Skip to content

Navigating the complexities of third-party remote access

No modern digital business is totally independent. Cloud computing and ever-changing IT technology force organizations to rely on third parties. And most digital companies cannot exist without a community of trusted partners

Companies look to third-party vendors when sourcing the latest applications and infrastructure. Third-party service providers support cloud deployments. External partners cut administration costs. And they even secure company networks. However, third-party remote access brings problems as well as benefits.

Partners need to access your corporate network. And external access brings security risks. Companies can control how their employees use network assets. Yet, enforcing the same standards for workers at third parties is not easy.

This article will explain how to secure third-party access. We will explore how businesses can create secure platforms with robust access controls. And we will help you navigate the design process to ensure seamless and safe third-party relationships.

What is third-party remote access?

Third-party remote access enables secure remote access for users not directly employed by the network owner. Third-party network users come in various forms.

Click to tweet

  • Contractors provide specific services on a contractual basis. Companies bring in contractors as needed to maintain systems, audit security controls, or fill gaps in their workforce. These individuals may work on-site. But they could also be remote contractors.

  • Vendors supply companies with applications needed to create professional environments. They sell cloud infrastructure and storage space. And they provide hardware to engineer physical networks. Vendors are almost always based off-site and may have minimal contact with clients. But they often need network access to provide services.

Securing third-party connections requires comprehensive risk management strategies. Companies should never allow unrestricted network access for vendors or service providers, regardless of how trusted they are.

Third parties dramatically increase the attack surface of corporate networks. For example, risks associated with external partners include:

Insider threats

Employees at third-party organizations may use legitimate credentials to breach networks. They can steal confidential data, implant malware, or compromise system integrity.

Malware attacks

Any remote connection can become a gateway for a ransomware attack. Companies must monitor every access request and ensure that firewalls cover third parties.

System failure

Companies rely on third parties to support everyday operations. When these services fail, they can compromise client networks.

Regulatory risks

Regulations include strict rules about using third-party providers. A data breach due to poor third-party security can lead to regulatory penalties and reputational damage.

The growing need for external network access

Third parties are a crucial part of the modern business landscape. Few organizations own and operate their network infrastructure. Even fewer develop apps in-house. Using third parties is a business necessity. Cloud service providers are filling that need.

Companies worldwide depend on cloud hosting for data storage and employee collaboration. The public cloud computing market has expanded rapidly from $145 billion in 2017 to almost $600 billion in 2023. And there are plenty of reasons for this shift.

Cloud services make managing workflows cheaper and leaner. Third parties allow companies to switch from legacy apps to flexible cloud tools hosted off-site. Local data centers are unnecessary. Maintenance costs fall as companies become less reliant on physical network infrastructure.

Digital transformations also enable companies to serve their customers more efficiently. For example, merchants use third-party technology to create seamless digital purchasing systems. Or they may use a 3D modeling vendor to deliver augmented reality experiences.

The rush to cloud-hosted services is impossible without remote access for third parties. External partners routinely access client assets to support corporate accounting. Or they might deliver customized eCommerce APIs.

This reliance is not unusual. However, without robust security solutions, third parties represent a data breach risk. Securing access for third parties is a critical security challenge.

Risk management in vendor network entry

Organizations need solid strategies to handle third-party risks. Companies managing remote access for third-parties risks must focus on hazard control and mitigating threats.

Hazard control

Security teams identify the risks linked to each vendor. A typical example is data breaches caused by insider attacks. Risk assessors might identify a risk of credential theft due to poor security practices. Alternatively they might decide that third-party API risks like code injection are more significant.

The consequences of third-party services failing is another critical example. Not every vendor poses an operational risk. However, security planners must identify relevant operational risks.

Threat mitigation

After identifying and classifying risks, security teams apply controls or policies to mitigate those risks. Controls must manage third-party access efficiently. They should also protect data against bad actors. Finding the right balance is challenging.

Companies must create and test incident recovery strategies. Recovery plans should mitigate operational risks from third-party failures. Auditing processes constantly test vendor security. Audits identify new risks before they compromise network security.

Secure your infrastructure: the role of network access control

Access control is the most crucial risk mitigation system when handling third-party hazards. Access controls lock down the network edge. They filter third-party access requests. And they enforce authentication and authorization policies.

Properly designed access control systems allow third parties enough access to carry out core duties. However, they limit network access beyond the assets required to carry out those duties.

Access controls vary depending on the organization involved and the type of third party. But they tend to have similar core components. These components include:

Entry regulation or authentication

Authentication systems demand a third-party vendor’s credentials for each access request. For instance, multi-factor authentication (MFA) demands more than one unique identifier for each user. Authentication combines with firewalls and allowlisting. These tools filter unknown users, adding another defensive line to the network edge.

Permission management

Access management systems assign each third-party vendor the permissions needed to execute their duties. Users cannot access network assets outside the scope of the access policy. Tightly defined privileges limit east-west movement inside the network.

Authorization control

Controls track vendor activity. They determine whether third parties can access network objects. Systems collect data about user access requests and the activities of every third-party vendor. This data is stored in a standardized format, enabling access during management audits.

