Architecture
Secure remote access
Remote access is the most common initial access path into OT. The goal is not to forbid it, but to make every session brokered, approved, time-bound and observed.
Target pattern
- One documented entry point terminating in the industrial DMZ — never directly into the control zone
- MFA on every account, including vendor and service accounts
- A jump host that mediates the session; the remote endpoint never speaks industrial protocols directly
- Just-in-time access: enabled on request, scoped to one asset, expiring automatically
- Operations approval before any session that can change process behaviour
- Full session logging, and recording where policy and law allow
Patterns to eliminate
- Cellular modems and vendor appliances that dial out of the plant unmanaged
- Shared vendor credentials used by multiple engineers over years
- Always-on VPN accounts with control-zone reachability and no expiry
- Remote desktop tools installed ad hoc on engineering workstations
- Direct internet exposure of HMIs, historians or controller web interfaces
Why should I care?
Every widely reported utility intrusion of the last decade involved a reachable interface someone had forgotten about. Inventorying and brokering remote access removes whole classes of incident.
Monitoring remote sessions
- Alert on any control-zone session outside an approved window
- Correlate jump-host logons with change tickets and shift schedules
- Watch for programming or download traffic sourced from a remote session
- Track geolocation and impossible-travel anomalies for vendor accounts
Vendor management
- Named individual accounts per vendor engineer, never a shared login
- Contractual right to audit and to disable access immediately
- Access reviewed at contract renewal and revoked at project close
- Vendor-supplied equipment inventoried, including its own connectivity