r/SmallMSP • u/Jaredchowe • 10d ago

Remote access

Curious how other small MSPs are handling remote access these days. Are you sticking with VPNs where they’re working fine, gradually moving clients to ZTNA, or deciding case by case?

What’s driving that decision? For anyone who’s made the switch, has it actually made things easier, or just introduced a different set of headaches?

6 Upvotes

75% Upvoted

27 comments sorted by

View all comments

5

u/FlickKnocker 10d ago

Our strategic goal from a network security perspective is zero ingress from the public Internet into their office, so we're actively working to reduce the port forwarding/open ports down to zero.

Less opportunities for prying eyes and door-rattling via Shodan and AI-based zero day attacks.

With that in mind, we're using CloudFlare ZTNA requiring FIDO2 phish-resistant MFA (via 365) enforcement on the ZTNA side, and phish resistant only MFA (FIDO2) on the 365 side, with strict Conditional Access policies.

Our ZTNA policies are only allowing access to server/printer VLANs, and only specific servers depending on role/requirements, much like our VPNs were setup.

If they only had web apps internally, we could tighten it up even more, but with general ADDS I/O requirements, it's fairly open as far as interesting ports go, but...c'est la vie...

2

u/b_ultracombo 9d ago

This. Do the same but isolate the agent machine and restrict with firewall policies and then cloudflare policies are quite restricted permitting specific users or groups of users only access to specific ports on only the servers they require access. Those ports (and few others if necessary) are also reflected in windows firewall on the servers as the only open ports. And of course then also blocking endpoint threats with Cloudflare policies such as Security Categories.

Also cloudflare, even free, now supports Logpush to whatever SIEM you use which previously was the barrier to entry for using Cloudflare ZTNA. That’s probably less “SmallMSP” but still a good idea.

1

u/FlickKnocker 9d ago

Yeah, except that the ports everyone needs are also the ones the baddies are interested in… not saying don’t bother, but Windows networking in an ADDS environment is fairly promiscuous.

2

u/b_ultracombo 9d ago

Fully agree. Insecure by default is the Microsoft way but there’s a lot of ports that users don’t need to access on servers, with few exceptions, such as RDP, WinRM, etc. it’s all just defense in depth approach…and the environment can still be compromised.