The need for remote access to industrial control systems (ICS) is one of the biggest challenges today and, at the same time, one of the biggest opportunities for the manufacturing sector. In a globally connected world, the ability to remotely diagnose, service and manage OT infrastructure has ceased to be a luxury - it has become an operational necessity. Fast response to failure, support from the best specialists regardless of their location or process optimization by external experts are benefits that cannot be ignored.
However, every remote connection is inherently a digital tunnel that cuts through all layers of our perimeter defenses and leads directly to the heart of our infrastructure - to SCADA systems and PLCs. One misconfigured, unsecured or forgotten connection can nullify an entire, carefully built security strategy and become a highway for attackers. The history of cyberattacks on industry, with the Florida water treatment plant incident at the forefront, emphatically demonstrates that unsecured remote access is one of the favorite and most effective attack vectors.
So the challenge is not WHAT to allow remote access, but HOW to implement it in a way that is fully controlled, monitored and secure. A modern approach, based on the Zero Trust philosophy and dedicated technologies, makes it possible to create solutions that give authorized users the access they need, while closing the door to the rest of the world.
Shortcuts
- Why has remote access to OT systems become an operational necessity?
- How can one unsecured remote connection nullify an entire defense strategy?
- Why is exposing a remote desktop (RDP) to the Internet asking for trouble?
- Is a traditional VPN sufficient security for OT network access?
- What are the risks of uncontrolled use of tools like TeamViewer or AnyDesk?
- What is the “zero trust” principle in the context of remote access?
- Secure Remote Access: the Old vs. the New Approach
- Why is a centralized bastion host (jump host) the foundation of secure access?
- How does multi-factor authentication (MFA) block 99% of password theft-based attacks?
- What is the principle of minimum entitlements and how to implement it in practice?
- Why is recording and monitoring remote sessions so critical for auditing and incident analysis?
- How do privileged access management (PAM) systems integrate all these mechanisms?
- How do you create a secure and controlled environment for remote third-party service technicians?
- How can nFlo help you design and implement a secure OT remote access solution?
- How do you reconcile the need for rapid response with the requirement for absolute security?
Why has remote access to OT systems become an operational necessity?
The era when every problem with a machine required the physical presence of a service technician is slowly becoming a thing of the past. Today’s economy demands speed and flexibility, and production downtime is more expensive than ever. Remote access has become a key tool for minimizing Mean Time to Repair (MTTR). Rather than waiting hours or days for a technician to arrive, you can enable him or her to immediately diagnose and often also repair the problem within minutes.
Another powerful driver is cost optimization. Regular service trips, especially for companies with a geographically dispersed infrastructure or using highly specialized foreign experts, generate huge costs. Remote access reduces them dramatically, enabling most service and configuration tasks to be performed without the need for physical presence at the site.
Finally, remote access is often a prerequisite for modern services offered by machine manufacturers, such as predictive maintenance or advanced analytics. In order to be able to provide these services, manufacturers need to have constant, secure access to data from the equipment in operation at the customer’s site. Failure to do so means foregoing innovations that can give a company a key competitive advantage.
📚 Read the complete guide: IAM / Zero Trust: Zarządzanie tożsamością i dostępem - od podstaw do Zero Trust
How can one unsecured remote connection nullify an entire defense strategy?
Unsecured remote access acts like a secret underground passage leading straight to the royal treasury, completely bypassing the walls, moat and guards at the main gate. An organization can invest millions in state-of-the-art firewalls at the network perimeter, intrusion detection systems and advanced analytics, but if an unsecured modem connected to a PLC is running somewhere on the network, all that investment becomes useless.
Attackers are well aware of this and are actively looking for such vulnerabilities. Specialized search engines, such as Shodan, are constantly scanning the entire Internet for industrial devices and remote access services that have been inadvertently exposed to the public. For them, finding an open RDP port leading to a SCADA station or HMI panel is like finding a factory door open wide.
Worse, compromising such a connection gives the attacker immediate, privileged access to the most vulnerable part of the infrastructure. He no longer has to move slowly from the IT network to OT. He lands immediately in the heart of the control system, from where he can sabotage, halt production or, just as threateningly, remain hidden for months, learning the process and preparing for the final strike.
