Hiring an outsourcer to roll out a system, letting a vendor connect remotely for equipment maintenance, bringing in a freelancer for a temporary project… small and medium-sized businesses are putting “outsiders” onto their corporate network almost every day. Yet when it comes to these third-party personnel, what permissions they should be given, for how long, and whether the access channel is still open after they leave — many companies simply have no one managing any of it. Today we’ll spell out the real risks of outsourcing and third-party access to your internal network, why “just give them a VPN account” is the most dangerous approach, and how to achieve “open on demand, auto-close on expiry, fully logged end to end”.
The Bottom Line First
The biggest risk of third-party access to your internal network isn’t that “the other party is a bad actor” — it’s that permissions are too broad, access stays open too long, and no one is watching. A single shared VPN account or one long-open remote channel can become the springboard for an external attack into your internal network. The right approach is to treat third parties as “temporary, limited, auditable” visitors: open only the one or two systems they need to touch this time, set a time limit, close access when they’re done, and keep a full trail — rather than handing over an all-powerful account that reaches the entire internal network.
What Can Go Wrong When Outsourcers/Third Parties Enter Your Internal Network
- One account, the whole internal network: You only wanted the vendor to fix one server, but the account you handed over can roam the entire network — finance, OA, and file servers are all in range.
- Channels left open indefinitely: The project wrapped up long ago, but the remote account opened back then is still there. A few months later no one remembers it, and it has become a “zombie entry point.”
- Shared and reused accounts: Several people on the outsourcing team use one account, so when something goes wrong there’s no way to tell who did it.
- The other party’s security posture is out of your control: A third party’s computer may be infected, their password may be weak. Once their account leaks, it’s as if you handed over the keys to your internal network.
- No evidence when something goes wrong: Data gets exfiltrated and configurations get scrambled, yet there is no access record at all — leaving you unable to run compliance audits or hold anyone accountable after the fact.
Five Things to Control in Third-Party Access
Turn the points below into a third-party access approval/revocation checklist and go through it item by item every time you let someone in:
| What to control | How to do it |
|---|---|
| Access scope | Open only the machine or system to be touched this time; everything else stays invisible and unreachable |
| Access duration | Set an expiry so access lapses automatically; even for long-term maintenance, review and renew monthly or quarterly |
| Account ownership | One person, one account. Outsourcing teams must not share a single account, so you can trace who did what |
| Identity verification | Require identity verification at login. Add a phone or one-time code layer where possible — don’t rely on a password alone |
| Activity trail | Who, when, what was accessed, and what was done — all of it must be searchable in logs |
Why “Just Give Them a VPN Account” Is the Worst Option
- Once in, you’re everywhere: Traditional remote access usually means “connect and you’re inside the internal network,” and it is very hard to restrict someone to a single machine.
- Everything is manual: Opening and closing accounts both require the administrator to do it by hand. When things get busy it gets forgotten, and the channels pile up.
- Nothing is visible or traceable: What the other party accessed or changed inside is essentially unrecorded.
- Shared accounts invite finger-pointing: When one account is used by several people, no one owns up when something goes wrong, and accountability cannot be enforced.
The Right Approach: On-Demand Authorization + Automatic Revocation on Expiry
The core idea is to turn third-party access from “hand over a universal entry point” into “open one precise, narrow door for this specific need”:
- Unified identity entry point: Third parties must also pass an identity check first, with accounts and permissions managed centrally in one console instead of scattered across systems.
- Least privilege: Authorize only the one or two resources they need this time. Other internal systems stay completely “invisible” to them — unseen and unreachable.
- Time-limited access: Authorizations carry an expiry and lapse automatically when the project ends or the time is up — no relying on an administrator to remember to shut them off.
- One person, one account + auditable: Every third-party individual gets a separate account, with complete access records retained — so you can investigate incidents and produce evidence for compliance.
For small and medium-sized businesses, the least hassle comes from a SaaS-based zero trust solution. Take sTrust as an example: outsourcing and vendor staff who need to reach the internal network all verify their identity at a unified entry point first, and business systems stay “invisible” to the public internet. The console grants fine-grained authorization by account and by resource — open only the system they need to touch this time, set an expiry, and revoke everything with one click by disabling the account in the console when they’re done, with a full access log throughout. The control plane is hosted in China, has completed its ICP filing, and can support MLPS 2.0 (China’s Multi-Level Protection Scheme) compliance. It is software-based, so there is no hardware to buy, and direct domestic connections are stable. If a Beijing enterprise needs local on-site implementation, Siwenlide can also bundle third-party account management, networking, and remote access together and lend a hand to your in-house IT team.
Three Things You Can Do Right Now
- Take inventory of zombie channels: List every remote account you have ever opened for outsourcers or vendors, and shut down immediately any whose project has already ended.
- Switch to one person, one account: Retire shared accounts and give each third-party individual their own account, so incidents can be traced to a person.
- Set an expiry: From now on, every third party you let in gets an expiry date. No more “permanent channels.”
Frequently Asked Questions
Q: It’s just a vendor fixing something remotely — is all this really necessary?
A: Yes. The most common internal network intrusions come in through a third-party channel that was “opened temporarily and never closed.” The hassle is one-time configuration; what you avoid is a potential data breach.
Q: There are several people on the outsourcing team — isn’t sharing one account just more convenient?
A: We don’t recommend it. Once something goes wrong with a shared account, you cannot tell who did it, and accountability cannot be enforced. Only one person, one account makes traceability possible.
Q: How do I make sure the channel is definitely closed after the project ends?
A: Relying on people to remember is prone to misses. The best approach is a solution that “sets an expiry and lapses automatically,” or one where disabling the account at the unified entry point revokes everything at once — with no manual, one-by-one deletion required.
Q: As an SME with no dedicated security staff, how do we get started?
A: Use a SaaS-based zero trust solution such as sTrust: it is software-based with no hardware to buy, and access can be granted or revoked with a few clicks in the admin console. You can also hand configuration and maintenance to an IT Operations Services provider and treat them as an extension of your own IT team.
Still using a single VPN account to let outsourced staff into your entire internal network?
sTrust Zero Trust Remote Access: third parties are verified first, authorized at fine granularity per resource, access expires automatically at the end of a time-limited window, one account per person with full audit trails, and business systems stay hidden from the public internet — all while supporting MLPS 2.0 (China’s Multi-Level Protection Scheme). It is software-based with no hardware to buy, and delivers stable direct connections within China. Visit strust.siwenlide.com for a free trial; Beijing-based companies can call 400-686-2011 or visit siwenlide.com.