The three components listed above work in combination. They assess third parties before allowing access. Security systems screen malicious threats and block cyber-attacks at the network edge.

How can you ensure secure network access for third parties?

Organizations need to work with third parties. There is no alternative in a cloud-dominated business landscape. The question is how to create secure network access for every vendor.

The answer lies in a mixture of security technologies and administrative measures. On the security side, essential controls include:

  • IP address allowlisting — enforces lists of approved identities. Filters check IP information when users make connection requests. Users can create grouped filters for approved vendors. You can easily add new contractors and automate the removal of third parties when vendor partnerships end.

  • Network Access Control (NAC) – NAC enforces security policies to admit or exclude network users. Controls check device health and user location. And they can check IP address data and user credentials. Network segmentation also falls under NAC. Users who comply with pre-set conditions can access the network environment.

  • Identity and Access Management (IAM) – Access management systems grant users role-based privileges. Security teams can define resources available for each identity. They can use filters to block all other network assets. When third-party security breaches occur, intruders will have limited scope to access data and apps.

  • Access Keys – These tools allow safe access to cloud platforms like Amazon Web Services. When partners log on, they use a unique access key. Network managers do not need to share their AWS or Google credentials. This reduces the chance of allowing unauthorized access to general network assets.

  • Data Loss Prevention (DLP) – DLP protects sensitive data against unauthorized third-party access. DLP enforces data security policies. It tracks data movements and prevents data extraction without appropriate credentials.

  • Firewalls – Firewalls filter incoming and outgoing traffic. They work alongside IP allowlisting, preventing unauthorized access. You can segment data environments and apply cloud-native firewalls around financial or customer information.

Organizations must also implement administrative safeguards to handle third-party risks.

  • Vendor risk assessments – Companies should carry out risk assessments before commissioning third-party services. IT teams should check the compliance record of potential partners. They should verify that third parties take security seriously.

  • Contract management – Contracts should include clauses related to cybersecurity and data protection. Agreements should state the security responsibilities of the third party. Companies should monitor contracts constantly to detect any policy breaches.

  • Security policy management – Security policies should cover third-party access risks. Comprehensive policies should guide the behavior of third parties. Regularly audit these policies to ensure their effectiveness.

Best practices for 3rd party access control

Companies must secure every third-party connection. If not, data breaches and regulatory penalties will result. However, securing third-party access is complex. And organizations routinely work with hundreds of external partners. So, simplifying the security challenge is critical.

With the correct steps, you can control access safely. And you can do so without compromising the efficiency of vendor-supplied solutions. These best practices will help you achieve complete security.

1. Implement strict access controls

Treat all third-party connections as a potential risk. Assess what resources the third-party needs to carry out their role. Only allow access to those resources. Use Access Management solutions, firewalls, and allowlisting to block everything else.

2. Risk assess all vendors and contractors

Carry out a risk assessment before installing third-party tools or onboarding contractors. Determine how third parties could compromise data and applications. Put in place risk control measures to mitigate those risks.

3. Create secure zones with network segmentation

Some third-party solutions create significant risks but still have a business benefit. In these cases, it makes sense to use network segmentation.

Segmentation creates safe zones guarded by cloud firewalls and access controls. Safe zones act like a containment strategy, protecting the rest of the network.

4. Proactively monitor third-party connections

Continuously monitor third-party connections to detect suspicious behavior or potential cyber-attacks. Use threat detection tools to detect malware or unusual access patterns. But don’t avoid being reactive. Employ proactive NAC tools that block third parties that fail to meet security conditions.

5. Write clear security policies for vendors and internal staff

Provide all third parties with security policies during the onboarding process. Policies should explain the partner’s security responsibilities and penalties for policy breaches. They should detail user permissions and access requirements. They should also document data protection rules.

Security policies should also cover internal employees. Explain how to access third-party network assets securely. And provide training to reinforce safe data handling processes.

6. Provide secure connection tools

Provide secure VPN access for third parties. VPNs encrypt connections and anonymize IP addresses. Secure gateways operate access policies for each third party. Encrypted tunnels separate third-party traffic from the wider internet. Business network managers can control each remote connection.

7. Audit third-party access to ensure security

Regularly audit third-party access. Audits should check that access controls are functioning as designed. Check that third-party privileges are appropriate and that segmentation protects critical data. And routinely check for third-party suppliers that have escaped security controls.

Conclusion: make third-party access secure and smooth

Working with third parties is an unavoidable aspect of modern business. Reliance on third parties is never risk-free. But secure vendor onboarding is always possible. You just need the right tools and security expertise.

NordLayer’s access solutions can secure every third-party vendor relationship.

  • IP Allowlisting admits trusted identities and excludes unknown users.

  • NAC tools assess users at the network edge. Only approved devices and identities can enter the network perimeter.

  • Secure gateways create encrypted tunnels for remote third-party connections.

  • Network segmentation systems implement role-based permissions. Authorized partners can access the resources they need. But everything else remains out of their scope.

  • Enhanced identity verification allows to check a user’s identity with identity management features like MFA and biometrics.

