Remote access is essential for OT operations and one of the most common entry points for attackers. Vendors, integrators and your own engineers need to reach systems quickly. The goal is not to block access but to make every path known, approved, protected and recorded.
The baseline
- One controlled path. All remote access terminates in the industrial DMZ on a dedicated gateway or jump host. No direct VPNs into control networks, no vendor-installed remote desktop tools, no forgotten cellular modems.
- Individual identities and MFA. Every person has a named account. Shared vendor accounts are retired.
- Just-in-time approval. Vendor access is disabled by default and enabled per request, for a defined time and system.
- Least access. Each vendor reaches only the systems they support.
- Session control. Sessions can be watched, recorded and terminated by site staff.
- Logging and review. Access logs go to monitoring and are reviewed periodically.
- Contracts that require it. Supplier agreements reflect these rules, supporting NIS2 supply-chain duties, IEC 62443-2-4 and standards such as Saudi Aramco SACS-002.
Finding what already exists
Most sites have more access paths than they think. Combine firewall rule reviews, contract lists, site walkdowns and interviews. Our remote access use case describes the process and a typical result.
Making it practical for operations
- Give the control room a simple way to approve or deny a session.
- Agree an emergency process for out-of-hours support.
- Keep the vendor register current with contacts and contract end dates.
Measuring progress
Track a few simple indicators: number of known access paths, percentage behind the controlled gateway, shared accounts remaining and sessions reviewed. These numbers make progress visible to management.
How OTVista helps
Third-party & Remote Access keeps the path inventory, vendor register and approval records together, linked to Identity & Access Review. Our architecture review service can design the target access model.
Topics: OT remote access, vendor remote access security, secure remote access ICS, jump host OT, supply chain security OT, MFA OT