Why is exposing a remote desktop (RDP) to the Internet asking for trouble?
The Remote Desktop Protocol (RDP) is an extremely convenient tool, but exposing it directly to the public on the Internet is one of the most serious configuration errors. It is a de facto invitation to attackers. The RDP port (standard 3389) is one of the first to be scanned by botnets looking for easy targets.
The main threats are brute-force and dictionary attacks. Automated tools can test millions of combinations of common logins and passwords in a matter of hours in an attempt to guess system credentials. Given the widespread use of weak and default passwords in OT environments, the probability of success of such an attack is extremely high.
Even if we use a strong password, exposing RDP to the world exposes us to exploitation of possible vulnerabilities in the protocol itself or its implementation. A number of critical RDP security vulnerabilities have been discovered throughout history (e.g., BlueKeep), which allowed the user to take full control of the system without knowing the password. Any system with publicly accessible RDP is therefore a ticking bomb, waiting for the next such vulnerability to be discovered.
Is a traditional VPN sufficient security for OT network access?
A Virtual Private Network (VPN) is undoubtedly a huge step forward compared to direct exposure of services on the Internet. It creates an encrypted tunnel that protects communications from eavesdropping. However, a traditional, simple VPN, while often seen as the “golden mean,” is not an ideal or sufficient solution for sensitive OT environments.
The problem with a classic VPN is that it works on an all-or-nothing basis. After successful authentication, the user is allowed “inside” the network and gains very broad, often unlimited access to it. His computer becomes a de facto part of the local network. It’s as if, after checking a ticket, we let a visitor into the entire castle, giving him the keys to all the chambers.
If the laptop of a remote service technician who has connected via VPN is infected with malware, that malware also gains full access to the entire OT network and is free to spread to other unsecured systems. A traditional VPN does not provide granular control over what a user can do once connected, nor does it isolate their session from the rest of the infrastructure.
What are the risks of uncontrolled use of tools like TeamViewer or AnyDesk?
Remote desktop tools such as TeamViewer, AnyDesk and VNC are extremely popular because of their simplicity and convenience. They allow you to quickly share control of your computer with another person. However, their uncontrolled use in an industrial environment poses a serious security risk, as they bypass all company policies and controls.
When an engineer installs TeamViewer on a SCADA station to enable remote support from the vendor, he creates a direct outbound connection from the trusted OT network to the software vendor’s servers in the cloud. This connection is usually invisible to the company’s firewalls and monitoring systems. We have no control over who connects to our critical system, when and for what purpose.
Moreover, we rely 100% on the security of the third-party vendor’s platform. The possible compromise of TeamViewer servers or the theft of service technician account credentials can give attackers direct access to our SCADA system. The uncontrolled use of these tools is a form of “Shadow IT/OT” that creates invisible and unmanaged holes in our security architecture.
What is the “zero trust” principle in the context of remote access?
Since simple methods fail, secure remote access must be based on the same philosophy that is revolutionizing the protection of internal networks - Zero Trust. In the context of remote access, this means abandoning the “user is outside (untrusted) or inside the VPN (trusted)” binary thinking. Instead, we treat every user and every connection as potentially hostile and subject them to continuous, granular verification.
Zero Trust’s approach to remote access is based on several pillars. First, identity becomes the new network boundary. It doesn’t matter where a user connects from - from the office, from home or from a hotel. The key is who he is and whether he can prove it through strong methods. Second, access is granted on the basis of minimum necessary privileges. The user is not given access to “the network,” but to a specific, single application or a single device that they need to perform their task.
Third, access is contextual and dynamic. The system evaluates not only identity, but also the security status of the device from which the connection is made, the time of day and geographic location. Access can be automatically restricted or blocked if the context raises suspicions. Finally, each session is separately verified and monitored. There is no such thing as a persistent, trusted session.
Secure Remote Access: the Old vs. the New Approach
Unprotected Method (Old Approach)Safe Counterpart (Zero Trust Approach).Directly expose RDP/VNC on the Internet.Centralized gateway/bastion host. No direct connections.Logging in with a password alone.Multi-Factor Authentication (MFA). Each session requires a second component.Access to the entire network (traditional VPN).Access on a minimum entitlement basis. Access only to a specific resource.Lack of control over user actions.Monitoring and recording of sessions. Full visibility and auditability of operations.
