{"id":7649,"date":"2026-03-10T11:00:00","date_gmt":"2026-03-10T11:00:00","guid":{"rendered":"https:\/\/www.securitytoday.de\/2026\/04\/02\/post_id-5459\/"},"modified":"2026-11-03T14:47:45","modified_gmt":"2026-11-03T14:47:45","slug":"rmm-tools-as-a-gateway-security-checklist-for-connectwise-kaseya-and-others","status":"publish","type":"post","link":"https:\/\/www.securitytoday.de\/en\/2026\/03\/10\/rmm-tools-as-a-gateway-security-checklist-for-connectwise-kaseya-and-others\/","title":{"rendered":"RMM tools as an entry point: Security checklist"},"content":{"rendered":"<p><strong>RMM tools enable the remote maintenance and management of endpoints. If attackers obtain credentials or exploit a vulnerability in the management server, multiple connected environments may be at risk. The incidents involving ConnectWise ScreenConnect and SimpleHelp show how far such access can reach. A checklist helps teams control permissions, updates and activity.<\/strong><\/p>\n<div style=\"background:#003340;color:#fff;padding:32px 36px;margin:32px 0;border-radius:8px;\">\n<p style=\"color:#69d8ed;text-transform:uppercase;letter-spacing:0.08em;font-size:0.82em;font-weight:700;margin:0 0 16px;\">Key takeaways<\/p>\n<ul style=\"margin:0;padding-left:20px;line-height:1.7;\">\n<li style=\"margin-bottom:10px;\"><strong style=\"color:#69d8ed;\">Remote maintenance access is a target.<\/strong> Attackers misuse credentials, vulnerabilities or remote access software installed after gaining entry.<\/li>\n<li style=\"margin-bottom:10px;\"><strong style=\"color:#69d8ed;\">An incident can affect customers.<\/strong> A compromised service provider account can give attackers access to connected environments.<\/li>\n<li style=\"margin-bottom:0;\"><strong style=\"color:#69d8ed;\">Access needs multiple layers of protection.<\/strong> MFA, restricted permissions, prompt updates and monitored logs all contribute to security.<\/li>\n<\/ul>\n<\/div>\n<h2>Why RMM access is attractive to attackers<\/h2>\n<p>Remote Monitoring and Management, or RMM, helps IT teams and service providers monitor and manage remote systems. Depending on the product and configuration, it can be used to deploy updates, execute commands or start support sessions.<\/p>\n<p>Attackers can take over existing access or introduce their own remote maintenance programs. The <a href=\"https:\/\/www.cisa.gov\/sites\/default\/files\/2023-02\/aa23-025a-protecting-against-malicious-use-of-rmm-software.pdf\" target=\"_blank\" rel=\"noopener\">joint advisory from CISA, NSA and MS-ISAC<\/a> also describes portable RMM programs that provide access in the context of a local user without full installation or administrator privileges.<\/p>\n<p>A legitimate program name alone is therefore no proof of authorised use. The user account, target system, time and actions performed are among the factors that matter when assessing activity.<\/p>\n<h2>What ScreenConnect and SimpleHelp reveal<\/h2>\n<p><strong>ConnectWise ScreenConnect:<\/strong> The vulnerability CVE-2024-1709, disclosed in 2024, allowed authentication to be bypassed on vulnerable servers. ConnectWise assigned it a CVSS score of 10.0 and provided a fix in version 23.9.8. The vendor also released patched versions for older installations. The vendor&#8217;s current <a href=\"https:\/\/www.connectwise.com\/company\/trust\/security-bulletins\/connectwise-screenconnect-23.9.8\" target=\"_blank\" rel=\"noopener\">security advisories<\/a> are the authoritative reference for operation.<\/p>\n<p><strong>SimpleHelp:<\/strong> In 2025, CISA reported a ransomware incident involving a utility billing software provider. The attackers exploited unpatched SimpleHelp instances. The agency assessed that they likely used the path traversal vulnerability CVE-2024-57727 to gain access to downstream customers. The case shows why service providers must also understand the reach of their remote maintenance access.<\/p>\n<h2>Security checklist for RMM tools<\/h2>\n<p>The following measures are based on the <a href=\"https:\/\/www.cisa.gov\/sites\/default\/files\/2023-06\/guide_to_securing_remote_access_software.pdf\" target=\"_blank\" rel=\"noopener\">CISA guide to securing remote access software<\/a> and should be adapted to the product and operating model.<\/p>\n<ul style=\"padding-left:1.4em;\">\n<li><strong>1. Take inventory.<\/strong> Document approved RMM products, servers, agents, accounts and connected customer systems. Remove unnecessary installations and investigate unknown remote access programs.