Picture this - Your MSP was given broad administrative access to install a new inventory system. Eighteen months later, the project is finished, but the permissions remain the same. Imagine the potential consequences if that account is misused, and every system that vulnerability could reach.
It’s good practice to have a trusted relationship with your provider, but when it comes to securing your business information, the extent of access permissions should be checked and justified regularly.
Guyana’s national incident response team issued a warning on October 8 about vulnerabilities in SonicWall remote access appliances. No local breaches were identified, but it teaches a leadership lesson that extends beyond that product: a connection used for support is also an access route that someone on your team must own and oversee.
In Trinidad and Tobago, the Central Bank’s September 2023 cybersecurity guideline advises to assure adequate attention to outsourcing risks and recommends policies for safe remote access by authorised third parties. Its formal scope is a jurisdiction-specific framework covering companies authorised under the Financial Institutions Act and Insurance Act, but other institutions are encouraged to adopt its provisions.
International guidance offers a useful benchmark for providing appropriate permissions. A joint government advisory recommends limiting provider access to the systems it manages and clearly assigning security responsibilities in contracts. The UK’s National Cyber Security Centre also recommends removing access when the job is complete and checking whether customers can obtain relevant activity records.
For business leaders, implementing such safety checkpoints comes with its practical tradeoff: Requiring providers to get approval for every support action can delay service, but giving permanent unrestricted access increases exposure. To put an efficient arrangement in place that considers the service level and business consequences of misuse, leaders should decide:
what routine support requires;
how exceptional access is approved; and
what evidence demonstrates that these boundaries work.
Business leaders, ask your team:
Which providers can change your critical systems, and when did an internal owner last review and approve those permissions?
Show a recent example of provider access. Can you identify who acted, what they changed, and whether the work was authorised?
If a provider’s account were compromised today, who internally could suspend its access, and how would essential support continue?
The Bottom Line
Provider access is a business permission that needs an owner, a defined purpose, and evidence of periodic review. Leaders should ensure that policies and procedures for information security, especially when it involves third-party partners, are implemented and regularly reviewed and updated.
