How do we control maintenance laptops that connect to our production network?
Treat them as visitors with a key: allowed in for a job, on a known port, and watched while they are there. Agree with each machine builder and integrator which laptop may connect, where and for what. Give them a dedicated maintenance port or VLAN that reaches only their machine, instead of any free socket on the line switch, and switch that port off when the job is done. Ask for the laptop to be checked for malware before it connects, or lend them a company laptop with the engineering software, which many plants prefer. Keep a short visit log: who, when, which machine. On the network side, the laptop appears as a new device on the NetSenX network map, on every plan, and if it scans or starts talking to many hosts, the scanning and lateral movement alerts fire. From the Pro plan, a write to a controller from a host that is not allowed to write raises an OTOT: operational technology. The computers that run machines, production lines, building systems and utilities. alert.
Read next
Related questions
- Can we see which controllers a visiting technician's laptop talked to?
- How should remote access to OT by vendors and integrators be secured?
- Are vendor 4G routers in machine cabinets a security risk?
- How do I find hidden remote-access routers in our production network?
- How do I protect an old production PC that cannot be patched?
Terms used here
- OT (operational technology)
- The computers that run machines, production lines, building systems and utilities.