Securing third-party access can be confusing. But NordLayer’s secure access controls help you neutralize critical risks. Get in touch with the NordLayer team today. We’ll find a solution that works for you and your external partners.

In this episode, we dive into: 

  • ChatGPT’s evil twin WormGPT

  • The Federal Trade Commission (FTC) investigation into OpenAI data leak and ChatGPT’s inaccuracy

  • A new 4-day rule for disclosing cyberattacks set by the US Securities and Exchange Commission (SEC)

Watch Cyberview here 

ChatGPT’s evil twin WormGPT

The new tool, WormGPT, is advertised on underground forums as a blackhat alternative to ChatGPT for launching phishing and business email compromise (BEC) attacks. Although, ChatGPT’s natural language abilities can already help hackers write convincing emails, resulting in the obvious signs of malicious emails disappearing.

Tools like ChatGPT and Google’s Bard have some safeguards in place that try to ensure that AI-generated content does not cause harm. However, WormGPT is specifically designed to be fully unrestricted and facilitate criminal activities, so it raises even more questions about the ethical limits of AI.

FTC investigates OpenAI over data leak and ChatGPT’s inaccuracy

Has ChatGPT broken consumer protection laws by risking personal reputations and data? The FTC has opened an investigation into OpenAI, requiring details on how OpenAI gathers and protects data and vets information.

The FTC wants to know how information was used to train its model and how it prevents false claims from being shown to users. Additionally, they are interested in how APIs connect to OpenAI’s systems and how user data is protected, all while the FTC issued multiple warnings that existing consumer protection laws apply to AI.

The 4-day deadline for public companies to report breaches

US companies hit by cyberattacks will face a 4-day deadline for publicly disclosing hacks, under new rules approved by the US Securities and Exchange Commission (SEC). There are mixed feelings about this new requirement. On the one hand, it is praised for encouraging transparency about cybersecurity breaches, as they are considered as important to investors as any other significant operational disruption.

On the other hand, the new rule is being labeled as a controversially short deadline that may not allow companies enough time to put an action plan in place or fix vulnerabilities. Although regulations state that if the SEC is informed in writing of a national security or public safety risk, a delay in breach disclosure of up to 60 days is allowed.

Stay tuned for the next episode of Cyberview.

About Version 2
Version 2 is one of the most dynamic IT companies in Asia. The company develops and distributes IT products for Internet and IP-based networks, including communication systems, Internet software, security, network, and media products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About NordLayer
NordLayer is an adaptive network access security solution for modern businesses – from the world’s most trusted cybersecurity brand, Nord Security.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

CyberLink FaceMe® Achieves Face Recognition Certification from Korea Internet & Security Agency (KISA)

Taipei, TAIWAN – September 7, 2023 – CyberLink Corp. (5203.TW), a pioneer in AI and facial recognition technologies, today announced it has achieved KISA certification for the Korean Market. As the leading Korean cybersecurity organization, the Korea Internet & Security Agency (KISA) is devoted to successful digital innovation for the purpose of creating a safe, trusted, and convenient digital society. Obtaining KISA certification further confirms the superior accuracy and performance of CyberLink’s facial recognition engine, FaceMe®.

KISA Certification Process 

KISA certification, conducted by K-NBTC (National Biometric Testing Center), is based on biometric recognition algorithm performance testing. Certification standards are established via a certification committee comprised of experts focused on securing objectivity in standards and test results, with certificates granted to technologies that meet the committee criteria. Modeled on and ISO international standards, the K-NBTC designed the process to be suitable for global standards, with a goal to promote the export of accurate and interchangeable domestic biometric recognition systems.

FaceMe® Facial Recognition Accuracy Passes with Flying Colors

FaceMe®’s biometric algorithms fully passed K-NBTC’s stringent certification tests with excellent accuracy marks. Under the various such as different lighting conditions, facial expressions, face angles, and accessories, FaceMe® achieved 100% accuracy (0% EER, Equal Error Rate).

FaceMe KISA certification

“As a top ranked AI facial recognition engine, delivering biometric identity verification solutions for a multitude of situations and environments,” said Dr. Jau Huang, CEO of CyberLink. “FaceMe®’s recent KISA certification demonstrates CyberLink’s commitment to ensuring international security requirement compliance.”

In addition to being certified by KISA, FaceMe® has been recognized as an industry leader in facial recognition technologies by other organizations, including NIST and iBeta. FaceMe® achieved an impressive True Acceptance Rate (TAR) of 99.83% in the most recent NIST FRVT 1:1 test (March 9, 2023) and passed iBeta Level 2 Compliant liveness detection tests under the standard of ISO 30107-3 Presentation Attack Detection (PAD). This anti-spoofing technology ensures effective prevention of impersonation or substitution attempts using high-definition photos, videos, or 3D masks.

FaceMe®’s facial recognition technology can be applied not only in various security scenarios such as security monitoring, access control, and employee attendance tracking, but it can also help enterprises significantly reduce manpower and labor costs. Additionally, its high accuracy and robust anti-spoofing technology are excellent for financial services (eKYC) and secure two-factor authentication, helping to address identity theft and account fraud issues currently faced by the financial industry.

