- The warranty link: Many manufacturers attach guarantees – for example regarding response times – to the fact that their own standards are used for remote maintenance.
- The power asymmetry: A single operator negotiates with a global machine manufacturer whose terms of service are identical for hundreds of customers.
- The brownfield reality: The additions have been created over the years in individual projects, the responsibility is diffused between maintenance, IT and purchasing – no one feels responsible.
- The availability logic: The open tunnel acts like insurance against standstill. The cyber risk is abstract, the loss of production is concrete – and the failure, not the audit, determines the plant manager’s key figures.
A hedging concept that ignores these forces remains paper. That’s why I deliberately arrange the measures in my projects like this: transparency first, then contract, technology and finally operations.
Industrial access hygiene in practice
I start with a list that provides information about who currently has access via which channel and for what reason and since when. The sources are unspectacular: firewall regulations, VPN accounts, external accounts in the directory service, mobile phone connections in control cabinets, installed remote maintenance tools. In addition, there are discussions with maintenance, because a significant part of the access only exists in people’s heads, not in documents. The result is an access register with owner, purpose, access path and time limit. Accounts for which no internal owner can be found will be deactivated after a defined objection period has expired. This usually affects a double-digit percentage of existing access. In these cases it only “costs” one round of voting to reduce the risks.
The principle of requirements before access applies to what remains. Before one is set up, the scope of services and confidentiality must be regulated. For mission-critical suppliers or service providers, additional security requirements should also be contractually specified. Two details make the difference between resilient and symbolic contracts:
- one Obligation to inheritwhich requires the supplier to pass on the same security controls to its subcontractors before they gain access, and
- a Defined replacement for denied audit rightssuch as independent test reports that the service provider submits annually. Instead of inventing my own catalogs, I reference IEC 62443-2-4, which standardizes exactly these requirements for service providers.
When conducting policy reviews, I first look at an inconspicuous detail: the modal verb. In the rules and regulations that I have examined or written over the past few years for energy, industrial and pharmaceutical companies, the distinction between “must” and “should” defines what reality looks like: If the time limit for external accounts is formulated as a must rule with automatic expiration, the accounts actually expire. If the same requirement is recorded as a recommendation with a one-year deadline, the next audit will contain the same files as the previous one. Or to put it another way: In the first case the set of rules works, in the second it is just decoration.
At this point I always come across the persistent counter-argument that without standard remote access the warranty is void. In my experience, this problem can be solved in three different ways:
- Use negotiation window: New purchases, retrofits and the extension of service contracts are the moments in which requirements can be enforced.
- Reassess the legal situation: The operator is legally obliged to secure its supply chain. A standard access that conflicts with this represents a legal risk – increasingly also for the manufacturer, who, as part of the supply chain, is subject to the obligations of his customers.
- Compensate where nothing can be enforced: Remote maintenance access could, for example, be limited to an operator’s own gateway, which is separated from the production systems by default and monitored separately. What is crucial at this point is that a risk decision is made and documented – instead of continuing to tolerate the status quo.
Technically, the rest follows the single-channel principle: All external access runs via a dedicated remote maintenance DMZ and hardened jump server. Direct RDP, SSH or VNC logins into OT systems are just as taboo as the manufacturer’s own parallel paths via cloud portals or mobile routers that you bring with you. Multi-factor authentication is set. The same principle applies to on-premises access: service provider devices, modems and smartphones must remain outside; USB ports are deactivated by default. Only dedicated, operator-owned engineering devices should be used in OT environments.
