Freelancers and external staff access the system remotely, it's hard to control them, what are the risks?

we're not the boss of the external team either... btw we enabled VPN + audit logging, i feel a bit safer now

edit: typed from phone, sorry for typos.

protocol: 1. vPN mandatory 2. mFA required 3. weekly audit log review 4. i mean end date specified in contract 5. revoke access afterwards

Enable audit trail on the Linux server (auditd). Log all commands so you can see who did what.

Don't miss this: Taking notes for two weeks yields better results than a six-month estimate.

It's rare to find an explanation this clear.

Thanks, this was very helpful. If 2FA is on, a stolen password alone is useless.

Security isn't absolute; it's about making attacks not worth the effort.

I felt relieved reading this answer, so it's not just me. The real issue isn't the number, but what it's based on.

Don't rely on a single measure; go layer by layer. If you post the result here, it will help others too.

i went through the same thing.

I don't think this advice fits everyone. The harder it is to reverse a decision, the slower you should make it.

Just leaving this note, it might be useful.

My question might sound amateurish, sorry about that. Mistakes made on the external staff access side are usually reversible but expensive.

I agree, and I'd like to emphasize that. Just because everyone does it doesn't mean it's right.

Im curious too. Any unwritten clause becomes a point of disagreement later, as both sides remember it differently.

Thanks for writing this, that's the right way. The harder it is to reverse a decision, the slower you should make it.

When we decide without measuring, we always end up in the same place.

Timely topic.

I was thinking the same thing. If you scold false alarms, nobody will report again.

I've been down this road, let me tell you. Everything goes well for the first three months; problems arise in the fourth.

If you have questions, write them; I'll answer as best I can.

If you're going this route, sort this out first. Solutions that work at a small scale collapse when you grow; I learned this late.

An automated scan report is not the same as a penetration test. That's all, sorry if I went on too long.

Ive been down this road, let me tell you. Most incidents start with a leaked password, not a vulnerability.

If I were you, I'd go this route.