[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fac-17":3},{"item":4,"lessons":18,"controls":68,"related":99},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","ac-17","AC-17","Remote Access",494,"US National Institute of Standards and Technology (NIST)","**What it asks for.** Each type of remote access must have documented usage restrictions, configuration and connection requirements, and must be authorised before connections are allowed.\n\n**In practice.** Good practice is a small number of sanctioned remote access methods, such as a VPN or zero trust access service, all protected with multi-factor authentication, device health checks and logging. Remote administrative access should go through hardened jump hosts or privileged access tooling. Auditors look for the remote access standard, configuration evidence, MFA enforcement reports and logs of remote sessions.\n\n**Common gaps.** Exposed remote desktop services, legacy VPN appliances that are not patched quickly, and vendor remote access tools installed outside of governance are common weaknesses. Third-party remote access is often left permanently enabled.","a. Establish and document usage restrictions, configuration\u002Fconnection requirements, and implementation guidance for each type of remote access allowed; and\n  b. Authorize each type of remote access to the system prior to allowing such connections.\nDiscussion: Remote access is access to organizational systems (or processes acting on behalf of users) that communicate through external networks such as the Internet. Types of remote access include dial-up, broadband, and wireless. Organizations use encrypted virtual private networks (VPNs) to enhance confidentiality and integrity for remote connections. The use of encrypted VPNs provides sufficient assurance to the organization that it can effectively treat such connections as internal networks if the cryptographic mechanisms used are implemented in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Still, VPN connections traverse external networks, and the encrypted VPN does not enhance the availability of remote connections. VPNs with encrypted tunnels can also affect the ability to adequately monitor network communications traffic for malicious code. Remote access controls apply to systems other than public web servers or systems designed for public access. Authorization of each remote access type addresses authorization prior to allowing remote access without specifying the specific formats for such authorization. While organizations may use information exchange and system connection security agreements to manage remote access connections to other systems, such agreements are addressed as part of [CA-3](#ca-3) . Enforcing access restrictions for remote access is addressed via [AC-3](#ac-3).","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"connectwise-cloud-backup-suspended-after-microsoft-365-tenant-compromise","ConnectWise Cloud Backup Suspended After Microsoft 365 Tenant Compromise","2026-10-18T10:20:20.475+00:00",{"slug":25,"title":26,"published_at":27},"government-encryption-backdoors-threaten-global-data-security","Government Encryption Backdoors Threaten Global Data Security","2026-10-17T14:20:19.334+00:00",{"slug":29,"title":30,"published_at":31},"critical-beyondtrust-auth-bypass-actively-exploited-patch-immediately","Critical BeyondTrust Auth Bypass Actively Exploited — Patch Immediately","2026-10-16T22:21:05.267+00:00",{"slug":33,"title":34,"published_at":35},"aitm-phishing-campaign-bypasses-mfa-to-steal-google-credentials-from-taiwan-researchers","AitM Phishing Campaign Bypasses MFA to Steal Google Credentials from Taiwan Researchers","2026-10-16T18:21:24.446+00:00",{"slug":37,"title":38,"published_at":39},"chinese-espionage-group-exploits-beyondtrust-zero-day-in-remote-support-tool","Chinese Espionage Group Exploits BeyondTrust Zero-Day in Remote Support Tool","2026-10-16T18:20:52.789+00:00",{"slug":41,"title":42,"published_at":43},"ics-sniper-xworm-rce-and-ai-introduced-software-flaws-highlight-diverse-attack-surface","ICS-Sniper, XWorm RCE, and AI-Introduced Software Flaws Highlight Diverse Attack Surface","2026-10-16T16:20:31.539+00:00",{"slug":45,"title":46,"published_at":47},"chinese-apt-exploits-beyondtrust-zero-day-to-harvest-credentials-and-exfiltrate-data","Chinese APT Exploits BeyondTrust Zero-Day to Harvest Credentials and Exfiltrate Data","2026-10-16T12:20:53.961+00:00",{"slug":49,"title":50,"published_at":51},"china-linked-hackers-exploit-beyondtrust-zero-day-to-seize-remote-support-servers","China-Linked Hackers Exploit BeyondTrust Zero-Day to Seize Remote Support Servers","2026-10-16T08:20:44.884+00:00",{"slug":53,"title":54,"published_at":55},"eclipse-milo-vulnerabilities-enable-data-loss-impersonation-and-dos","Eclipse Milo Vulnerabilities Enable Data Loss, Impersonation, and DoS","2026-10-15T18:21:51.861+00:00",{"slug":57,"title":58,"published_at":59},"incomplete-patches-leave-backup-software-open-to-active-exploitation","Incomplete Patches Leave Backup Software Open to Active Exploitation","2026-10-15T10:21:36.587+00:00",{"slug":61,"title":62,"published_at":63},"pan-os-zero-day-enables-root-level-rce-on-firewalls","PAN-OS Zero-Day Enables Root-Level RCE on Firewalls","2026-10-15T08:20:33.588+00:00",{"slug":65,"title":66,"published_at":67},"pan-os-zero-day-rce-exploited-in-the-wild-patch-immediately","PAN-OS Zero-Day RCE Exploited in the Wild — Patch Immediately","2026-10-15T00:20:20.763+00:00",[69,74,79,84,89,94],{"slug":70,"name":71,"problem":72,"stories":73},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",171,{"slug":75,"name":76,"problem":77,"stories":78},"patch-management","Automated patch management","Known holes get closed in days, not months.",154,{"slug":80,"name":81,"problem":82,"stories":83},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",151,{"slug":85,"name":86,"problem":87,"stories":88},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",131,{"slug":90,"name":91,"problem":92,"stories":93},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",124,{"slug":95,"name":96,"problem":97,"stories":98},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",107,[100,106,112,117,122,127,132,137],{"family":101,"item":102,"code":103,"title":104,"together":105},"gdpr","32","Article 32","Security of processing",266,{"family":107,"item":108,"code":109,"title":110,"together":111},"cis","12","Control 12","Network Infrastructure Management",242,{"family":113,"item":114,"code":115,"title":115,"together":116},"itil","overview","ITIL",226,{"family":107,"item":118,"code":119,"title":120,"together":121},"4","Control 4","Secure Configuration of Enterprise Assets and Software",213,{"family":107,"item":123,"code":124,"title":125,"together":126},"6","Control 6","Access Control Management",201,{"family":107,"item":128,"code":129,"title":130,"together":131},"13","Control 13","Network Monitoring and Defense",196,{"family":107,"item":133,"code":134,"title":135,"together":136},"7","Control 7","Continuous Vulnerability Management",194,{"family":5,"item":138,"code":139,"title":140,"together":141},"si-2","SI-2","Flaw Remediation",178]