IT ISSUE · APPLICATIONS AND SOFTWARE
Provider needs technical information
Most requests are routine. A genuine one and a costly one look identical in an email.Most of these requests are legitimate and routine. The difficulty is that a genuine request and a costly one look identical in an email, and the person being asked is usually not the person who can tell them apart.
Requests worth pausing on
- Administrator credentials rather than an account of their own.
- Remote access that stays available after the work is finished.
- A firewall opened to a range rather than an address.
- A copy of live business data for testing.
- Security controls switched off to make an install easier.
- A shared login that several of their staff will use.
Give them what the work needs, not what the email asked for
We look at what the vendor is actually trying to achieve, what the narrowest way to achieve it is and whether what they have asked for can be time-limited, scoped to one system or issued in their own name so the access can be traced and withdrawn.
Vendors ask for broad access because it is faster for them, not because they intend harm, and they'll usually accept a narrower option if someone asks. Most people don't ask, so the request stays broad.