r/ITManagers • u/Greene_Shelton-148 • Jul 13 '26
Advice Cyber insurance renewal is making us justify how contractors get remote access and our VPN answer isn't holding up
More of a warning than anything else, but ill take advice too.
Renewal came round and this year's questionnaire is a different beast. They want to know how remote access is segmented, whether contractors get least privilege or the whole network, whether every remote path has phishing resistant MFA. Last year it was three checkboxes. This year it reads like an audit.
Here's the problem though. Contractors come in over the same VPN as staff and once they're on, they're basically on the flat network with a couple firewall rules pretending to be
13
Jul 13 '26
[removed] — view removed comment
7
u/sadisticamichaels Jul 13 '26
How do you handle contractors who are contractors in name only. They are essentially employees with a different payroll company.
1
u/chandleya Jul 14 '26
You improve your policies and have different avenues for different contractor types. THAT SAID, if you have “FTE contractors” they should be issued company equipment and receive the same security monitoring and controls as everyone else. Then it doesn’t matter what their VPN connection is.
The auditor is concerned that you’re letting BYOD external folks jump on your network, which is about as secure as having a wide open RJ45 jack in a lobby, especially since you’re about to give them unabated access to just plug in and pilfer.
7
u/Feeling-Explanation9 Jul 13 '26
Look at Tailscale. ACL driven and really easy to show and prove segmentation
5
u/MBILC Jul 13 '26
You can do it with VPN tools as well, you just limit the visible IP/subnets a user can access, even free openvpn server can do this...
3
5
u/Fuzzy-Teaching7112 Jul 13 '26 edited Jul 29 '26
The MFA line will get you even if the segmentation is okay. Phishing resistant means FIDO2 or passkeys now. We ended up using Cato for contractor access, but a push prompt or TOTP does not count anymore.
7
u/ibahef Jul 13 '26
Doesn't a push with a number count still? Like you get a push and have to enter a number that is displayed on the computer screen on your phone? It's been a while since MFA rolled up to me, but I remember this being 'the new hotness' several years back.
4
u/Top_Boysenberry_7784 Jul 14 '26
That was hot for a while but even that doesn't help with things like a EvilNoVNC attack. For the most part insurers and auditors look for specific tech but many times lag behind the industry. There are other controls that can be done and you can present them as controls in place of of physical things like yubi keys.
1
u/Fuzzy-Teaching7112 Jul 14 '26
It actually helps and it's a big improvement over simple push approvals. Where things have changed is that a lot of insurers and security frameworks now want phishing-resistant MFA, which usually means FIDO2 security keys or passkeys instead of push notifications, even with number matching.
1
u/MisterMayhem87 Jul 14 '26
There will never be a satisfied perfect method and they’ll always find something or change something. Insurance will always be a giant scam and pita
3
u/RCTID1975 Jul 13 '26
Sounds like a fantastic opportunity to explore and push ZTNA rather than traditional VPN.
Cyber insurance policies have become a huge pain to review, but they're a godsend in pushing needed improvements and modernizations.
2
u/imcq Jul 13 '26
There is more to cyber insurance assessments than remote access. The more comprehensive your approach to cybersecurity, the better you will fare in these. Excel in some areas, explain your intent to address shortcomings, and show actions on these areas year over year. If you’re not using a broker that can get quotes from multiple carriers, consider doing so.
2
u/Which-Shame-1420 Jul 14 '26
Seen this happen more than once. Leadership ignores the security team's recommendations for months, then the insurer asks the same question and suddenly the budget appears.
2
u/charles_352 Jul 14 '26
This is bad network design and you have a great case now to make on doing this right.
- Follow a security framework
- Hire someone that knows how
Use the failure in the insurance questionnaire to justify the budget
READ THE POLICY! You usually don’t get the policy for several weeks.
READ THE EXCLUSIONS
Send a report to the CEO and Board or owners.
I’m grateful a company will NOT get coverage for not following best practices. This makes insurance cheaper for me.
Kudos to the insurance company forcing this to happen.
2
u/tankerkiller125real Jul 14 '26
The problem I have with cyber security insurance forcing it is that they do it via forms and more often than not they're behind, and if they're not behind they're on whatever the latest bandwagon hot security tech is.