About Version 2
Version 2 is one of the most dynamic IT companies in Asia. The company develops and distributes IT products for Internet and IP-based networks, including communication systems, Internet software, security, network, and media products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About CyberLink
Founded in 1996, CyberLink Corp. (5203.TW) is the world leader in multimedia software and AI facial recognition technology. CyberLink addresses the demands of consumer, commercial and education markets through a wide range of solutions, covering digital content creation, multimedia playback, video conferencing, live casting, mobile applications and AI facial recognition.  CyberLink has shipped several hundred million copies of its multimedia software and apps, including the award-winning PowerDirector, PhotoDirector, and PowerDVD.  With years of research in the fields of artificial intelligence and facial recognition, CyberLink has developed the FaceMe® Facial Recognition Engine. Powered by deep learning algorithms, FaceMe® delivers the reliable, high-precision, and real-time facial recognition that is critical to AIoT applications such as smart retail, smart security, and surveillance, smart city and smart home. For more information about CyberLink, please visit the official website at

Child Safety: Understanding the Vital Role of KCSIE Guidance

The digital world has become the new normal and children are exposed to it from an early age. While the internet offers a wealth of information and opportunities, it also presents risks and challenges, especially for young and vulnerable individuals. To address these safeguarding concerns and ensure the safety and well-being of children and young people, the UK government introduced the Keeping Children Safe in Education (KCSIE) guidance. 

KCSIE stands for Keeping Children Safe in Education, and it is a comprehensive set of guidelines issued by the UK government. This statutory guidance is designed to help schools, colleges, and other educational institutions create a safe and secure environment for children, both offline and online. KCSIE provides a framework for safeguarding children from various risks, including abuse, neglect, and online threats, such as child criminal exploitation, sexual abuse or child on child abuse.

Why is KCSIE Important?


Keeping Children Safe in Education (KCSIE)

is of utmost importance because it prioritizes the safety and well-being of children. Nowadays children face online risks like cyberbullying and child sexual exploitation, KCSIE provides a vital framework for schools and colleges to protect them.

It’s not just a legal requirement; it’s a moral obligation.

Educational institutions have legal duties to create a secure environment for children, both online and offline. By adhering to KCSIE, they show their commitment to nurturing a generation that can safely explore the digital world while shielding them from its dangers. This dedication builds trust with parents and guardians, such as school and college staff, ensuring children can learn and grow with confidence.

Main Points and Regulations of KCSIE

  • Child Protection Policies: Educational institutions must have robust child protection policies in place, outlining how they will safeguard children from harm, including online risks.
  • Designated Safeguarding Leads (DSLs): Each institution must appoint one or more designated safeguarding leads responsible for child protection and online safety.
  • Online Safety: KCSIE emphasizes the importance of educating children about online safety and the responsible use of technology. It also requires institutions to have appropriate filters and monitoring systems in place to prevent access to harmful content and maintain cyber security standards.
  • Reporting Concerns: Staff members are required to report any concerns they have about a child’s mental health or welfare promptly, including those related to community safety incidents. Institutions must have mechanisms in place for recording and escalating such concerns.
  • Safer Recruitment: Educational institutions must adhere to strict guidelines for safer recruitment practices to support schools and ensure that individuals who work with children are suitable and safe.
  • Training and Awareness: KCSIE mandates that all staff receive regular training on child protection, including online safety issues, and health education.
  • Information Sharing: The statutory guidance encourages institutions to share information and collaborate with other agencies, such as social services and law enforcement, when necessary to safeguard children, especially in cases of domestic abuse and sexual violence.

Governing bodies and management committees play a pivotal role in overseeing and implementing these regulations.

Important Updates to KCSIE Guidance Effective from September 1st, 2023

Recently, the UK government released an updated version of the statutory safeguarding and child protection guidance for schools and colleges, which includes important changes related to online safety. Effective from September 1st, 2023, these updates address evolving digital challenges in educational settings.

Enhanced DSL Responsibilities: Designated Safeguarding Leads (DSLs) now hold explicit responsibility for safeguarding, including online safety and understanding filtering and monitoring systems. Additional education guidance and support is mandated to aid DSLs in their critical role.

Comprehensive Staff Training: All staff members are now required to undergo safeguarding and child protection training, with a strong focus on online safety and designated safeguarding lead responsibilities. This ensures that staff are well-informed about filtering and monitoring responsibilities.

Integrated Online Safety: Schools must align their online safety approach with their child protection policy. This includes implementing filtering and monitoring systems and setting clear policies for mobile and smart technology use to prevent students from accessing harmful content on school premises.

In essence, these updates proactively address evolving child protection needs, emphasizing DSL responsibilities, child protection guidance, staff training, and the integration of online safety measures into educational institutions. This ensures a safer environment for children both online and offline in the face of new challenges.

