A modality vendor demands a standing remote-support path or voids support: how do you grant it, and what does an intruder inherit?

## Why this is the sharpest exception in the estate The unpatchable population already carries the widest permits you write, because the compensating control is the only control. Now the vendor requires a path in - for diagnostics, calibration, image transfer or licence checks - and threatens the support contract if they do not get it. That path terminates on a machine you may not patch, may not instrument and may not log in to. It is the single most valuable permit an adversary could inherit anywhere in the estate, and it is usually granted once at installation and never examined again. ## Standing versus brokered | Standing permit | Brokered access | | --- | --- | | Reachable at all hours, whether or not anyone is working | Opened on request, closed by an expiry | | Authentication happens at the vendor's end, under their controls | Authentication happens at your broker, against your directory, with your second factor | | Use is indistinguishable from misuse | Every session has a requester, a reason and a window | | Compromise of the vendor is compromise of your segment | Compromise of the vendor still faces your authentication | | No operational cost | Someone must be available to open it, against the vendor's clock | The design position to argue is that the vendor's requirement is reachability *when they need it*, and a contract clause written as always-on is a convenience, not a technical necessity. Most vendors will accept a broker if the alternative is a purchase decision; the leverage exists at renewal and at procurement, which is why the conversation belongs there rather than in a firewall ticket. ## If the device must dial home Some equipment reverses the direction: it originates a persistent outbound connection to the vendor and support arrives back through it. That is often better than an inbound doorway, because the connection is originated by the device rather than by anyone on the internet, but it needs the same discipline. Permit exactly one destination, one port and one direction, from that one address. Deny every other outbound flow the device could originate, including name resolution to anywhere other than your own resolvers, because an intruder on the device would otherwise have a general-purpose outbound channel handed to them. And record the flow, because the absence of the dial-home for three days is a genuine signal that something changed on a host you have no other view into. ## What you can and cannot prove afterwards Be precise here, because interviewers listen for over-claiming. Flow records for the session prove that bytes moved between two endpoints, in what volume, for how long, and nothing about the content. If the transport is encrypted, an on-path observer can typically see the destination name asked for in the handshake and the certificate presented, not the commands run or the files copied. Your broker is what closes that gap: session recording, an authenticated requester, and a start and end time you can correlate against a change to the device. Without the broker, the honest answer to *what did the vendor do on Tuesday* is that you cannot say. ## What an intruder inherits Work it through concretely. Someone who takes the vendor's own support infrastructure or an engineer's credentials arrives at your boundary with an authorised source, at a time nobody reviews, aimed at a machine that keeps no local record. With a standing permit they are already inside the clinical segment. With a broker they must pass your authentication and their session is recorded, which does not stop them but does mean you can answer what happened. This is the whole argument for the operational cost, and it is a supply-chain risk expressed as a firewall rule. ## The rollout order that actually works 1. Enumerate every existing vendor path, because there are always more than the register says. 2. Record what each one is used for and how often - many are used twice a year, which weakens the always-on argument considerably. 3. Stand up the broker and migrate the low-friction vendors first, so the pattern is proven before you argue with the difficult one. 4. Take the remaining standing permits to the contract owner with the usage data, and make the change a condition of the next renewal or purchase. 5. Keep the ones you cannot move, narrowed to one destination and one port, on an exception with an expiry and a named owner. ## The summary answer Grant the access, refuse the shape. Terminate the vendor on something you control, make the path exist only while it is being used, keep the device's own permitted originations narrow enough to be useless, accept that you are buying an on-call obligation, and be honest that boundary records show movement and not content.