<\/li>\n<li><strong>2. Secure accounts.<\/strong> Enable MFA for remote maintenance and administrator accounts. Use phishing-resistant methods where the product supports them. Avoid shared accounts and limit permissions to the tasks and systems required.<\/li>\n<li><strong>3. Restrict access.<\/strong> Make management interfaces accessible only to authorised users and necessary networks. Network segmentation and access controls limit which systems can be reached through an account.<\/li>\n<li><strong>4. Prioritise updates.<\/strong> Monitor vendor advisories and promptly apply security updates to servers and agents. For critical vulnerabilities, also check whether the installation has already been attacked.<\/li>\n<li><strong>5. Monitor activity.<\/strong> Log sign-ins, sessions, account changes and administrative actions. Investigate unusual source addresses and times as well as unauthorised programs.<\/li>\n<li><strong>6. Involve service providers.<\/strong> Agree responsibilities for updates, logs and incident reporting. Regularly review which customer environments a service provider account is allowed to access.<\/li>\n<\/ul>\n<h2>Acting on suspected misuse<\/h2>\n<p>The incident response team should restrict the affected access in line with its incident response plan and preserve relevant logs. It should then establish which accounts, sessions and connected systems may be affected.<\/p>\n<p>An update closes a vulnerability but does not automatically remove unauthorised access already established. Accounts, configuration and affected systems must therefore also be investigated before systems are brought back online.<\/p>\n<h2 style=\"padding-top:64px;margin-bottom:20px;\">Frequently asked questions<\/h2>\n<p class=\"st-faq-hint\">Each question is closed. Tap to reveal the&nbsp;answer.<\/p>\n<details>\n<summary><strong>Which remote maintenance programs have been misused in attacks?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">CISA describes the misuse of ScreenConnect and AnyDesk, among others. The agency documented an incident involving unpatched SimpleHelp instances.<\/p>\n<\/details>\n<details>\n<summary><strong>How can RMM misuse be detected?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">An up-to-date inventory helps identify unknown programs. Sign-in and session logs can reveal access at unusual times or from unexpected source addresses. Anomalies must be assessed in the context of the relevant environment.<\/p>\n<\/details>\n<details>\n<summary><strong>Is a patch enough after an attack?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">No. A patch fixes the relevant vulnerability. Accounts that have already been created, changed settings or additional access may remain and must be investigated.<\/p>\n<\/details>\n<p><!--ST-LOWER-CARDS lang=en--><\/p>\n<h3 style=\"margin:48px 0 18px;font-size:1.05em;font-weight:800;color:#e6e3da;line-height:1.2;\">Editor&#8217;s Picks<\/h3>\n<p><a href=\"https:\/\/www.securitytoday.de\/en\/2026\/03\/17\/identity-security-gap-what-zero-trust-doesnt-protect-and-how-to-close-it\/\" style=\"display:flex;align-items:center;gap:14px;padding:12px 14px;margin:0 0 10px;background:#23261f;border:1px solid rgba(105,216,237,0.18);border-radius:12px;box-shadow:0 6px 18px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;box-sizing:border-box;width:100%;\"><span style=\"flex:0 0 116px;aspect-ratio:16\/9;overflow:hidden;border-radius:8px;background:#111210;border:1px solid rgba(230,227,218,0.08);display:block;\"><img decoding=\"async\" src=\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/03\/identity-security-gap-cybersecurity-250x167.jpeg\" alt=\"\" loading=\"lazy\" width=\"116\" height=\"65\" style=\"width:100%;height:100%;object-fit:cover;display:block;\"><\/span><span style=\"display:block;min-width:0;\"><span style=\"display:block;font-size:0.68em;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:#69d8ed;margin-bottom:5px;\">Editor&#8217;s Pick<\/span><span style=\"display:block;font-size:1.0em;font-weight:650;line-height:1.35;color:#e6e3da;overflow-wrap:anywhere;\">Identity Security Gap: What Zero Trust Misses and How to Close It<\/span><\/span><\/a><a href=\"https:\/\/www.securitytoday.de\/en\/2026\/02\/27\/cloud-misconfigurations-the-10-most-dangerous-security-gaps-in-aws-and-azure\/\" style=\"display:flex;align-items:center;gap:14px;padding:12px 14px;margin:0 0 10px;background:#23261f;border:1px solid rgba(105,216,237,0.18);border-radius:12px;box-shadow:0 6px 