The Keeping Children Safe in Education (KCSIE) statutory guidance serves as a crucial framework for educational institutions in the UK to protect children from harm, including online threats of violence and sexual harassment. By understanding and implementing the main points, regulations, and requirements of KCSIE, schools and colleges can create a safer and more secure environment for children to learn and grow, both online and offline. Ultimately, the goal is to ensure that children can explore the digital world with confidence and without compromising their safety.

About Version 2
Version 2 is one of the most dynamic IT companies in Asia. The company develops and distributes IT products for Internet and IP-based networks, including communication systems, Internet software, security, network, and media products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About SafeDNS
SafeDNS breathes to make the internet safer for people all over the world with solutions ranging from AI & ML-powered web filtering, cybersecurity to threat intelligence. Moreover, we strive to create the next generation of safer and more affordable web filtering products. Endlessly working to improve our users’ online protection, SafeDNS has also launched an innovative system powered by continuous machine learning and user behavior analytics to detect botnets and malicious websites.

RADIUS vs. TACACS+: A Comparative Breakdown

With cyber-attacks on the rise, the security and integrity of network systems are paramount. The heart of this security lies in ensuring that users are who they say they are and can only access what they are allowed to. This is where AAA (Authentication, Authorization, and Accounting) protocols play a pivotal role.

As two of the most prominent AAA protocols, TACACS+ and RADIUS have become synonymous with network security. Each has unique characteristics and applications, shaped by decades of development and real-world deployment. 

Today, we’ll dive into the intricacies of both, shedding light on their distinct features, capabilities, and optimal use cases. By understanding the essence of TACACS+ and RADIUS, organizations can make informed decisions, ensuring their networks remain resilient, compliant, and secure in an ever-evolving digital landscape.

When Does AAA Become Critical?

AAA protocols—Authentication, Authorization, and Accounting—are the backbone of robust network security. Authentication verifies a user’s identity. Authorization determines what that user can do once inside the system. Accounting keeps track of user activity, a crucial component for audits and security reviews. Together, these functions form the foundation of a secure network environment.

As businesses grow, the complexity and potential vulnerabilities of their networks increase. Typically, as soon as a company expands beyond a basic IT setup—adding more users, devices, or sensitive data—it becomes crucial to adopt AAA protocols. This not only fortifies their networks against threats but also streamlines user management and ensures compliance with ever-evolving cybersecurity regulations.


Understanding the origins of a protocol can help you understand why it was made and who it was meant to serve. And although technology evolves over time, the core use cases often don’t evolve much. With that in mind, let’s look at how TACACS+ and RADIUS came to be.

TACACS: The story commences in 1984 with TACACS, developed by BBN Technologies for ARPANET and MILNET, early forerunners to today’s internet. Fast forward to the 1990s, Cisco Systems, recognizing the need for advancement, first rolled out XTACACS, a proprietary variant with enhanced features like centralized user management. By 1993, this evolved into TACACS+, a more secure, feature-packed open standard. Today, TACACS+ stands tall as a preferred choice for AAA in sophisticated enterprise networks.

RADIUS: In 1991, Livingston Enterprises introduced RADIUS as a counterpoint to TACACS. Envisioned as a streamlined, efficient alternative, RADIUS made its mark with a less complex architecture, making it a go-to for networks that prioritized simplicity. Its design centered on a client-server model, where a centralized server manages authentication requests from various network devices. The protocol’s strength lies in its versatility – from VPNs to wireless networks, RADIUS supports a wide array of applications. Its adaptability to diverse network needs and support for a broad spectrum of authentication methods, like tokens and smart cards, made it a popular pick.

RADIUS Explained

The complexities of network access and security necessitate solutions that are both robust and efficient. Among these solutions, RADIUS (Remote Authentication Dial-In User Service) holds a distinguished position, providing a framework that simplifies and centralizes AAA.

While RADIUS was initially designed to authenticate dial-up network connections, its adaptability and effectiveness led to its application across various network types, including Wi-Fi, VPNs, and even wired Ethernet configurations.

How RADIUS Works

The strength of RADIUS lies in its client-server model. Let’s break this down. The Client is a user’s device or a network equipment seeking access. And the Server is the RADIUS server, housing user credentials and access policies.

Here’s how the authentication process unfolds:

  1. Initiation: The user’s device, acting as a RADIUS client, sends a connection request to the Network Access Server (NAS).
  2. Forwarding: The NAS then channels this request to the RADIUS server.
  3. Verification: Here, the pivotal moment of authentication occurs. The RADIUS server evaluates the presented credentials against its database of authorized users.
  4. Response: Upon successful verification, the RADIUS server issues an “Access-Accept” message, empowering the NAS to grant the user access. Conversely, if the credentials are mismatched, access is denied.

Advantages of Centralization

RADIUS offers centralized user management. Network administrators are equipped with a singular control point to manage user credentials and permissions, enhancing operational efficiency. Moreover, this centralized approach ensures that any modifications to user privileges or new additions are immediately reflected across the network.

In addition, RADIUS is not just about granting access; it’s also about accountability. Detailed logs of user activity can be generated, serving as invaluable tools for audits, troubleshooting, or assessing network health and usage patterns.