Why is a centralized bastion host (jump host) the foundation of secure access?
The first and most important element of a secure remote access architecture is the creation of a single, controlled point of entry. All remote users, without exception, must connect not directly to target systems on the OT network, but to a dedicated, specially hardened proxy server called a bastion host or jump host.
The bastion host is located in a secure, isolated area of the network (e.g. in the DMZ). It is the only system in the entire infrastructure that is accessible from the outside. Its configuration is minimal, and the operating system and all services are “hardened” as much as possible to minimize the attack surface. It is where all incoming VPN tunnels or SSL connections terminate.
With this approach, all defense and monitoring can focus on a single, well-protected point. Instead of trying to secure dozens of different machines in the OT network, we secure only the host bastion. Once a user logs onto the bastion host, only from it does he initiate a second, separate connection to the target system inside the OT network. This creates crucial separation and prevents direct communication between a potentially untrusted service technician’s laptop and a critical PLC.
How does multi-factor authentication (MFA) block 99% of password theft-based attacks?
A password alone, even a very complicated one, is no longer sufficient security. Passwords can be guessed, cracked or, most commonly, stolen via phishing. That’s why every session of remote access to an OT environment must be protected with multi-factor authentication (MFA).
MFA requires the user to present at least two different pieces of proof of identity, from different categories: something he knows (a password), something he has (a hardware token, a phone with a code-generating application), or something he is (a fingerprint, a facial scan). Even if an attacker steals a service technician’s password, he won’t be able to log into the system because he won’t have the other, physical component.
Implementing MFA is one of the simplest yet most effective ways to dramatically improve security. Studies show that it blocks more than 99% of typical attacks based on credential compromise. In the context of remote access to critical infrastructure, the use of MFA should be an absolute, non-negotiable standard.
What is the principle of minimum entitlements and how to implement it in practice?
The Principle of Least Privilege (PoLP) says that each user or system should have only those privileges that are absolutely necessary to perform its tasks, and nothing more. In the context of remote access, this means moving away from granting broad access to the entire network.
Modern remote access solutions allow us to implement this policy in a very granular way. We can create a policy that states that “User John Smith, connecting during business hours, can only access the remote desktop (RDP) on SCADA server with address X and only for a period of 4 hours.” Any attempt by him to connect to another server or using another protocol will be automatically blocked.
For even greater security, a just-in-time (JIT) access model can be implemented. By default, no user has any remote access privileges. To gain access, he or she must submit a request in a special portal, which is then accepted by a manager. Only after acceptance does the system automatically and temporarily create a corresponding rule on the firewall, and when the session ends, the rule is automatically deleted.
Why is recording and monitoring remote sessions so critical for auditing and incident analysis?
Trust is good, but control is better. Even after proper authentication and authorization, we need to have full visibility into what a remote user is doing on our systems. That’s why a key part of a secure solution is logging and monitoring all remote sessions.
Modern systems can not only create detailed text logs (who connected, from where, when and to what), but also record the entire session in video form. Every mouse click, every command entered is recorded and archived. This gives unprecedented possibilities for auditing and analysis.
In the event of a security incident or operational failure, a recording of the session is invaluable evidence. It allows step-by-step reconstruction of the serviceman’s actions and verification that his actions followed procedures and may have been the cause of the problem. The mere knowledge that each session is recorded also acts as a strong deterrent against taking any unauthorized or malicious actions.
How do privileged access management (PAM) systems integrate all these mechanisms?
All the mechanisms discussed above - centralized gateway, MFA, minimum privileges and session monitoring - are elements of a broader strategy called Privileged Access Management (PAM). Dedicated PAM platforms are integrated solutions that provide all of these functions within a single, cohesive system.
The PAM system acts as a central gateway and password safe for all privileged accounts. The remote user never learns the actual password for the SCADA server or PLC. He logs into the PAM portal with his account and MFA. The PAM system then logs him into the target device on his behalf, in an automated and transparent manner, using passwords stored in its encrypted vault.
