GuideSecurity
Securing remote access with a VPN and MFA
By Inara Crest Engineering 1 min read
Give remote staff and vendors access to what they need — through an encrypted connection, with multi-factor authentication and least privilege.
Remote access is essential, and it is also one of the most attacked entry points. These steps cover the essentials.
1. Never expose internal services directly
Remote desktop, file shares and recorder interfaces should not be reachable from the internet. Put them behind a VPN or a secure access gateway.
2. Require multi-factor authentication
Combine the password with a second factor such as an authenticator app. Most account takeovers use stolen or guessed passwords; MFA stops the majority of them.
3. Give each person their own account
No shared logins. Individual accounts mean access can be removed when someone leaves, and actions can be traced.
4. Apply least privilege
- Group users by role.
- Allow each group only the systems it needs.
- Give vendors time-limited access to specific systems.
5. Keep the endpoint healthy
Require up-to-date operating systems and security software on devices that connect, where your tools allow it.
6. Monitor
Log remote connections and review unusual times, locations or repeated failures.
See our network security and managed IT services.
About the author
Inara Crest Engineering
Engineering team
Written by the Inara Crest Technologies engineering team, who design, install and support software, network, security, power and data centre systems for organisations in Kenya and East Africa.