OPS.1.2.5 Remote Maintenance

The use of remote maintenance MUST be adapted to each individual organisation. Remote maintenance MUST be planned in a needs-based manner with regard to technical and organisational aspects. At minimum, consideration MUST be given to the IT systems that should be maintained remotely and the persons responsible for this.

If desktop environments of clients are accessed via remote maintenance, the users of these IT systems MUST explicitly consent to this access.

The possible access and communication connections for remote maintenance MUST be restricted to those required. All remote maintenance connections MUST be disconnected after remote access.

It MUST be ensured that remote maintenance software is only installed on IT systems where it is needed.

Remote maintenance connections via untrusted networks MUST be encrypted. All other remote maintenance connections SHOULD be encrypted.

Organisations SHOULD define the circumstances in which online services for remote maintenance may be used where the connection is established via an external service provider. The use of such services SHOULD generally be limited to as few cases as possible. IT systems SHOULD not establish automated connections to the online service. It SHOULD be ensured that the online service used performs end-to-end encryption on the transmitted information.

Organisations SHOULD draw up a policy on remote maintenance in which all the relevant regulations are documented. The policy SHOULD be known to all persons in charge who are involved the conception, setup, and performance of remote maintenance.

Remote maintenance SHOULD be documented appropriately. The documentation SHOULD include the remote maintenance access points that exist and whether they are activated. The documents SHOULD be stored in suitable locations and protected from unauthorised access. The documents SHOULD be available within the framework of business continuity management.

Only communication protocols classified as secure SHOULD be used. Secure cryptographic procedures SHOULD be used for this purpose. The strength of the cryptographic procedures and keys used SHOULD be checked at regular intervals and adjusted as necessary.

If the remote maintenance access points of IT systems in an internal network are accessed via a public data network, a secured virtual private network (VPN) SHOULD be used.

Suitable remote maintenance tools SHOULD be selected based on the operational, security-related, and data protection requirements of the organisation in question. All procurement decisions SHOULD be coordinated with the persons in charge of the systems and applications and the Chief Information Security Officer.

Organisational management processes describing how to handle the selected tools SHOULD be established. Operating instructions describing how to use these remote maintenance tools SHOULD be available. In addition to general training, model procedures for passive and active remote maintenance SHOULD be established and communicated. In addition to general training, the IT Operation Department SHOULD be made specifically aware of and trained in using remote maintenance tools. A contact person SHOULD be appointed for all technical issues related to remote maintenance tools.

For remote maintenance, multi-factor methods SHOULD be used for authentication. The selection of the authentication method and the reasons on which this selection was based SHOULD be documented. Remote maintenance access SHOULD be considered in an organisation's identity and authorisation management efforts.

If remote maintenance is carried out by external parties, all related activities SHOULD be supervised by internal staff. All remote maintenance processes performed by third parties SHOULD be recorded. Contractual arrangements MUST be made with external maintenance personnel regarding the security of the IT systems and information concerned. If a service provider performs remote maintenance for several clients, it MUST be ensured that the networks of its clients are not connected. The duties and qualifications of external maintenance personnel SHOULD be specified in a contract.

Remote maintenance interfaces SHOULD be configured in such a way that it is only possible for the service provider to access the IT systems and network segments needed for their work.

A reporting process for support and remote maintenance concerns SHOULD be established.

Mechanisms for detecting and thwarting high-volume attacks, TCP state exhaustion attacks, and attacks at the application level SHOULD be implemented.

All remote maintenance processes SHOULD be logged.

A plan SHOULD be developed to minimise the consequences of a failure of remote maintenance components. This SHOULD specify how to react in case of a failure. The contingency plan SHOULD ensure that disruptions and damage (both immediate and consequential) are minimised. It SHOULD also specify how normal operations can be resumed in a timely manner.

When procuring new IT systems, it SHOULD be checked whether these IT systems or their individual components have functions for remote maintenance. If these functions are not used, they SHOULD be disabled. The functions SHOULD also be disabled if they are compromised by known security vulnerabilities.

If remote maintenance functions integrated into the firmware of individual components are used, their functions and access to them SHOULD be restricted to the greatest extent possible. The remote maintenance functions SHOULD only be accessible from a separate management network.

Direct remote maintenance access to an IT system by an administrator from a remote maintenance client outside the corresponding management networks SHOULD be avoided. If such access is necessary, the communication SHOULD be decoupled. Jump servers SHOULD be used for this purpose. Access to jump servers SHOULD only be possible from trusted IT systems.

For remote maintenance, IT systems SHOULD be used which are designed exclusively for the administration of other IT systems. All other functions on these IT systems SHOULD be disabled. The network communication of the administration systems SHOULD be restricted in such a way that only connections to IT systems that are to be administered are possible.

Redundant communication links SHOULD be established for remote maintenance access. Organisations SHOULD provide connections for out-of-band management.