Skip to content
OT AssociatesPURE PLAY OT SECURITY
← The OT Field Guide
08

Remote access: brokered, time-bound, watched

All remote access to OT is brokered through the DMZ, granted per session, tied to a person and recorded.

4 min readInteractive figureISA/IEC 62443-3-3 FR1, FR2, FR5ISA/IEC 62443-2-4
Interactive figure
Vendor remote access, hop by hop
Vendor laptopshared accountInternetAlways-on VPNinto the plantPLC-201any time, unrecorded
  • ✕Multi-factor authentication
  • ✕Approved per session by the asset owner
  • ✕Time-bound, expires automatically
  • ✕Session recorded, escort for high-risk work
  • ✕OT identity separate from corporate
  • ✕No direct path from the internet

Compare a direct vendor connection with a brokered one, hop by hop.

The most used way in

Remote support is essential: equipment vendors and integrators maintain systems they built. It is also one of the most common paths into OT, through always-on VPNs, shared accounts, forgotten modems and remote desktop tools installed for convenience.

The brokered pattern

Remote users authenticate with multi-factor authentication into a broker in the industrial DMZ, never directly into the control network. Access is granted per session, for a defined window and a defined asset, approved by the asset owner and tied to the contract. Sessions are recorded, and high-risk work can be escorted live.

Identity for OT runs in domains independent of the corporate directory, so a compromise of the business network does not hand over the plant.

Takeaways
  1. 01No direct paths from the internet or the enterprise to control systems.
  2. 02Per-session, per-asset, approved and expiring access.
  3. 03Record sessions and separate OT identity from corporate identity.