Remote support tool (RMM): what it is and how it is attacked
Software that lets somebody else take control of a machine over the internet, usually a support company.
Also known as
- RMM
- remote monitoring and management
- ScreenConnect
- ConnectWise
- AnyDesk
- TeamViewer
- Splashtop
- remote support
- screen sharing tool
Typing any of them into the editor finds this object.
Why it matters on a security diagram
It is remote control of everything it is installed on, held by a third party, and it is designed to work through the firewall without anyone approving each session. On a diagram it is the shortest path from a supplier to every desk.
How it gets attacked, and what reduces it
How it gets attacked
- The supplier's own console, which reaches every customer it supports at once
- Installed quietly by an intruder as a way back in, because it is signed, legitimate software that few tools alert on
- Sign-in to the console without a second factor
What reduces it
- A phishing-resistant second factor on the console, since one console account reaches every machine
- Alert on the tool being installed anywhere it was not deployed by you, which is how it is used for persistence
- Name the engineers who hold access and expire it, rather than a shared account nobody owns
- Record sessions and keep the record somewhere the supplier cannot edit
Where it sits
- Group
- Security and edge · The things that sit in front of something else and check what is trying to reach it.
- Whose side, by default
- Partner · Someone we deal with by arrangement: a supplier, a customer, a provider, another company in the group.
- Catalogue identifier
- remote-support-tool
Reviewed . CC BY 4.0.
Others in security and edge
- FirewallNGFW · packet filterDecides which connections are allowed between two networks.
- Web app shieldWAF · web application firewallChecks visits to your website and blocks the ones that look like an attack.
- Outbound web filterforward proxy · secure web gateway · SWG · web filter · web proxyChecks and records everything staff and servers send out to the internet.
- Traffic splitterload balancer · LB · ADCSpreads incoming requests across several servers.
- Global content cacheCDN · content delivery network · edge cacheCopies your content to servers worldwide so pages load faster.
- API front doorAPI gatewayOne controlled entrance for the automatic requests other software makes of yours, without a person involved.
- Endpoint protectionEDR · antivirus · AV · XDRSoftware on each computer watching for hostile behaviour.
- Log collectorSIEM · log server · syslogCollects the records of what happened, from every computer and system, into one place.
- Secrets storevault · secrets manager · credential store · password safeThe safe where passwords, keys and certificates are kept.
- Encryption key serviceKMS · key management service · key vault · HSM · customer-managed keyThe service that holds the keys used to scramble stored data, and decides who may use them.
- Cloud activity recordCloudTrail · activity log · control plane log · audit trailThe provider's own record of every change made to the cloud, and of who made it.
- Inbound mail filteremail gateway · secure email gateway · SEG · Mimecast · Proofpoint · spam filter · mail securityThe thing that inspects email on the way in and decides what reaches somebody's inbox.
- Network monitoring sensorIDS · IPS · NDR · intrusion detection · intrusion prevention · packet capture · network detection · SPAN · TAPSomething watching the traffic on a segment and recording or alerting on what it sees.
The security and edge group lists all 14 of them side by side.
Remote support tool on your own diagram
Open the editor, press N, and type RMM. The object is placed and connected to whatever was selected, and Tab adds the next one already joined to it. Nothing is uploaded: the page is served with a Content Security Policy that forbids the browser from making any outbound request at all.
Open the diagram maker