18px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;box-sizing:border-box;width:100%;\"><span style=\"flex:0 0 116px;aspect-ratio:16\/9;overflow:hidden;border-radius:8px;background:#111210;border:1px solid rgba(230,227,218,0.08);display:block;\"><img decoding=\"async\" src=\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/11\/cloud-fehlkonfigurationen-top-10-sicherheitsluecken-aws-azure-cover-hero-250x167.jpg\" alt=\"\" loading=\"lazy\" width=\"116\" height=\"65\" style=\"width:100%;height:100%;object-fit:cover;display:block;\"><\/span><span style=\"display:block;min-width:0;\"><span style=\"display:block;font-size:0.68em;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:#69d8ed;margin-bottom:5px;\">Editor&#8217;s Pick<\/span><span style=\"display:block;font-size:1.0em;font-weight:650;line-height:1.35;color:#e6e3da;overflow-wrap:anywhere;\">Cloud misconfigurations: 10 major AWS and Azure risks<\/span><\/span><\/a><a href=\"https:\/\/www.securitytoday.de\/en\/2026\/03\/07\/agentic-ai-security-when-ai-agents-become-the-attack-target\/\" style=\"display:flex;align-items:center;gap:14px;padding:12px 14px;margin:0 0 10px;background:#23261f;border:1px solid rgba(105,216,237,0.18);border-radius:12px;box-shadow:0 6px 18px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;box-sizing:border-box;width:100%;\"><span style=\"flex:0 0 116px;aspect-ratio:16\/9;overflow:hidden;border-radius:8px;background:#111210;border:1px solid rgba(230,227,218,0.08);display:block;\"><img decoding=\"async\" src=\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/03\/agentic-ai-security-robot-250x167.jpeg\" alt=\"\" loading=\"lazy\" width=\"116\" height=\"65\" style=\"width:100%;height:100%;object-fit:cover;display:block;\"><\/span><span style=\"display:block;min-width:0;\"><span style=\"display:block;font-size:0.68em;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:#69d8ed;margin-bottom:5px;\">Editor&#8217;s Pick<\/span><span style=\"display:block;font-size:1.0em;font-weight:650;line-height:1.35;color:#e6e3da;overflow-wrap:anywhere;\">Agentic AI Security: When AI Agents Become the Attack Target<\/span><\/span><\/a><\/p>\n<h3 style=\"margin:48px 0 18px;font-size:1.05em;font-weight:800;color:#e6e3da;line-height:1.2;\">More from the MBF Media Network<\/h3>\n<p><a href=\"https:\/\/mybusinessfuture.com\/en\/cybersecurity-boom-why-nis2-is-turning-germanys-security-industry-into-a-growth\/\" style=\"display:flex;align-items:center;gap:14px;padding:12px 14px;margin:0 0 10px;background:#23261f;border:1px solid rgba(105,216,237,0.18);border-radius:12px;box-shadow:0 6px 18px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;box-sizing:border-box;width:100%;\"><span style=\"flex:0 0 116px;aspect-ratio:16\/9;overflow:hidden;border-radius:8px;background:#111210;border:1px solid rgba(230,227,218,0.08);display:block;\"><img decoding=\"async\" src=\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/11\/net-cybersecurity-boom-nis2-deutschlands-sic-59382484-250x166.jpg\" alt=\"\" loading=\"lazy\" width=\"116\" height=\"65\" style=\"width:100%;height:100%;object-fit:cover;display:block;\"><\/span><span style=\"display:block;min-width:0;\"><span style=\"display:block;font-size:0.68em;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:#aa8ac2;margin-bottom:5px;\">MyBusinessFuture<\/span><span style=\"display:block;font-size:1.0em;font-weight:650;line-height:1.35;color:#e6e3da;overflow-wrap:anywhere;\">Cybersecurity Boom: NIS2 Drives Germany\u2019s Security Growth<\/span><\/span><\/a><a href=\"https:\/\/www.digital-chiefs.de\/en\/ciso-compliance-under-nis2\/\" style=\"display:flex;align-items:center;gap:14px;padding:12px 14px;margin:0 0 10px;background:#23261f;border:1px solid rgba(105,216,237,0.18);border-radius:12px;box-shadow:0 6px 18px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;box-sizing:border-box;width:100%;\"><span style=\"flex:0 0 116px;aspect-ratio:16\/9;overflow:hidden;border-radius:8px;background:#111210;border:1px solid rgba(230,227,218,0.08);display:block;\"><img decoding=\"async\" src=\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/11\/net-managed-security-services-ciso-complianc-33809373-250x143.jpg\" alt=\"\" loading=\"lazy\" width=\"116\" height=\"65\" style=\"width:100%;height:100%;object-fit:cover;display:block;\"><\/span><span style=\"display:block;min-width:0;\"><span style=\"display:block;font-size:0.68em;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:#e8828d;margin-bottom:5px;\">Digital Chiefs<\/span><span