Pros and Cons of RADIUS

Pros of RADIUS
  • Centralized Authentication: Centralized authentication not only streamlines user access management but also provides a more coherent framework to monitor and log user activities, ensuring consistent oversight and control.
  • Flexible Authorization: RADIUS shines when it comes to crafting bespoke authorization policies. Administrators have the liberty to tailor permissions based on user roles, device types, and even specific situational criteria, allowing for adaptive and precise network access management.
  • Accounting: Whether it’s for billing users based on their network consumption or diagnosing potential network hiccups, RADIUS offers many tools to document and evaluate user activity.
  • Widespread Support: One of RADIUS’s undeniable strengths is its universal acceptance. Many devices, spanning varied operating systems, recognize and support the RADIUS protocol, facilitating its widespread adoption.
  • Open Standard: Unshackled by vendor-specific constraints, RADIUS is an open standard. This ensures enhanced device interoperability and reinforces security since the protocol benefits from collective expert scrutiny and development.
Cons of RADIUS

Some additional factors to consider with RADIUS include:

  • Password Security: RADIUS uses cleartext passwords by default – so it is essential to use a strong encryption method for RADIUS passwords or opt for passwordless authentication methods.
  • Single point of failure: Because RADIUS authentication relies on a central server, if that server goes down or experiences other issues, it could potentially prevent users from accessing the network. Portnox allows customers to add an additional layer of redundancy through a local RADIUS server either on-prem on in their private cloud.

Overall, RADIUS is a versatile and robust protocol that can be used to manage user access to various networks. However, it is essential to be aware of its limitations before deploying it in a production environment.

TACACS+ Explained

What is TACACS+

TACACS+, short for Terminal Access Controller Access Control System Plus, is a network security protocol designed to offer centralized authentication, authorization, and accounting services for remote access servers. Compared to RADIUS, TACACS+ offers enhanced security and flexibility, making it a preferred choice for many organizations.

How TACACS+ Works

TACACS+ uses a client-server model. The client is the remote access server requesting access to the network. The server is the TACACS+ server that is responsible for authenticating the user and authorizing their access to the network.

The flow of operations for TACACS+ works like this:

  1. The remote access server sends a request to the TACACS+ server to authenticate a user.
  2. The TACACS+ server queries its database to verify the user’s credentials.
  3. If the user’s credentials are valid, the TACACS+ server sends an authorization message to the remote access server.
  4. The remote access server uses the authorization message to determine what resources the user is allowed to access.
  5. The remote access server grants or denies the user access to the network based on the authorization message.

TACACS+ is often favored in networks that prioritize security and adaptability. Its common use cases include:

  • Remote Access: Authenticating and authorizing users accessing the network from remote locations, like through a VPN.
  • Network Devices: Ensuring only authorized users can access network devices like routers and switches.
  • Servers: Validating and granting permissions to users accessing various servers, including web and database servers.

Pros & Cons of TACACS+

Pros of TACACS+
  • Increased security: TACACS+ encrypts all traffic between the client and server, which helps to protect user credentials and network traffic from unauthorized access.
  • Greater flexibility: TACACS+ allows for more granular authorization control than RADIUS. This means that administrators can fine-tune what resources users are allowed to access based on their role or group membership.
  • Scalability: TACACS+ is designed to scale to large networks with a large number of users.
  • Per-command authorization: TACACS+ allows administrators to control which commands users are allowed to run on network devices. This helps to prevent unauthorized access to sensitive commands.
  • Audit trail: TACACS+ keeps a detailed audit trail of all authentication, authorization, and accounting events. This helps to track user activity and troubleshoot security incidents. 
Cons of TACACS+

Here are some additional things to consider when evaluating TACACS+:

  • Your Network Size & Complexity: TACACS+ is a good choice for large and complex networks where security is a top priority. However, it may not be necessary for small or simple networks.
  • Allocated Budget: TACACS+ servers are typically more expensive than RADIUS servers. However, the cost of TACACS+ can be offset by the increased security and flexibility it offers.
  • Vendor Support: Not all network devices and servers support TACACS+.

Overall, TACACS+ is a powerful and secure AAA protocol, but like any technology it does have some limitations. It is essential to weigh the benefits and limitations of TACACS+ before deploying it in your network.

How RADIUS and TACACS+ Support Zero Trust

Today, more and more organizations are turning to Zero Trust security models. This rise in popularity stems from the escalating cyber threats and the shifting work landscape, notably remote work.

Both RADIUS and TACACS+ enhance Zero Trust security. This framework, rooted in “never trust, always verify,” demands rigorous user validation. RADIUS excels in authentication and accounting, while TACACS+ distinctly manages authentication, authorization, and accounting.

With their centralized controls, they authenticate users and set precise permissions, ensuring users access only relevant resources. By consistently verifying identities and restricting access, RADIUS and TACACS+ underpin Zero Trust, mitigating unauthorized breaches.

RADIUS vs. TACACS+: A Snapshot of Differences

Protocol and ports

RADIUS operates on the User Datagram Protocol (UDP). As a connectionless protocol, UDP typically offers faster transmission because it doesn’t establish a formal connection between devices. However, this also means UDP lacks the reliability that comes with guaranteed packet delivery. In contrast, TACACS+ relies on the Transmission Control Protocol (TCP). Being a connection-oriented protocol, TCP ensures that packets are delivered, granting TACACS+ greater reliability at the cost of speed.


