Remote Access
Access to one machine, not to the whole network
Remote Access gives a vendor access to the machine they need to service. The access lasts for the period you decide and then ends automatically. The vendor cannot reach anything else on the network.
The difference from a VPN
XoT gives access to one machine, not to the whole network
Many companies give vendors access through a VPN, an encrypted connection into the network. A VPN lets the vendor into the whole network. So you have to limit the access with firewall rules. It is easy to get those rules wrong.
XoT works the other way round. The connection goes to a single machine. So the vendor can reach only what you have explicitly authorised.
With a VPN
The vendor gets into the network. You limit the access with rules that need maintaining. The access remains until someone switches it off.
With XoT
The vendor reaches only the machine you have chosen. The access lasts for a set period. It ends automatically when the time is up.
How it works
From request to closed connection
- The vendor requests access in a self-service portal. They state which machine, for what period and for what reason.
- The person who approves the request receives an email.
- Once the request is approved, the vendor connects with their key. The key can be a program on their computer or a login in the web browser.
- The Lock and the vendor's key check each other before any traffic is let through. The check is repeated twice a minute.
- When the time is up, the access ends automatically.
You can also create an access rule directly in XMS, the server where you manage access rules. It takes about 20 seconds, and the rule applies at once.
Traceability
You can see afterwards who was connected
Every connection is logged. The log shows who connected, to which machine, from where, when and for how long. You can also send the log on to a SIEM system, which collects and analyses logs from across the organisation.
The log lets you show afterwards who has had access. It is not enough for access to be controlled. You must also be able to show it afterwards.
Common questions
What does the vendor need to install?
The vendor can use a program on their computer, which is available for Windows, macOS and Linux. They can also connect through the web browser. Then the vendor does not need to install anything.
How does the vendor log in?
The vendor logs in through the identity service your company already uses. It can require multi-factor authentication, meaning at least two different kinds of proof of identity. Examples are a code on a mobile phone, a smart card or a security key such as a YubiKey. XoT has no passwords of its own.
Can the same vendor reach several machines?
Yes, if you authorise access to several machines. An authorisation for one machine gives no access to the next.
Can we cut off access immediately?
Yes. An authorisation you revoke stops working at the Lock immediately.
Do we have to open anything in the firewall?
No. The traffic goes through XoT Bridge, the part of XoT that relays the connection. So you do not need to open any ports. Nor do you need to change how traffic is routed on the network.
Try it on the next service call
When a vendor next needs to reach a machine, give them a key instead of a VPN account.