptions.
  • We never subcontract our help desk. Every call and support request is handled by 3rd Element staff, not a third-party or white-label help desk. The only outside party with any access is our security monitoring partner, and its role is limited to detecting and responding to threats.
  • Access only from our own devices. Our team works only from company-managed devices. Getting into our management tools takes both an authorized user and an authorized device, so a stolen password on its own gets nowhere.
  • When someone leaves, their access leaves with them. Their device is removed and their access is shut off, so there's no path back into our controls. Because access requires both the user and the device, taking either away closes the door.
  • A CJIS cleared team. Every member of our staff is CJIS cleared.

Questions to ask any IT provider

  • Is MFA required on every account your team uses to reach our systems, including your remote management tools?
  • Who actually answers our calls: your own staff, or a subcontracted or white-label help desk?
  • Can your technicians reach our environment from personal devices?
  • What happens to a technician's access on the day they leave?
  • Are your staff background checked?
  • If your company were compromised, what stops an attacker from reaching us?

A provider that takes this seriously can answer every one of these specifically. If the answers are vague, that tells you something too.

Common questions

Questions leadership usually asks first.

Can an IT provider be a security risk to our business?
Yes. A provider has administrative access to your systems, often through tools that manage many clients at once. That's why the provider's own security practices matter as much as the ones it puts in place for you.
Why does a subcontracted help desk matter for security?
Every outside team that can reach your environment is another set of people, devices, and accounts you have to trust. Many IT providers route first-contact support to a third-party help desk that serves many clients at once. We don't. Every call and support request is handled by our own staff. The only outside party with any access is our security monitoring partner, and its role is limited to detecting and responding to threats.
What are remote management tools?
Software IT providers use to monitor, update, and support many computers and systems from one place. They're essential to managed IT, and they need to be protected like the keys they are.
What should happen to a technician's access when they leave an IT provider?
It should end the same day. At 3rd Element, a departing staff member's device is removed and their access is shut off, and because access requires both the user and the device, there's no way back in.
Should our IT provider's staff be background checked?
We think so. Every member of our staff is CJIS cleared.
Why do we get a different technician every time we call?
Usually because first-contact support is handled by a large or subcontracted help desk where nobody owns your account. When the same team supports your environment every day, the person you reach already knows it. You never get a level one.

Continue reading

Related work and reading.

Standards and Security Baseline

The written baseline used across every supported environment.

Read more: Standards and Security Baseline

Cybersecurity Services

Security built into how IT is managed every day.

Read more: Cybersecurity Services

IT Provider Vetting Checklist

The questions to ask before signing with an IT provider.

Read more: IT Provider Vetting Checklist

What Happens When Your MSP Gets Acquired

What to check when ownership and support begin to change.

Read more: What Happens When Your MSP Gets Acquired

Next step

Get a clearer view of your IT environment.

Want to ask us these questions directly? Schedule an IT Environment Review.

Schedule an IT Environment Review