A noticeable difference in security exists between the two. RADIUS only encrypts the password within the access-request packet during transmission from the client to the server, leaving the rest of the packet, which could contain sensitive information like usernames and accounting details, vulnerable to interception. TACACS+, on the other hand, encrypts the entire packet content, offering a more comprehensive security layer than RADIUS.


The structure of RADIUS amalgamates authentication and authorization, making it a unified process. While efficient, this setup may not offer the same level of adaptability as TACACS+, which separates authentication, authorization, and accounting into three separate processes. This separation in TACACS+ ensures more detailed and granular control over user permissions and activities.

Which One Is Right for Your Business?

The best choice for your business will depend on your specific needs. If you need a simple, reliable protocol for network access authentication, then RADIUS is a good choice. If you need a more flexible and secure protocol for device administration, then TACACS+ is a better choice.

Ultimately, which one is right for you is going to depend on your specific needs. Let’s break down some primary needs that might be dealbreakers in your choice.

  • Auditing and troubleshooting: TACACS+ can be used to more comprehensively and seamlessly track user activity for auditing and troubleshooting. This can be helpful for identifying security vulnerabilities and resolving performance issues.
  • Compliance: TACACS+ can be used to enforce compliance with security regulations. This can be helpful for meeting the requirements of industry standards, such as PCI DSS and HIPAA.
  • High-security environments: TACACS+ is more secure than RADIUS, which makes it a better choice for high-security environments. This is because TACACS+ encrypts all traffic, including passwords.
  • Broader vendor support: RADIUS is more widely supported by different vendors than TACACS+. This means that you are more likely to be able to use RADIUS with your existing network infrastructure.

Why High-Security Environments or Highly Regulated Industries Prefer TACACS+

In industries like finance, healthcare, defense, and energy, where security breaches can have profound consequences and where regulations are stringent, choosing the right authentication protocol is critical. These sectors demand not just robust security but also granular access control and detailed logging.

While both RADIUS and TACACS+ have their merits, TACACS+ often comes out on top. Here’s why:

  1. Separation of Duties: Unlike RADIUS, which combines authentication and authorization, TACACS+ keeps these as distinct processes. This allows for more granular control over user actions after they’re authenticated.
  2. Encryption: TACACS+ encrypts the entire body of the packet, whereas RADIUS only encrypts the password. This ensures that sensitive information like usernames and command authorizations remain confidential during transmission.
  3. Command-Level Authorization: In high-security environments, not just user access but the specific commands users execute can be critical. TACACS+ supports command-by-command authorization, giving a tighter grip on user activities.
  4. Detailed Logging: TACACS+ offers more extensive logging capabilities than RADIUS. This level of granularity is vital for compliance where organizations must audit user actions meticulously.

Why Some Businesses Prefer RADIUS Over TACACS+

RADIUS is often the go-to for businesses prioritizing simplicity, wide compatibility, and cost-effectiveness. Internet Service Providers (ISPs), for example, widely adopt RADIUS for managing dial-up and VPN access for their vast user bases.

Small to medium-sized enterprises (SMEs) with less complex network infrastructure and without the need for granular command-by-command control might also gravitate towards RADIUS, given its broad support across devices and straightforward implementation.

Universities and other educational institutions, which often require a scalable solution for Wi-Fi authentication across large campuses, also frequently opt for RADIUS because of its seamless integration with many wireless infrastructure solutions.

The Vital Conversation: Engaging Network Security Solution Providers

In the digital age, businesses grapple with many network security challenges regardless of size or industry. With myriad protocols, tools, and techniques available, it’s no wonder that choosing the right solution can be overwhelming. This is where expert consultation with network security solution providers becomes invaluable.

Engaging with these specialists offers businesses a tailored approach. Rather than employing a one-size-fits-all method, companies can benefit from solutions that fit their unique operational needs, industry regulations, and risk profile. Remember, what works for a tech startup might not be suitable for a large hospital or a financial institution.

When discussing needs, businesses should be prepared with a set of questions. Some essentials include:

  1. What are the specific threats pertinent to my industry?
  2. How can we ensure compliance with industry-specific regulations?
  3. What’s the balance between user convenience and security in each protocol?
  4. How scalable are the solutions as our business grows?
  5. What kind of support and incident response can we expect?

Furthermore, discussions should delve deep into topics like encryption, access control granularity, and logging capabilities. It’s also pivotal to consider future needs, ensuring the chosen solution remains viable as technologies and threats evolve.

What’s The Verdict?

The RADIUS vs. TACACS+ debate exemplifies the importance of context and specificity. Both protocols have carved their niches, with each bringing distinct advantages to the table. With its broad device compatibility and straightforward implementation, RADIUS remains a favorite among ISPs, SMEs, and educational institutions. Its ability to offer a more general solution makes it attractive for environments that prioritize scalability and seamless integration.