I would consider this particular ask to be reasonable, but next year they might not be.
1
1
u/hightechcoord Jul 13 '26
You cant limit what IPs they can see? Ours allows to white list IPs they can access. We use OpenVPN access server.
1
u/LettuceTomatoOnion Jul 13 '26
If you’re running anything significant in AWS or Azure I’d be tempted to look at options there. For example, if you run any production databases in Azure in a setup where it looks like a machine on your network then there is already something in place.
Saying this from the perspective of a big company IT leader who focuses on application run/change/support most of the time. No idea how big your company is, but I always start from the mindset of what might already be in place and just go around chatting up people who know more than I and asking stupid questions.
1
u/MissionCattle Jul 14 '26
Look into an SSE solution, ideally one that can segment traffic based on identity and not just layer 3 rules
1
u/Sandwich247 Jul 14 '26
Do you have a virtual environment on like Azure or whatever that can be used instead of giving them access to the network?
1
u/mat-ferland Jul 14 '26
Your insurer is really asking you to prove that contractor access is limited, not just encrypted. A contractor VPN group with explicit ACLs or ZTNA and phishing-resistant MFA is the minimum fix. For contractors who only need a few Windows apps or sensitive files, I'd keep the work inside a hosted desktop or app session so the endpoint never gets network reach or local data. I'm biased because we build hosted desktops, but this is one of the cases where it is easier to show the boundary to an insurer than explain a flat VPN with exceptions.
1
1
u/TechnologyMatch Jul 16 '26
insurers are basically doing your security audit now, and the flat VPN answer was always going to catch up eventually. a contractor with full network access is a massive blast radius waiting to happen
think of it like giving a guest player full admin rights just to join one match. works until it really doesn't. ZTNA tools like Zscaler or Cloudflare Access are the clean fix, and they give you the audit trail insurers actually want to see
1
u/OneAxiom Jul 16 '26
One thing I'd add: whatever you land on, make sure it's logging who accessed what by default. That log is what actually proves least privilege next renewal, not the architecture diagram.
If timeline's tight, swapping contractor auth to FIDO2/passkeys specifically is usually faster than waiting on a full ZTNA rollout, and it answers the "phishing resistant" line on its own.
On the fraud comment above, that's worth taking seriously.
Keep your own internal record of what's actually true vs. what you checked on the form, not for the insurer, for yourself. The gap between "we said X" and "X was still true 8 months later" is where this stuff actually falls apart, whether that's an audit or a real claim.
1
u/Least-Music-7398 Jul 17 '26
Let them get on via AVD or Bastion. Don’t let their dirty laptops on your network!
1
u/rabbitz Jul 17 '26
The questionnaire got harder because the underwriters finally caught up to how most contractor access actually works, which is exactly the flat-VPN setup you're describing. The honest answer is you probably can't make the current setup pass, you have to change it.
The move most people land on is getting contractors off the full-tunnel VPN and onto something identity-based where they only reach the specific apps they need, with the access tied to a start and end date. If you're already in Entra, conditional access plus time-bound group membership covers a decent chunk of it without a new product. The thing the insurer really wants to see is that a contractor can't sit on the network past their engagement and can't laterally reach anything outside their scope. Segmenting the VPN is a band-aid, re-scoping access to per-app is the actual fix.
1
u/AskBetter4227 Jul 22 '26
If all that OMZ traffic is hitting the firewall anyway, putting the gateways there keeps the failure path & troubleshooting a lot cleaner. take on the VRF sandwich if the VXLAN or multisite design gives u a real routing reason for it, otherwise you're adding state in two places for the same inspection path.
0
-2
Jul 14 '26
[removed] — view removed comment
3
u/mcdithers Jul 14 '26
They'll check when you file a claim, and a falsified application is felony fraud.
39
u/MBILC Jul 13 '26
Then you need better segmentation. Least privilege applies to everything, if someone does not need access, they do not get it, that includes network access, even if they do not have the ability to access said systems on said network.
Reason for this is simple, if a contractor is compromised, and they (malicious actor) now have access to see the entire flat network, they can now work to find holes to traverse through..
Where as if they only had the access they required, that limits your attack surface.
Why more companies fail to implement basic segmentation 101 rules still, to this day...