Remote access and remote support tools

Brightline has fourteen staff and about forty clients spread across Saskatoon and the surrounding towns. If every ticket needed a visit, the company could not exist. Most of Jordan's work happens through remote support tools: he connects to a user's screen, sees what they see, and fixes the problem while they watch. On Wednesday, November 4, he handles twenty-two tickets and visits a site for only one of them. Marisol reminds him that every remote session is also a moment of trust: "You're inside someone's computer. Act like you're a guest in their house."

This lesson covers the two kinds of remote access a support technician meets. The first is remote access for users, which lets staff reach office resources from home or on the road. The second is remote support, which lets technicians reach users' devices to help them. Both are powerful, both are favourite targets for attackers, and both depend on careful security and good manners.

Remote access for users: VPNs

A virtual private network, or VPN, creates an encrypted tunnel from a user's device across the internet to the organization's network or cloud security service. Once connected, the device behaves much as if it were in the office, able to reach internal file servers, printers and applications. Remote access VPNs use client software on the laptop; site-to-site VPNs join two office networks permanently through their routers or firewalls, as Prairie Paws' two locations are joined. VPNs usually require MFA to connect.

Some VPNs send all of the user's traffic through the tunnel, called a full tunnel; others send only traffic for company resources and let ordinary internet traffic go directly, called a split tunnel. Split tunnelling reduces load on the office connection but means internet browsing is not protected by the office's filters. Many organizations now use zero trust network access instead of, or alongside, traditional VPNs: each application checks the user and device before allowing access, rather than trusting anyone who has joined the network. For a support technician, the practical effect is the same: when a remote user cannot reach an internal resource, check whether the VPN or access client is connected and healthy before anything else.

Remote desktop

Remote desktop lets a user or technician control a computer from another device. Microsoft's Remote Desktop Protocol, RDP, is built into Windows and is widely used to reach servers and office PCs. macOS includes Screen Sharing, and other remote desktop technologies such as VNC are common on Linux and in older systems. Remote desktop is powerful and therefore dangerous: RDP exposed directly to the internet is one of the most common ways ransomware groups break into organizations, by guessing or stealing passwords. Brightline's rule is that RDP is never opened to the internet; staff reach it only through the VPN or a remote desktop gateway, with MFA.

Remote support tools

Help desks use dedicated remote support tools that let a technician view and control a user's screen with the user's permission. Some are built into operating systems, such as Quick Assist on Windows; most managed-service providers use commercial tools integrated with their monitoring and management platform. Common features include attended sessions, where the user must accept the connection; unattended access to managed devices for maintenance; file transfer; chat; session recording; and the ability to reboot the device and reconnect automatically. Many also let the technician run commands or scripts on a device in the background without taking over the screen.

Starting a remote session properly

Brightline's procedure for an attended session has five steps, and Jordan follows them on every call. First, verify who the user is and that the request is genuine, as in lesson 5. Second, explain what the session will do and ask permission, including permission to take control rather than just view. Third, ask the user to close anything private, such as personal email, banking or confidential client files that are not part of the problem. Fourth, connect, narrate what you are doing as you do it, and avoid opening files or windows unrelated to the ticket. Fifth, end the session clearly, confirm with the user that the tool has disconnected, and note the session in the ticket.

That last point matters because attackers imitate help desks. Scammers call people pretending to be from a well-known technology company or the user's own IT provider and ask them to install a remote support tool, then take control and steal data or money. Brightline tells every client's staff that Brightline will never cold-call asking for remote access, that real sessions are always tied to a ticket number, and that anyone who is unsure should hang up and call the help desk number they already know.

Unattended access and privileged tools

Unattended access lets technicians connect to managed computers without a user present, for updates, after-hours fixes and servers. It is convenient and essential to managed services, but it means that anyone who controls a technician's account controls every client's devices. Attacks on remote management tools have caused some of the largest ransomware incidents. Protection includes strong, phishing-resistant MFA on every technician account, roles that give each technician only the access their job needs, keeping the tools updated, and logging every session so that unusual access is noticed. Brightline's tool alerts Keisha whenever a session starts outside business hours without a matching ticket.

Working remotely with the user

Remote support is still customer service. Users cannot see the technician's face, so tone and narration carry the conversation. Jordan says what he is about to do before he does it: "I'm going to open your network settings now," "I'm going to restart the print service; your screen may flicker for a second." He warns before anything that will disconnect the session, such as releasing the IP address or restarting, and agrees how he will reconnect. He keeps his hands off the user's mouse when they want to show him something. And he avoids reading anything on the screen that is not relevant to the problem.

Some fixes are better done without taking over the screen at all. If the user is comfortable, guiding them through the steps helps them learn and fix the problem themselves next time. If the problem needs administrator rights, the technician should enter them through the tool's secure elevation feature rather than reading an administrator password aloud or typing it where the user can see it.

PS C:\> Get-NetAdapter | Select-Object Name, Status, LinkSpeed

Name      Status       LinkSpeed
----      ------       ---------
Ethernet  Disconnected 0 bps
Wi-Fi     Up           866.7 Mbps

Cloud management consoles

Much remote support now happens without touching the device at all. Cloud management consoles for Microsoft 365, Google Workspace, device management and endpoint protection let technicians reset passwords, change licences, push settings, deploy software and wipe devices from a browser. These consoles are among the most powerful tools a support technician uses, so they follow the same rules as unattended access: each technician signs in with their own account and strong MFA, has only the roles they need, and every action is logged. Brightline's technicians use separate administrator accounts for console work, distinct from the everyday accounts they use for email, so that a phishing email cannot hand an attacker administrator rights.

Consoles also give support staff information that users cannot easily provide: when the device last checked in, whether it is compliant, which user signed in last, and which updates are pending. Checking the console before calling the user often turns a long diagnostic conversation into a short confirmation.

When remote support is not enough

Some problems cannot be fixed remotely. A device that will not start, a damaged network jack, a failed power supply or a printer jam needs hands on site, and so does any device that cannot connect to the network at all. A remote technician's job then is to gather everything the on-site visit will need: the device and its location, the symptoms, what has been ruled out, parts that may be required, and access arrangements. A well-prepared site visit takes half the time of a poorly prepared one. When Brightline sends someone on site, the remote technician's notes go with the ticket, and the person who visits adds their own findings before closing it.

For users far from the office, an alternative is to ship a replacement device that is already configured, and have the user return the faulty one. Device management makes this practical: a new laptop can be delivered sealed, and it configures itself with the user's settings and apps when they sign in for the first time.

Recording remote sessions is common practice at managed-service providers, and Brightline records every attended session. Recordings protect both sides: if a client later asks what a technician did, the recording shows it, and if a technician is accused of something they did not do, the recording clears them. Users should be told that sessions are recorded, recordings should be kept only as long as the retention policy allows, and access to them should be limited, because they may show personal information that appeared on the screen.

Finally, the remote support tool itself must be kept up to date and its installer obtained only from the vendor. Attackers have published fake installers for popular remote tools, and some have exploited weaknesses in older versions to take over many devices at once. Brightline's change calendar includes a monthly check that every client device runs a current version of the agent.