---
title: "Insecure Remote Access: Top Risk for SMBs"
description: Recent attack trends show that hackers are beginning to move their focus to smaller merchants that have improperly configured remote access systems.
image: https://blog.pcisecuritystandards.org/hubfs/2017-Blog/smb-insecure-remote-access.jpg
---

[< Return to Blog Home](https://blog.pcisecuritystandards.org) [Print](https://blog.pcisecuritystandards.org/insecure-remote-access-top-risk-for-smbs#)

# [Insecure Remote Access: Top Risk for SMBs](https://blog.pcisecuritystandards.org/insecure-remote-access-top-risk-for-smbs)

 Posted by [Laura K. Gray](https://blog.pcisecuritystandards.org/author/laura-k-gray) on 10 Oct, 2017 in [Small Business](https://blog.pcisecuritystandards.org/topic/small-business) and [Infographic](https://blog.pcisecuritystandards.org/topic/infographic) and [QIR](https://blog.pcisecuritystandards.org/topic/qir) and [Small Merchant Resources](https://blog.pcisecuritystandards.org/topic/small-merchant-resources) and [Cyber Security Awareness Month](https://blog.pcisecuritystandards.org/topic/cyber-security-awareness-month) and [Third Party Risk](https://blog.pcisecuritystandards.org/topic/third-party-risk) and [Remote Access](https://blog.pcisecuritystandards.org/topic/remote-access)

![smb-insecure-remote-access.jpg](https://blog.pcisecuritystandards.org/hs-fs/hubfs/2017-Blog/smb-insecure-remote-access.jpg?width=800&name=smb-insecure-remote-access.jpg "smb-insecure-remote-access.jpg")

<https://www.linkedin.com/shareArticle?mini=true&url=https://blog.pcisecuritystandards.org/insecure-remote-access-top-risk-for-smbs>

<https://www.facebook.com/share.php?u=https://blog.pcisecuritystandards.org/insecure-remote-access-top-risk-for-smbs>

<https://twitter.com/intent/tweet?original_referer=https://blog.pcisecuritystandards.org/insecure-remote-access-top-risk-for-smbs&url=https://blog.pcisecuritystandards.org/insecure-remote-access-top-risk-for-smbs&source=tweetbutton&text=Insecure%20Remote%20Access:%20Top%20Risk%20for%20SMBs> 

[mailto:?subject=Check%20out%20this%20article&body=https://blog.pcisecuritystandards.org/insecure-remote-access-top-risk-for-smbs](mailto:?subject=Check%20out%20this%20article&body=https://blog.pcisecuritystandards.org/insecure-remote-access-top-risk-for-smbs)

*Recent attack trends show that hackers are beginning to move their focus to smaller merchants that have improperly configured remote access systems. Generally, hackers are not targeting a specific merchant, rather, the hacker will scan the Internet for vulnerable remote access systems and attempt to compromise them, regardless of the merchant size or type.**

Point-of-sale (POS) vendors will often support or troubleshoot merchant payment system from their office and not from the business location. They do this using the Internet and remote access software. Hackers know that these vendors often use the same remote access login information for all of their customers, and keep this software running all the time, even when it’s not needed, leaving businesses open to attack.

To minimize the risk of being breached, businesses should make sure **[remote access](https://blog.pcisecuritystandards.org/topic/remote-access)** to their systems is only turned on when needed, and that vendors are using **[multi-factor authentication](https://blog.pcisecuritystandards.org/topic/multi-factor-authentication)** with a different username and password for each customer they access remotely.

The PCI SSC **[Questions to Ask Your Vendors](https://www.pcisecuritystandards.org/pdfs/Small_Merchant_Questions_to_Ask_Your_Vendors.pdf)** resource can help businesses get the information they need from their third party vendors. Additionally, merchants can refer to the PCI **[Qualified Integrators and Resellers list](https://www.pcisecuritystandards.org/assessors_and_solutions/qualified_integrators_and_resellers)** for companies and individuals that have been trained by PCI SSC on secure remote access and other payment data security essentials.

| [![More on Remote Access](https://no-cache.hubspot.com/cta/default/281302/190159b5-b0a8-4b6f-b0f7-02520937105f.png)](https://cta-redirect.hubspot.com/cta/redirect/281302/190159b5-b0a8-4b6f-b0f7-02520937105f) |
| --- |
| [![SMB Payment Protection Resources](https://no-cache.hubspot.com/cta/default/281302/d2909039-6dc5-435e-85e7-5cfec50b9cfb.png)](https://cta-redirect.hubspot.com/cta/redirect/281302/d2909039-6dc5-435e-85e7-5cfec50b9cfb) |

***[Remote Access Technology Best Practices](https://www.mastercard.com/us/company/en/docs/RemoteAccess_whitpaper_Sept21.pdf)** 

### LIKE WHAT YOU READ?

Subscribe to the PCI Perspectives blog to receive insights, information and practical resources to help your organization protect payment data.

[Subscribe Here](https://training.pcisecuritystandards.org/subscribe-to-pci-perspectives-blog)

![Laura K. Gray](https://blog.pcisecuritystandards.org/hubfs/Headshots/laura-gray.jpg)

[ Laura K. Gray ](https://blog.pcisecuritystandards.org/author/laura-k-gray)

[Twitter ](https://www.twitter.com/pcissc) [Email](mailto:blog@pcisecuritystandards.org) [Website](http://www.pcisecuritystandards.org)

 The PCI Security Standards Council (PCI SSC) is a global forum that brings together payments industry stakeholders to develop and drive adoption of data security standards and resources for safe payments worldwide.

[< Return to Blog Home](https://blog.pcisecuritystandards.org) [Print](https://blog.pcisecuritystandards.org/insecure-remote-access-top-risk-for-smbs#)