By Kip Gering, VP GTM Strategy
Enabling reliable, secure remote access to Operational Technology (OT) networks is increasingly a top priority for operational leaders. Yet, regardless of the drivers, many industrial organizations were left with no choice but to turn to IT-centric tools to meet remote access demands.
Unfortunately, IT-centric tools – such as traditional VPNs and jump servers – lack native support or understanding of OT environments. As a result, instead of a fluid access experience, remote users suffer through a patchwork of point solutions to compensate for these shortcomings.
With operational productivity and safety on the line, not to mention the growing risk of cyber threats, the time is now to modernize your OT remote access.
Modernizing Remote Access for Operational Environments
As you evaluate alternatives to your existing remote access approach, keeping the following five considerations in mind is essential. Each of these “must-haves” is a crucial success criterion for modernizing your secure remote access without compromising user experience or the cybersecurity posture of your OT infrastructure.
1. Enforces least-privilege access control
Cyberattackers often compromise privileged accounts to expand their access in a target environment. Enforcing the principle of least privilege is a crucial cybersecurity control for your remote access strategy. IT-centric access tools are only partially applicable to OT/ICS environments. While IT-centric remote access tools can integrate with privileged access management (PAM) to enforce least privilege, they usually require agents on the assets. This makes them inapplicable to many OT asset types, such as Programmable Logic Controllers (PLCs) and remote terminal units (RTUs). This is an unacceptable compromise for critical infrastructure.
Look for a remote access solution that shifts from a traditional network-centric to an identity-centric security model while accounting for OT’s unique access control challenges. To achieve this, your secure remote access solution must create an individual identity for every asset regardless of native device controls. Only when each identity forms its own perimeter can you consistently enact and enforce granular access policies across your OT, IT, and cloud networks.
2. Takes an asset-centric approach
At the heart of every industrial organization are the mission-critical OT/ICS assets (devices such as PLCs, RTUs, sensors, actuators, etc.) that comprise your operations. These assets should be the central focus of your secure remote access strategy. Any remote access solution must be able to provide the appropriate level of access, for the required amount of time, to individual OT assets. Any solution offering less granular control, such as a VPN that default-allows access to an entire network segment, is insufficient for OT/ICS environments.
Consider secure remote access solutions that are purpose-built for OT. You’ll benefit from a solution that overlays and augments the different native security capabilities of your operational systems.
Your remote access solution must have a deep understanding of the unique relationships and behaviors of different OT assets to effectively safeguard all digital interactions and data transfers between devices, applications, and users.
Absent this awareness, your OT security teams will struggle to create and enforce granular remote access policies. One misconfiguration could impede productivity, threaten operational safety, or leave your environment vulnerable to cyberattack.
3. Preserves security layers across OT, IT, and cloud interconnectivity
The benefits of remote connectivity are undeniable. However, you need to be wary of any remote access solution that exposes vulnerable protocols and at-risk OT devices directly to the internet.
For years, operations security relied on physical separation between OT systems and IT environments. The “airgap” provided a sense of security that is rapidly dissipating as digital transformation projects drive the need for interconnectivity between OT, IT, and Cloud assets.
Today, your remote access solution must preserve logical segmentation while enabling secure traversal of multiple network layers. This includes utilizing a multi-hop architecture that provides session and protocol termination at each layer without added complexity or friction for the remote user.
You’ll also want to look for a secure remote access solution that eliminates the need to open multiple firewall ports to provide remote connectivity via common protocols (e.g., SSH, VNC, PROFINET).
Finally, your remote access solution must achieve these outcomes without disrupting your existing operations infrastructure. Instead, aim to implement an approach that overlays your environment, OT-IT DMZ, and the cloud. Avoid any solution that requires you to rip and replace any part of your architecture.
4. Delivers complete visibility of remote access activity
A lot can happen during a remote session into your OT infrastructure that affects operational productivity and your cyber-physical systems security posture. Remote access tools that “black box” activities at the network edge limit early detection and cause slow cyber-incident remediation.
Be sure to adopt a secure remote access solution that provides full visibility into all remote session activity. Your solution must take an identity-aware approach to activity logging, auditing, and session tracing, even if the participating devices lack unique user accounts. Anything less leaves operations teams with more questions than answers when every minute a production process is impacted can lead to thousands (if not millions) in lost revenue.
Identity-enriched visibility into OT remote access speeds forensics for incident response, even offering proactive protection against anomalous behaviors. This level of comprehensive visibility also makes demonstrating regulatory compliance much easier.
5. Modernizes user experience without limiting cyber-hardening
The flexibility offered by remote access must not come at the expense of cyber-hardening your OT environment. Whether your cyber-hardening priorities are driven by regulatory mandates, reduced insurance premiums, or intellectual property protection, it’s vital that your remote access solution gives you a way to set a high bar cyber-protection across all of your OT assets.
Make sure your solution can seamlessly add new layers of security controls, regardless of the maturity of native device capabilities. This includes enabling multi-factor authentication (MFA), single sign-on (SSO), advanced secrets management, and other cybersecurity best practices.
Most importantly, it’s crucial these added defense-in-depth controls don’t lead to a kludgy user experience.
Avoid the Shortcomings of IT-centric Remote Access
By now it should be evident that you can’t afford to settle for a disjointed remote access solution for the operational technology that drives your business. Fortunately, you can use the five considerations outlined in this article to avoid going down the wrong path.
See for yourself how leading industrial organizations, like one of the world’s largest steel manufacturers, have applied these principles to their operations using Xage Zero Trust Remote Access.
The time is now to modernize your secure remote access, and Xage is here to help you accelerate your shift to a proactive, zero trust-based approach.
