Modern industrial operations rely heavily on third-party Original Equipment Manufacturers (OEMs), system integrators, and specialized contractors to maintain, troubleshoot, and update complex control systems. To perform these tasks efficiently, vendors require remote access to the Operational Technology (OT) network.
However, third-party remote access is consistently identified as one of the most significant vectors for cyberattacks against industrial environments. A compromised vendor connection bypasses perimeter defenses entirely, depositing an attacker directly into the critical OT network.
In many facilities, remote access was set up hastily for convenience or during the rapid shift to remote work, leading to highly insecure configurations. Common, dangerous practices include:
vendor_admin). This makes auditing impossible and prevents accountability if a configuration error or malicious action occurs.Real-world incidents, such as the 2021 attack on the Oldsmar, Florida water treatment facility (which involved unauthorized remote access via TeamViewer), highlight the severe real-world consequences of poorly managed external access.
To mitigate these risks without hindering necessary maintenance, organizations must transition from ad-hoc remote access to a structured, purpose-built Secure Remote Access (SRA) architecture designed specifically for OT.
Vendors should never connect directly to an OT asset. All external connections must terminate in the Industrial DMZ (Purdue Level 3.5).
From the IT network or external internet, the vendor connects via a secure gateway to a dedicated "Jump Server" located in the iDMZ. The Jump Server acts as a proxy. The vendor controls the jump server, and the jump server (via strict firewall rules) connects to the specific target PLC or HMI on the plant floor. This completely breaks the direct network routing path between the internet and the control system.
MFA is non-negotiable for external access to OT environments. Even if a vendor's credentials are stolen via a phishing attack or credential stuffing, MFA prevents the attacker from utilizing them. Hardware tokens or authenticator apps should be enforced for all external connections.
Access should default to "closed." When a vendor needs to perform maintenance, they must request access.
This access should be time-bound (e.g., valid only for a 4-hour window) and automatically expire when the window closes. This eliminates the risk of "always-on" connections and ensures that access is only available when actively needed.
In physical plants, contractors must often sign in at the guard shack and receive physical keys from a shift supervisor. Remote access should mimic this process.
Implement approval workflows where a plant manager or lead engineer must explicitly approve a vendor's remote access request before the connection can be established. This ensures that plant personnel maintain absolute control and awareness of who is operating within their environment at any given time.
Total visibility is crucial for accountability and incident response. Modern OT SRA solutions offer session recording capabilities. Every click, keystroke, and screen change made by the vendor during their session is recorded as a video file.
This deters malicious behavior, assists in troubleshooting if a vendor makes a configuration error, and provides irrefutable forensic evidence in the event of an incident.
A vendor maintaining a packaging machine should not have network access to the chemical mixing PLCs. Access must be granularly restricted using Role-Based Access Control (RBAC). The vendor should only be able to see and interact with the specific IP addresses and ports necessary for their specific job function.
Technology alone is not enough; it must be backed by strict policies. Ensure your vendor agreements explicitly define:
Secure remote access for vendors is about balancing operational necessity with security rigor. By implementing an architecture centered on jump servers, MFA, just-in-time approval workflows, and session recording, industrial organizations can confidently allow third-party maintenance while shutting the door on unauthorized access and lateral movement.
Why IT incident response plans fail on the plant floor, and how to build a specialized OT IR playbook focused on safety, containment, and production continuity.
Look behind the curtain of a typical OT security assessment. Discover the most common vulnerabilities hidden in industrial environments and why finding them matters.
Discover the hidden risks of flat industrial networks, how they facilitate lateral movement for attackers, and practical steps to begin segmenting your OT environment.