Security
Hardening your remote access
· 7min read
What the platform already enforces
Start with what is already guaranteed, because it does not depend on your configuration:
- mandatory MFA on every technician account (TOTP, passkeys, FIDO2);
- TLS 1.3 on the single port 443;
- AES-256-GCM session encryption with per-session ECDH keys;
- mandatory user confirmation before any file transfer;
- a hash-chained audit log.
Hardening means using these guarantees well, not recreating them.
Enable the strongest MFA
- Prefer passkeys or a FIDO2 key over TOTP for administrator accounts: they resist phishing.
- Make sure each technician has their own account. Shared accounts weaken the audit: you no longer know who did what.
- On the Business plan, connect SAML or OIDC SSO to your identity provider.
Constrain sessions
- Reserve unattended access for machines you are responsible for. See Unattended access: configuration.
- Use attended sessions whenever a user can confirm actions.
- Remind users that a 6-digit code is only shared with the person assisting them. Ubidesk never starts a session toward a user unless the user joins it.
Use the hash-chained log
- Enable audit-log export to your SIEM from day one: Syslog, Splunk or Microsoft Sentinel.
- Create alerts on sensitive events: off-hours sign-ins, new technician accounts, file transfers.
- Review the log after every incident, not only during annual audits.
Choose and lock data residency
Pick the region (EU, Canada or United States) when creating the workspace, based on your legal and contractual obligations. Changing it later means a data migration: decide before going to production.
Session recording
On Pro and above, session recording adds a layer of evidence. Tell users about it, and set a retention period aligned with your internal rules.
Final checklist
- Passkey or FIDO2 MFA for administrators
- SSO configured (Business plan)
- SIEM export active and alerts created
- Data residency chosen and documented
- Recording policy defined and communicated
- Agent fleet reviewed, decommissioned machines removed
- Offboarding procedure for technicians: immediate account and token revocation