PAM platforms automatically manage the lifecycle of passwords (e.g., changing them regularly), enforce granular “just-in-time” access policies and record all sessions. Implementing a PAM system is the most mature and comprehensive way to secure remote access, as it automates and integrates all best practices in the field.
How do you create a secure and controlled environment for remote third-party service technicians?
Managing access for employees is one thing, but even more challenging is controlling third-party companies - machine manufacturers, system integrators and service technicians. Here, the level of trust is inherently lower, and control must be even more stringent.
The best practice is to create a dedicated, isolated environment for each provider. Instead of letting him into our main network, we can provide him with a virtual machine on a bastion host server. The service technician connects only to this one machine, where all the tools he needs are installed. This virtual machine then has strictly limited access to only those devices on the OT network that are covered by the service contract.
Clear formal procedures should also be put in place. Each remote session should be notified in advance and authorized by a company employee. If possible, the session should be supervised live by a maintenance engineer. All of these policies should be written into a contract with the supplier that precisely defines the cyber security responsibilities of both parties.
How can nFlo help you design and implement a secure OT remote access solution?
At nFlo, we are well aware that there is no one-size-fits-all solution for remote access that fits every organization. An effective and secure implementation requires a deep understanding of your specific operational processes, existing network architecture, and relationships with external vendors. That’s why our approach always begins with a joint workshop where we map your unique needs and requirements.
Our security architects will help you design a remote access architecture that is fully compliant with Zero Trust principles and industry best practices. We’ll help you choose the right technologies - from bastion host-based solutions to industrial VPN gateways to end-to-end PAM platforms - that will best fit your scale, budget and maturity level.
Our role doesn’t end with the project. nFlo engineers actively support your team in the process of deploying, configuring and testing the solution, ensuring its seamless integration into your existing environment. We also create dedicated procedures and policies that will allow you to effectively and securely manage access on a daily basis. Our goal is to provide you with a complete, working and secure solution that realistically supports your business while minimizing risk.
How do you reconcile the need for rapid response with the requirement for absolute security?
Seemingly, speed and security are two opposing goals. Business demands immediate access to fix a failure as quickly as possible, while security requires multi-step verification that can prolong the process. The key to reconciling these two worlds is automation and the implementation of modern, intelligent systems.
A well-designed PAM platform or solution based on just-in-time access does not have to be slow at all. The process of requesting and accepting access can take seconds, and once approved, the user gets connected almost immediately. Automation eliminates the time-consuming, manual process of configuring access, while ensuring that each session is policy-compliant and fully auditable.
Ultimately, investing in secure remote access is not a cost, but an investment in operational resilience. Not only does it provide protection against cyber attacks, but it also gives us the confidence that at a critical moment, at two in the morning, we will be able to safely and reliably call upon the best experts to restore our production continuity as quickly as possible. This is the very definition of a modern digital factory.
Related Terms
Learn key terms related to this article in our cybersecurity glossary:
- Zero Trust — Zero Trust is an IT security model that assumes that no person, device, or…
- Network Security — Network security is a set of practices, technologies, and strategies aimed at…
- Network Access Control — Network Access Control (NAC) is a set of technologies and practices used to…
- Cybersecurity — Cybersecurity is a collection of techniques, processes, and practices used to…
- Cybersecurity Incident Management — Cybersecurity incident management is the process of identifying, analyzing,…
Learn More
Explore related articles in our knowledge base:
- ZTNA vs VPN: How is Zero Trust Network Access revolutionizing secure remote access?
- Identity and Access Management (IAM): who, what, where, when and why
- Network access control: capabilities and benefits of FortiNAC
- Privileged Access Management (PAM): How to protect orgaznization
- The government has approved an amendment to the KSC law. Gawkowski determined to complete work this year.
Explore Our Services
Need cybersecurity support? Check out:
- OT/ICS Penetration Testing - industrial systems security
- OT/ICS Security Audit - industrial environment security assessment
Explore Our Products
Solutions mentioned in this article that can help protect your organization:
- FortiNAC — Fortinet
Cybersecurity for Your Industry
Learn more about cybersecurity in your industry:
