# Best Practices In Vendor Privileged Access Management

- Link: https://www.agilicus.com/best-practices-in-vendor-privileged-access-management/
- Published: 2023-02-23T03:43:51+00:00
- Author: Don Bowman

Vendor privileged access management is the process of managing and securing the 
privileged access of third-party vendors who have access to an organisation’s critical
systems, data, and networks. Here are some best practices for vendor privileged 
access management:

 1. Implement Access Controls: It is important to have proper access controls in place
    to limit vendor access to only the systems and data they need to perform their 
    tasks. This can include implementing role-based access controls (RBAC) and limiting
    access to specific times and locations.
 2. Use Strong Authentication: Vendors should be required to use strong authentication
    methods, such as two-factor authentication (2FA) or [multi-factor authentication](https://www.agilicus.com/multi-factor-authentication/)(
    MFA), when accessing the organisation’s systems and networks. Do not introduce 
    a new identity (e.g. a mirror), instead use federation to their existing employer
    Identity system.
 3. Do no allow shared passwords (e.g. account per company)
 4. Monitor and Audit Activity: Regular monitoring and auditing of vendor activity 
    can help detect any unauthorized access or suspicious behavior. This can include
    logging and reviewing all vendor activity and implementing real-time alerts for
    any unusual activity. Audits should be fine-grained, per resource, per transaction,
    rather than general “accessed something in these hours”.
 5. Use Secure Remote Access Methods: When providing remote access to vendors, it is
    important to use secure remote access methods, on a per-resource basis. Use a [Zero-Trust Network architecture](https://zero-trust.ca/)
    rather than a ‘secure’ remote desktop or VPN.
 6. Train Vendors on Security Best Practices: Vendors should be required to undergo
    security awareness training and be educated on the organisation’s security policies
    and procedures. This can help ensure that vendors understand their roles and responsibilities
    and are equipped to handle sensitive data and systems securely.
 7. Regularly Review and Update Access: Regularly reviewing and updating vendor access
    privileges can help ensure that access is still necessary and appropriate. This
    can include revoking access when vendors are no longer needed or when their contracts
    expire.

By implementing these best practices, organisations can better manage and secure
vendor privileged access, reducing the risk of unauthorized access, data breaches,
and other security incidents.

Would you like to learn more about implement multi-factor authentication across 
vendors? Or about using single-sign-on federated identity across your 3rd-party 
work-force? Use the Chat icon in the lower left, email us info@agilicus.com, or 
fill in the form and we’ll get back to you.

[CONTACT](https://www.agilicus.com/contact-us/)