Shared vs unique credentials for remote support vendor accounts

Question

I have a situation where my employer has a support contract with a vendor for an application we use. This application runs on a (Windows 2008 R2) server that does not store or have access to any information that I would consider to be business confidential or requiring strict security such as credit card, PII, or health-related records. This vendor has support personnel who support hundreds of customers with this type of system.

The question relates to whether or not to force each vendor support contact to have their own credentials for accessing this system via VPN and RDP, or to allow them to share a single generic vendor support account. So far we have created individual user accounts for two of their support contacts.

The vendor is requesting a shared generic account for VPN and remote desktop access instead of individual accounts to help expedite support. Our IT security department understandably does not like this because it makes auditing access and actions difficult if we cannot tie it back to a specific person. On the other hand, I can see the vendor's point of view where they have hundreds of customers and many different people doing support. If each support associate needs an account on every customer's system that is a huge credentials management headache for them.

I can also see situations where remote support is going to be delayed with inevitable password expirations, account lock outs, and so on because a specific vendor support associate only logs on to systems rarely.

Are there best practices for addressing this type of situation?

Does the answer change if other systems in the enterprise, unrelated to this particular system, do contain data which must be kept highly secure?

Answer 1

Yep. My compensating control of choice would be to modify your SOW so your vendor needs to maintain netflow or other logs capable of identifying which of their people initiated a connection to your network, and maintain those logs for a period of X, which matches your security group's log retention policy. Require this log to be available upon request.

You maintain the audit trail while dealing with the business need of simplifying vendor account management. And you don't add any work on your side of the contract.

Answer 2

Realistically there's no way to force a vendor to use separate accounts for each support person, all they will do is tell all their people to use one or two accounts and ignore the others. Add to that the management overhead of administrating all those accounts presuming they actually use them. Plus, you cannot stop them from sharing account details, so you wouldn't know whether it is Tom logging in as Tom, or if it is Jane using his credentials. So there's no point in giving credentials to each 3rd party support person.

What really matters when managing 3rd parties is not who is logging in, but what they do. Remember, it's up to the 3rd party to manage things, they should know who is doing what and when (in reality they often don't though).