1

My tech support company now has access to my computer 24/7... instead of our old system where I would email them, set an appointment, and then I would grant them permission to access my computer. A pop-up does appear when they are on screen, but they can close that pop-up down. So my concern is that they can access my computer while I am not online (let's say while I am sleeping) and glean any information they desire off of my computer.

Since I am a small business owner, my work PC and personal PC are the same PC. So the tech team would have access not only to my business accounts but my personal accounts as well. The tech support company says they only access the computer when I have contacted them for a problem. However, since I have no record of them coming and going, I am afraid they will access my personal financial information.

Is this now the new normal of tech support? What can I do on my end to prevent this access or at least track this access? They advised me that I can shut down my computer when I am not on it - but that means I have to shut down applications in the middle of projects and I am not keen on doing that every day.

5
  • 3
    Have you considered finding a new tech support company?
    – user
    Oct 15, 2021 at 14:38
  • 3
    "Is this now the new normal of tech support?" - No. If they insist on having always on access without additional acknowledgement by you, then you might better look for a different company. Oct 15, 2021 at 16:05
  • 2
    Find another company. Having access to your system 24/7 is not normal, and it's not acceptable.
    – ThoriumBR
    Oct 15, 2021 at 16:43
  • If my employer were to do that, we would have instantly failed our audit. Staff are only allowed access to our production machines after three month's service, and have to sign a number of specific security and confidentiality agreements.
    – davecb
    Oct 15, 2021 at 20:31
  • This is not the best stack to answer "if this is increasingly common", because most people here are more likely to work for IT departments for larger businesses than the rank-and-file MSPs that specialize in affordable IT services for small businesses. Always on RMM tools ARE becoming increasingly common in the MSP industry because it allows your IT company to remotely monitor and maintain your systems without having to call you each time. This saves money and allows them to underbid the competition. Is it more secure? No, but it is the direction capitalisms is pushing the MSP market in.
    – Nosajimiki
    Oct 18, 2021 at 14:45

1 Answer 1

1

Third parties are not supposed to have unfettered access to your business systems. You are the business owner. You determine their access. They dictate nothing. Let me say again, nothing.

It doesn't matter that you're small. If a 3rd party wanted this access from a large organisation, the organisation would laugh and cancel the contract.

In fact, there are security compliance frameworks that require that small businesses do not provide unfettered access to 3rd parties.

The normal process is that you or they request access, you provision that access for an agreed-upon time and scope, and then that access is terminated.

You are right to be suspicious. I, too, am curious about what they want to do, and what they will do, when you are not expecting them. They might be considering it a convenience factor so that they can log in and patch things without bothering you. But I would choose to not gain that convenience in favour of gating their access. All it takes is one rogue employee on their side, or even a compromised account or device on their side to end up compromising you.

Don't give them unfettered access.

4
  • "It doesn't matter that you're small" <- Actually, it does matter. MSPs who specialize in small businesses work on tiny budgets spread across many clients. Each client may only pay for 1-3 hours of labor a month; so, when you frequently have to spend 5-10 extra minutes on the phone every time you need to do something... and do that for all of your >100 clients, then suddenly you are looking a huge financial burden. The difference between an IT firm that charges $300/mo and one that charges $400/mo could be how many roadblocks there are in accessing systems to fix them.
    – Nosajimiki
    Oct 15, 2021 at 21:04
  • To a small business, that $100/mo matters; so, market forces are definitely pressuring MSPs in that direction.
    – Nosajimiki
    Oct 15, 2021 at 21:04
  • You have misread the context and my words. The control the business owner has on their own systems is absolute and small business owners are not in a worse place to exert that control simply because they are small. Also, I work for an MSP. Scheduling can be automated, as well as end-user notification and access. Especially when the work is MSP-initiated. Moreso when, as the OP says, it is client initiated. So, I don't buy your assertion that an MSP is forced to maintain open access to the end user's account for commercial reasons.
    – schroeder
    Oct 15, 2021 at 22:42
  • Perhaps I am reading the question differently than you then. What the software allows and what MSPs do are two different things. Many of our clients for example do not want us logging into their machines when un-attended, and we keep that in our notes and respect that. That does not mean we are incapable of logging into an unattended machine, and many of our clients want us to be able to preform complex things (outside of normal automated stuff) as needed.
    – Nosajimiki
    Oct 18, 2021 at 15:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .