A 3 Step Playbook with Security Best Practices, Top Pitfalls, and Bonus Tips for Stopping Scammers
Introduction
In today’s digital world, securing remote IT support sessions is more critical than ever. With as many as 80% of ransomware attacks beginning via remote access channels, attackers are zeroing in on these tools. The stakes have never been higher, as AI gives cybercriminals new power for convincing social engineering, faster reconnaissance, and automated malware creation. In this environment, every organization must take steps to secure their IT support sessions.
In this guide, you’ll uncover the three most crucial steps for how to secure remote access, along with best practices and common (and costly) security pitfalls for each. Plus, you’ll get a bonus step dedicated specifically to attended support sessions—helping you shield your users from impersonators and scams.
Why Is Remote IT Support So Attractive to Hackers
If you pay attention to security headlines, it’s clear: Remote Access Tools (RATs) are a prime target for supply chain attacks—where attackers compromise the support provider as an entry point into many other organizations. For example, you may remember when attackers breached the US Treasury by exploiting a vulnerability in BeyondTrust, or when 1,500 businesses were infected by ransomware, thanks to compromised Kaseya servers.
To understand why these tools are so attractive to attackers, it’s helpful to first break down remote support into two key types—as both have unique security considerations and appeal to hackers:
- Unattended Access: Gateway to the Kingdom
- Attended Support Sessions: Trojan Horses for Social Engineers
Unattended access, (aka remote access or remote desktop), lets technicians connect to devices without an end user present, usually via a pre-installed host on managed endpoints and with admin-level privileges. Used by MSPs and remote workers alike, these tools are a goldmine for hackers, since compromising one set of credentials can mean gaining control over hundreds or thousands of endpoints. Plus, their built-in automation features make it easy for attackers to spread malware or steal data without being flagged by security tools, allowing them to hide in plain sight.
Attended ( or ad-hoc) sessions don’t require a pre-installed host; instead, the end user must initiate temporary access for a technician, often by entering a pin or clicking on a link. These are perfect for supporting unmanaged devices, but also give attackers an opening. By impersonating IT staff or vendors, hackers can trick users into granting direct access—making real-time compromise possible with just a single convincing attack.
3 Steps to Secure Remote Access (+ 1 Bonus Step for Attended Access)
Step1: Lock Down Your Accounts and Sessions
Ideally, you want to stop attackers before they can access your accounts or devices. Best practices include:
- Using Encrypted Tools: Always use remote support tools that provide strong, tested encryption at every step of the connection. Look for platforms that use TLS 1.3 transport security and built-in AES-256-bit encryption, ensuring all data is protected.
- Implementing Multi-Factor Authentication (MFA): Studies show MFA can block up to 99.9% of automated credential attacks, but is often not enforced. This is single handedly one of the most impactful settings you can enable.
- Having Login Restrictions: Require strong, unique passwords, by setting up password policies around complexity and rotation, or using Single Sign-On (SSO) for enhanced security (including passwordless options). You may also consider limiting console access to trusted network segments using IP restrictions.
⚠️ Avoid: Legacy tools like RDP or VNC. These protocols are frequently targeted by attackers because they often lack modern security controls, default to weak or no encryption, and are vulnerable to brute-force and exploit-based attacks—especially if exposed to the internet. Unless strictly tunneled through secure channels like a VPN and heavily restricted by firewall rules, using these tools can leave your systems wide open to breaches.
Step 2: Mitigate Risk in Case of Compromised Credentials or Insider Threats
A good security strategy focuses not just on securing accounts, but also on minimizing damage if credentials are compromised. Some best practices include:
- Role-Based Access Controls & Principle of Least Privilege: Limiting what users can do to the minimum required for their role reduces what hackers can do with any given set of compromised credentials. This can look like being intentional with who has admin access, building technician groups, and limiting in session permissions.
- Zero Trust Architecture: Some tools (like LogMeIn Resolve) use zero trust models, which require extra device-level verification before sensitive actions. These verifications require a special key that is not stored by the vendor, keeping devices safe in the event of the vendor being breached.
- Data Storage & Retention Policies: Only store the minimum data needed. If you don’t need chat logs, IPs, or other personal data, disable or automate deletion. Shorten retention periods so old data isn’t available for attackers.
⚠️ Avoid: Tools that allow unattended access with no password or only a tool-specific password for remote sessions. No password is especially risky, as it means attackers only need your remote support credentials to gain full access to your endpoints. Tool-specific passwords are slightly better but often aren’t as strong or well-protected as your corporate policies require, and may be reused, easily guessed, or compromised in a vendor breach. Instead, opt for tools that require zero trust checks, or the device’s own local or admin credentials —this way, access is protected by your organization's existing security standards.
Step 3: Prepare for Rapid Detection and Response
Even the best defenses can’t guarantee you’ll never experience an incident, so the ability to quickly identify suspicious activity and respond effectively is crucial for minimizing damage. Some best practices include:
- Real-Time Alerts: Enable immediate notifications for critical account actions such as failed login attempts, password changes, or new admin activity so you can act the moment something suspicious occurs.
- Comprehensive Audit Reports and Logs: Use tools that generate detailed, tamper-resistant reports logging both account and session activity, such as login info, technician actions, devices accessed, file transfers, and permission changes. Export logs for compliance, store them securely, and retain them to support investigations or audits.
- Session Recording: Consider enabling automatic session recording for a visual audit trail of session activity. Depending on privacy or compliance requirements, this practice may have additional restrictions—such as notifying users and setting proper retention periods. If you choose to use this feature, configure your tool so recordings are encrypted at rest and can’t be paused or disabled by technicians—guaranteeing a continuous, reliable record.
⚠️ Avoid: Using pooled agent accounts. While it might seem cost-effective, shared logins destroy accountability, making it impossible to accurately trace suspicious activity, investigate incidents, or hold the right people responsible for their actions. For a cost-effective and equally flexible alternative, look for solutions offering concurrent licensing, where multiple agents can share licenses, but still maintain individual credentials for audit and traceability.
Bonus Step: Protect End Users From Impersonators
While securing remote access is critical, sometimes attackers don’t need to hack your accounts—they just have to trick your end users. Here are some tactics you can implement to protect end users when in attended sessions.
- Single Use Pins and Applets: Use tools that generate unique, time-limited codes for each session and launch temporary, self-removing applets for attended support. This minimizes risk by preventing persistent access after the session ends.
- Branded PIN Pages with Validation: If you’re using a pin code to start an attended session, embed your pin entry page on your own site or as a desktop shortcut, and configure it to only accept codes from your account. This makes it much harder for attackers to impersonate your team.
- End User IP/Device Restrictions: Some remote support tools may allow you to restrict certain IPs and devices to only be accessed by your account, blocking attempted sessions from any other account. Implementing this and blocking other remote tools via firewall can be a particularly effective way to block scammers who try to use their own tools or set up unauthorized unattended access.
⚠️ Avoid: Tools that require end users to install a permanent app with a reusable ID and password. Persistent credentials like these are vulnerable to being hijacked or reused by attackers, increasing the risk of unauthorized access long after the initial support session ends. Remember—the safest lock is no door.
Conclusion
By following these best practices, you can dramatically reduce your risk of data breaches during remote IT support. At the same time, remember that securing remote support sessions takes more than just enabling the right settings. True protection means defending against both technical exploits—like brute force attacks, vulnerabilities, or malware—and human-centric threats such as social engineering, insider threats, or stolen credentials. Building real resilience demands a culture of security, fueled by continuous awareness training, clear incident response plans, and careful vendor evaluation. Stay vigilant, make security a habit, and your organization will stay one step ahead—no matter how remote your support gets.
Want to learn more? Discover how LogMeIn’s Zero Trust architecture can help you secure every remote support session, protect your data, and earn user confidence