Topic starter
06/11/2026 6:38 pm
TL;DR: Zero trust changes remote access from network-based trust to session-based verification, with MFA, approval workflows, scoped access, automatic termination, and session logging reducing the blast radius of compromised credentials and limiting third-party movement, according to Admin By Request.
Editorial analysis by NHI Mgmt Group, based on content published by Admin By Request: “Remote Access Security Through a Zero Trust Lens”.
Key questions
Q: How should teams reduce the blast radius of compromised remote access credentials?
A: Reduce blast radius by replacing shared remote credentials with per-user or per-service accounts, enforcing MFA, limiting sessions with least privilege, and removing standing access through just-in-time elevation.
Q: Why do persistent remote connections create more risk than just-in-time access?
A: Persistent remote connections keep an always-on authentication path open, so a stolen password, token, or certificate can be reused without a fresh approval step.
Q: How do session logs differ from connection logs in remote access governance?
A: Session logs record what happened inside an active remote session, such as commands, file transfers, privilege changes, and timestamps.
Practitioner guidance
- Audit standing remote connections Inventory persistent VPNs, saved tunnels, and always-on vendor paths, then classify which ones still have a current business justification.
- Scope access to the target system Restrict each remote session to the named endpoint or application needed for the task, rather than the wider network.
- Require approval before session start Gate sensitive remote access behind a documented approval workflow so access is granted only for the specific request.
Bottom line: Remote access risk is driven less by the transport method than by whether the session inherits standing trust after authentication.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:42 pm
Remote access trust has to be redefined at the session level. The old assumption was that successful login established a durable trust relationship. That assumption fails when access is remote, temporary, and shared across employees, vendors, and contractors. The practical consequence is that governance has to move from network membership to explicit session scope.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should teams do first when third-party remote access is too broad?
A: Start by inventorying every third-party account, VPN, shared credential, and vendor tunnel that creates standing access paths, then map each one to a named owner, approved business purpose, and specific target systems. Remove blanket network reach where possible, replace it with least-privilege access, and require time-bound approval plus session logging for any remaining remote access.
👉 Read our full editorial: Zero trust reshapes remote access by removing standing trust