On the other hand, TACACS+, with its granular controls, full-packet encryption, and detailed logging, is a beacon for high-stakes industries like finance and defense, where the slightest breach can have catastrophic repercussions.

For businesses at this crossroads, the key is not to look for a universally superior option but to evaluate based on individual needs, anticipated growth, and industry requirements. It’s imperative to collaborate with network security experts, seek guidance, and weigh the pros and cons specific to one’s ecosystem. Ultimately, both RADIUS and TACACS+ have proven their mettle in distinct scenarios. By aligning with an organization’s unique needs and challenges, the right choice emerges naturally, ensuring a fortified and future-ready network.

About Version 2
Version 2 is one of the most dynamic IT companies in Asia. The company develops and distributes IT products for Internet and IP-based networks, including communication systems, Internet software, security, network, and media products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Portnox
Portnox provides simple-to-deploy, operate and maintain network access control, security and visibility solutions. Portnox software can be deployed on-premises, as a cloud-delivered service, or in hybrid mode. It is agentless and vendor-agnostic, allowing organizations to maximize their existing network and cybersecurity investments. Hundreds of enterprises around the world rely on Portnox for network visibility, cybersecurity policy enforcement and regulatory compliance. The company has been recognized for its innovations by Info Security Products Guide, Cyber Security Excellence Awards, IoT Innovator Awards, Computing Security Awards, Best of Interop ITX and Cyber Defense Magazine. Portnox has offices in the U.S., Europe and Asia. For information visit, and follow us on Twitter and LinkedIn.。

Pandora FMS announces brand unification with Pandora ITSM and Pandora RC

Pandora FMS, a leader in the Information Technology and Monitoring solutions market, is glad to announce that the unification of its brands, Integria IMS and eHorus, under the new names Pandora ITSM and Pandora RC, respectively, has been successfully implemented. 

Pandora ITSM, formerly known as Integria IMS, represents Pandora FMS IT Service Desk and Service Management solution. It provides a comprehensive platform for managing IT incidents, issues, changes and assets, enabling organizations to improve the efficiency of their IT departments and deliver a superior service to end users.

Pandora RC, formerly known as eHorus, is the Remote Control solution from Pandora FMS. It offers a safe and effective platform to access and manage servers and devices remotely from any location in the world. Pandora RC becomes an essential tool for system administrators and support technicians looking to maintain the effective operation of their systems.

This significant advance reflects Pandora FMS’ commitment to further strengthen and consolidate its position in the technology solutions market, providing a more comprehensive and cohesive service and strategy for both its customers and partners.

Such brand unification will be completed across all Pandora FMS platforms, website and social media.

We would also like to underline that eHorus and Integria have always been part of Pandora FMS family, and this change does not alter our dedication to providing exceptional IT monitoring and management solutions.

We are excited to see how Pandora ITSM and Pandora RC brand and products are further integrated into Pandora FMS. Pandora ITSM has always represented a compelling mission and value proposition in the field of IT service management“, – Sancho Lerena CEO of Pandora FMS. 

“For a long time, IT service monitoring, IT service management (ITSM), and remote control solutions have evolved independently, but now, under the Pandora FMS umbrella, we are exceptionally unifying these three areas.”

This brand unification reflects the trend in the technology industry towards the consolidation and simplification of product and service offerings, with the aim of improving the customer experience. Pandora ITSM and Pandora RC celebrate this achievement and are committed to continuing to excel in their respective fields.

We are committed to your satisfaction and look forward to exceeding your expectations in the future.

Kind regards,

the Pandora FMS team.

About Pandora FMS

Pandora FMS is the integral monitoring solution: it is profitable, scalable and covers most of the infrastructure deployment options. 

Find and solve problems quickly, no matter if you come from on-premise, multicloud or a mix of both. 

In hybrid environments where technologies, management processes and data are mixed, a flexible tool capable of reaching everywhere and unifying data display is needed to make its management easier.

Thanks to more than 500 plugins available you may control and manage any application and technology, such as SAP, Oracle, Lotus, Citrix, Jboss, VMware, AWS, SQL Server, Redhat, Websphere and many more.

For those of you who do not yet know it, Pandora FMS is a tool that allows to control and monitor the whole infrastructure of an institution, so that the performance of computer supports can be displayed in real time and prevent failures, system crashes and cyberattacks.

With more than 50K installations in 53 countries, its customers include companies such as Salvensen, Prosegur, Repsol, CLH, Euskaltel, Adif, Santalucía, Cofares, AON, El Pozo, EMT, and other foreign companies such as Rakuten, the bank with the largest history in the USA, Nazareth University in New York, and hospitals in Spain and Canada. Also, public administrations such as the Junta de Castilla-La Mancha, the Comunidad of Madrid, the Diputación de Barcelona and numerous municipalities in France, Portugal and Spain.

About Version 2
Version 2 is one of the most dynamic IT companies in Asia. The company develops and distributes IT products for Internet and IP-based networks, including communication systems, Internet software, security, network, and media products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About PandoraFMS
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.



Click one of our contacts below to chat on WhatsApp