Secure remote maintenance access
We bring order to how suppliers and maintenance contractors connect remotely: their separate VPNs and remote access tools are replaced by a single access point that requires approval and logs all access.
Starting point and goal
From many separate channels to one controlled entry point
The remote channels used by machine builders and equipment suppliers are the most common way attackers get into a plant network. Typically, each supplier connects with its own solution.
The process
How we clean it up
First we find out who connects today and how. Then we build the new entry point and move the connections over to it, one supplier at a time.
-
Inventory of existing connections
We record which supplier can reach which system, over which channel, and with what permissions. The starting list is rarely complete, because procurement and IT often keep separate records.
-
The central access point
We build the approval-based entry point, which, depending on your environment, sits in the industrial DMZ. Every external party goes through it, and MFA is required for every login, without exception.
-
Supplier access
Each maintenance engineer gets personal, time-limited access and can reach only the systems they need to work on. Logins are logged. Once a supplier is working through the new access point, you can shut down its old VPN and remote access tool.
-
Handover
We prepare the handover documentation and hand the system over to you.
Deliverables
What you get at the end
items handed over
- Inventory of existing remote connections
- Central, approval-based access solution
- Personal, time-limited supplier access with logging
- Handover documentation
Related services
What goes with external access
These services either prepare the ground for sorting out remote access or complement it.
OT security assessment
Produces a communication map of the OT network, including undocumented external connections. If you already have one, the inventory builds on it.
OT network segmentation
Splits a flat OT network into zones so an attack cannot spread from one compromised device to the whole plant. In this design, the supplier channel also runs into the DMZ.
Media inspection station
Checks USB drives, laptops, and files before they enter the plant, for when the maintenance engineer comes on site.
Zero trust remote access (ZTNA)
On the office side, replaces the traditional VPN with application-level access for employees working remotely.
Frequently asked questions
What people ask about remote maintenance
Why isn't a VPN or a ZTNA solution enough for this?
A maintenance engineer with a VPN can see the plant network. Many ZTNA products are optimized for web protocols, and their support for older client-server applications is uneven. In industrial environments, supplier access needs a different tool: a jump server, with session recording for critical systems. We covered this in our article on supplier remote access in OT environments.
Why start with remote access?
In practice, it is the biggest concrete risk, and also the area you can fix fastest. The most dangerous connection often belongs to a small integrator who has been logging in over VPN for years to maintain a piece of equipment.
Is there a regulatory background to this?
NIS2 requires the organizations in scope to manage the security risks arising from their relationships with suppliers and service providers. The organization remains responsible even if the supplier itself is outside the directive's scope. Cleaning up supplier remote access is one concrete, technical part of that risk management.
Who runs the system after handover?
Your own team can run it using the handover documentation. If you would like us to maintain the access point, we take that on under a custom agreement, within a scope agreed with you.