style=\"display:block;font-size:1.0em;font-weight:650;line-height:1.35;color:#e6e3da;overflow-wrap:anywhere;\">Managed Security Services: CISO Does Not Bear Sole Liability<\/span><\/span><\/a><a href=\"https:\/\/www.cloudmagazin.com\/en\/2026\/03\/25\/container-supply-chain-security-how-it-teams-can-secure-their-software-supply-ch\/\" style=\"display:flex;align-items:center;gap:14px;padding:12px 14px;margin:0 0 10px;background:#23261f;border:1px solid rgba(105,216,237,0.18);border-radius:12px;box-shadow:0 6px 18px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;box-sizing:border-box;width:100%;\"><span style=\"flex:0 0 116px;aspect-ratio:16\/9;overflow:hidden;border-radius:8px;background:#111210;border:1px solid rgba(230,227,218,0.08);display:block;\"><img decoding=\"async\" src=\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/11\/net-container-supply-chain-security-wie-it-t-38170336.jpg\" alt=\"\" loading=\"lazy\" width=\"116\" height=\"65\" style=\"width:100%;height:100%;object-fit:cover;display:block;\"><\/span><span style=\"display:block;min-width:0;\"><span style=\"display:block;font-size:0.68em;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:#0bb7fd;margin-bottom:5px;\">cloudmagazin<\/span><span style=\"display:block;font-size:1.0em;font-weight:650;line-height:1.35;color:#e6e3da;overflow-wrap:anywhere;\">Container Supply Chain Security: IT Teams Secure Software Chains<\/span><\/span><\/a><!--\/ST-LOWER-CARDS--><\/p>\n<h3>More from the MBF Media network<\/h3>\n<ul>\n<li><a href=\"https:\/\/mybusinessfuture.com\/en\/cybersecurity-boom-why-nis2-is-turning-germanys-security-industry-into-a-growth\/\">Cybersecurity boom: NIS2 as a driver of growth<\/a><\/li>\n<li><a href=\"https:\/\/www.digital-chiefs.de\/en\/ciso-compliance-under-nis2\/\">Managed security services: The CISO is not solely liable<\/a><\/li>\n<li><a href=\"https:\/\/www.cloudmagazin.com\/en\/2026\/03\/25\/container-supply-chain-security-how-it-teams-can-secure-their-software-supply-ch\/\">Container supply chain security: Securing IT supply chains<\/a><\/li>\n<\/ul>\n<p style=\"text-align:right;color:#868e96;font-size:0.85em;margin-top:48px;\"><em>Image credit: AI-generated (November 2026)<\/em><\/p>\n<p style=\"text-align:right;\"><em>Image source: AI-generated (November 2026)<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"RMM access connects IT service providers to multiple endpoints. A checklist shows how businesses can secure this access.","protected":false},"author":50,"featured_media":26120,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_focuskw":"rmm tools","_yoast_wpseo_title":"RMM tools as an entry point: Security checklist","_yoast_wpseo_metadesc":"Securing RMM tools: What the ScreenConnect and SimpleHelp incidents reveal and what CISA recommends for remote access.","_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_meta-robots-adv":"","_yoast_wpseo_canonical":"","_yoast_wpseo_opengraph-title":"","_yoast_wpseo_opengraph-description":"","_yoast_wpseo_opengraph-image":"","_yoast_wpseo_opengraph-image-id":0,"_yoast_wpseo_twitter-title":"","_yoast_wpseo_twitter-description":"","_yoast_wpseo_twitter-image":"","_yoast_wpseo_twitter-image-id":0,"evm_kih_original":false,"_evm_slot_owner":"","evm_cvss":0,"evm_risk":0,"evm_casefile":"","evm_primary_cve":"","evm_pin_until":0,"evm_external_preview_token":"","evm_external_preview_expires":"","_evm_translation_lang":"","featured_post":0,"featured_post_sortierung":0,"_wp_old_slug":["post_id-5459"],"footnotes":""},"categories":[255],"tags":[],"class_list":["post-7649","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-praxis-umsetzung-en"],"evm_reading_time_minutes":5,"wpml_language":"en","wpml_translation_of":5459,"_links":{"self":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/7649","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/users\/50"}],"replies":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/comments?post=7649"}],"version-history":[{"count":13,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/7649\/revisions"}],"predecessor-version":[{"id":26409,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/7649\/revisions\/26409"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media\/26120"}],"wp:attachment":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media?parent=7649"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/categories?post=7649"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/tags?post=7649"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}