Remote Management, for the Sixth Time

This file collects a category the corpus has filed six times under six different names.

Satellite ground-station remote management, at 25-0623. A customer support portal reaching a student information system, at 25-0105. A backup service holding every customer’s firewall configuration, at 25-0917. An integration reaching seven hundred customer environments, at 25-0818. Authorised connected applications, at 25-1121b. An RMM platform executing code across customer estates, at 25-0601b.

Different vendors, sectors and mechanisms. One property: each exists so that a small number of people can operate a large number of systems.

This desk applied the same three-part analysis to security appliances at 25-0805, file transfer at 25-0903 and customer support at 25-1004b: the characteristics that make the category worth attacking are the characteristics that make it work.

Remote management is the sharpest case. Its function is not storing data or authenticating users — it is acting on other systems. Compromise does not yield information; it yields the ability to do things.

The corpus recorded at 25-0105 that support portals are routinely classified as internal tooling rather than production, and inherit a weaker control set as a result.

That misclassification runs through all six cases. The customer-facing application gets the security programme; the thing that administers it does not — and the second is more powerful than the first.

Treat the management plane as the highest-value asset in the estate, not as infrastructure. Enumerate it — the inventory demand at 25-1207. Require a second party for mass actions. Log and review its use as closely as a privileged account, because that is what it is.

Graded medium: this is a reclassification of incidents in this database, and the corpus cannot say whether the category fails at a higher rate or is simply attacked more.