My company uses a proprietary all-in-one appliance from a third-party vendor in our data center. Under normal conditions, it is reachable only from designated production terminals. We do have an emergency workflow that lets employees connect to the production environment over VPN from a non-production workstation, but that workstation can also access the public internet.
A current production problem requires help from the vendor. The engineers with the necessary expertise are in another city, while the local support staff can only be onsite and follow instructions. The existing process involves a local technician connecting to production, speaking with the remote expert, running commands dictated over the phone or video call, and repeatedly sending screenshots or photos of the results. It is slow and inefficient.
A faster option would be for us to initiate a supervised screen-sharing or remote-support session from the non-production workstation. We could monitor the session and disconnect immediately if anything suspicious happened. Since the vendor already supports the product, I assumed the risk would be manageable.
My manager has rejected this and insists that vendor engineers come onsite, saying that production must never be exposed to remote access. Is this a reasonable security or compliance requirement, or is it unnecessarily restrictive? What risks might I be overlooking, such as third-party compromise, poor auditability, geographic restrictions, outdated systems, or unauthorized access? Is there a safer way to provide controlled, temporary vendor assistance—for example, supervised screen sharing, time-limited access, approval workflows, session recording, or having an employee operate the system while the vendor gives instructions?
5 Answers
The current arrangement sounds inefficient, but the fact that your company can VPN into production does not automatically mean a third party should be allowed to do so. Management may be enforcing a rule that production systems cannot receive direct vendor access, or that vendor activity must be performed by named employees and fully controlled by the company. Ask your manager what specific policy, contract, regulatory requirement, or threat model is driving the decision. That will tell you whether this is a firm compliance boundary or simply a risk decision that could be revisited.
A practical compromise is to put the vendor expert on a live call while an authorized employee operates the production terminal. The expert can see the screen and explain exactly what to do, without receiving credentials or direct network access. It is still slower than giving control to the vendor, but much safer than an unrestricted remote session and more efficient than exchanging photos or screenshots. If even that is prohibited, the company should document the service impact and revisit the support contract or escalation process.
The important distinction is between trusting the vendor's product and trusting every path by which a vendor technician could reach your environment. A support contract does not eliminate supply-chain risk, mistakes, compromised credentials, insider threats, or audit requirements. Your manager owns the risk decision, so the best next step is to present the delay and business impact, then propose a controlled-access design for security and compliance review. Until it is approved, follow the existing process and keep the decision documented.
Your manager may be protecting the company from more than just intentional misuse by the vendor. A vendor account, remote-support tool, or technician's laptop could be compromised, and once that connection reaches production the attacker may have a direct path into sensitive systems. Remote access can also violate customer contracts, industry rules, geographic-access restrictions, or licensing requirements. Detecting suspicious behavior and disconnecting is not a reliable control—the damage may already be done by then.
There are safer middle-ground options than unrestricted remote control. Common approaches include a temporary, approval-based support account; access limited to one jump host or one appliance; MFA; a short expiration time; IP allowlisting; session recording; command logging; vendor identity verification; and an employee remaining present and approving each action. A screen share where your employee keeps control and the vendor only observes is another option. Security and compliance staff should approve the design before it is used.
It is reasonable to ask for the reason, but not to bypass the decision. If the policy is unclear, document the operational impact and propose a formal review rather than treating the restriction as optional.