How should remote access to OT by vendors and integrators be secured?
Through one controlled entry point that you own, switched on only when needed. In practice: a remote-access gateway or jump server in the DMZ between office and production, multi-factor authentication for every vendor account, a named account per technician instead of a shared one, access limited to the machines that vendor supports, sessions enabled on request and switched off afterwards, and logs or recordings of what was done. Once that path exists, remove the vendors' own permanent tools, such as remote-desktop apps on HMIs and 4G routers in cabinets. NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. also expects supply-chain security measures, so write these rules into the contracts. On the network, a vendor session shows as connections from the gateway into production; NetSenX flags scanning and lateral movement from it on every plan and, from the Pro plan, writes from hosts that are not allowed to write. NetSenX does not decide who gets access; your gateway does.
Read next
Related questions
- Are vendor 4G routers in machine cabinets a security risk?
- How do I find hidden remote-access routers in our production network?
- How do I protect an old production PC that cannot be patched?
- What is a compensating control for legacy OT systems?
- How do I build an OT asset inventory without active scanning?
Terms used here
- NIS2 (the EU's second Network and Information Security directive)
- The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies.