BlogCybersecurity
Managing privileged access in outsourced IT
An IT provider may have broad access to business systems. Know which accounts provide it, how access is reviewed and what happens during an incident.
Your staff can log in, the accounts are running and laptops update automatically. Everything seems well managed. But behind that day-to-day reliability there is often one party with unusually broad access: your IT provider.
What happens if the software that provider uses to manage your systems has a serious security flaw? This week, that became a very real question.
A security problem at the company behind your IT
On Sunday 8 November, security researcher Sean Bales published information and proof-of-concept code for 33 alleged vulnerabilities in N-able N-central. IT providers use this software to manage customers’ computers and servers remotely. The collection was named *Able2Shell*.
The next day, N-able temporarily took its hosted N-central environments offline. Organisations running N-central on their own servers were also advised to shut them down until a safe solution was available.
That is a significant step. Turning off management software means IT teams lose some of their normal visibility and control over systems.
Why such a strong response? According to the published findings, combinations of vulnerabilities could allow unauthorised administrator accounts to be created, data to be read and commands to be run on the management server. Some attack paths reportedly do not require an existing user login.
Important: this does not mean that every vulnerability has been independently confirmed or that customers were actually hacked. On 10 November, N-able reported scans related to the published proof-of-concept code, but at that point had no evidence of successful attacks on customer environments.
Why this matters to a business with twenty employees
You may never have heard of N-central. That is normal: many small and medium-sized businesses outsource IT management. The provider chooses the tools; the business gets working laptops, email and support.
That is usually efficient. With *remote monitoring and management* software, or RMM, an IT provider can install updates, investigate faults and offer technical support without visiting your office.
That useful central access also makes the system sensitive. Think of a key ring that opens several offices. The person managing it can help quickly. If it is lost, you need to replace it and work out which doors it could open.
For a smaller business, the practical impact might be uncertainty about workstation security, an IT helpdesk that temporarily cannot resolve issues remotely or necessary updates being delayed. These are possible consequences, not confirmed damage to N-central customers.
The incident shows that security does not stop at your own passwords, firewall or antivirus. The suppliers you trust are part of your risk too.
Should you be worried now?
Not every business is directly affected. This specific incident is relevant if your IT team or external provider uses N-able N-central. If you do not use that software, this alert alone is not a reason to switch off systems.
You also do not need to identify the technical vulnerabilities yourself. But this is a good moment to ask your IT provider how management is set up and what they would do during an incident.
Four questions can provide a lot of clarity:
- Which software manages our computers and servers remotely? Is N-central among the tools used?
- If you use N-central, have N-able’s recommendations been followed? Ask specifically whether vulnerable management servers were taken offline and how safe operation will resume.
- Have you checked for unusual activity? Look for unexpected administrator accounts, unfamiliar logins or unknown management tasks.
- What happens if the management software is temporarily unavailable? Can urgent security updates, monitoring and support continue another way?
A good IT provider does not need to promise that vulnerabilities will never occur. A good answer explains which systems could be affected, what has already been done and which checks are still needed.
The difficult choice: stay available or shut down safely
Perhaps the most striking part of this case is not the number of reported vulnerabilities, but the decision to temporarily disable a widely used management service.
IT usually focuses on availability: systems should work, staff should keep moving and customers should notice as little maintenance as possible. Faced with a potentially serious security issue, stopping temporarily may be the wisest decision.
That takes preparation. A provider that depends entirely on one central management environment for monitoring, patching and support needs to consider alternatives in advance. That applies to the IT provider and to the agreements a business has with its supplier.
A software update may not be enough either. If a system may already have been accessed, someone should check whether unauthorised accounts were created or management actions were performed. The right recovery steps depend on the evidence and the supplier’s instructions.
What we can learn from this incident
The main lesson for smaller businesses is not that outsourcing IT is unsafe. It is that outsourcing does not mean outsourcing responsibility.
You do not have to become a security researcher. But you should know who can access your systems, which tools they use and how quickly your provider can act if one of those tools is vulnerable.
The N-central incident makes that risk visible. The coming days should clarify which recovery measures are needed and whether confirmed compromises emerge. Until then, separate established facts from possible consequences.
A useful question for your IT provider is not only “Are our systems secure?” Ask also: “What will we do if your management system is unavailable or cannot be trusted tomorrow?”
Sources: N-able · Rapid7 · BleepingComputer · Huntress
