“We're not sure how many ways vendors can reach our control systems.”
Remote access added for support contracts and projects accumulates over years: VPNs, remote desktop tools, cellular modems. Each path is a potential entry point that needs an owner, an approval and protection.
Remote access is one of the most frequent routes into OT environments.
NIS2 and supplier standards expect vendor access to be controlled.
Every session should be traceable to a person and an approval.
Fewer, well-controlled paths are easier to defend and monitor.
A sequence that can be adapted to your environment and scope.
List every access path from designs, firewall rules, contracts and site surveys.
Record vendors, contacts, systems reached and business need.
Route access through one controlled gateway with MFA.
Enable vendor access on request and time-limit it.
Keep approvals and session records for review.
A site believes all vendor access goes through its jump server. A survey finds a cellular router installed by a machine builder and a remote desktop tool on an engineering workstation. Both are retired and replaced with on-request gateway access.
Through one controlled, logged gateway with individual accounts and MFA, enabled only when approved, limited to the systems needed and reviewed regularly.
From the blog
National NIS2 laws are now being enforced. Here is what energy, water, transport and manufacturing operators should be able to show for their OT environments.
Read the articleManufacturers must now report actively exploited vulnerabilities and severe incidents. Asset owners should expect more advisories, and suppliers need a working process.
Read the articleSegmentation diagrams often look perfect and behave very differently. A practical method for zones and conduits that match how your site really works.
Read the articleDescribe where you are today and we'll suggest a practical way forward.