Full Report
Ask different questions, get different answers. What should you be asking your OT “secure” remote access (SRA) vendor? The post 8 (and a Half) Questions for Your OT “Secure” Remote Access Vendors appeared first on Waterfall Security Solutions.
Analysis Summary
# Best Practices: OT Secure Remote Access (SRA)
## Overview
These practices address the inherent risks of connecting Operational Technology (OT) networks to external environments. The guidelines shift the focus from "IT-grade" software-based security, which relies on detection and response, to "Engineering-grade" protection that utilizes physical properties and deterministic hardware to prevent cyber-sabotage.
## Key Recommendations
### Immediate Actions
1. **Enforce Multi-Factor Authentication (MFA):** Ensure MFA is enabled for all remote access points; do not rely on passwords alone.
2. **Audit for "Override" Capabilities:** Configure client software to prevent users from overriding TLS/SSL certificate warnings or encryption errors.
3. **Disable "Auto-Connect" Features:** Turn off features that automatically save credentials or maintain persistent tunnels between IT and OT.
### Short-term Improvements (1-3 months)
1. **Transition to H2M Only:** Preference Human-to-Machine (H2M) access (screen scrapes/keystrokes) over Machine-to-Machine (M2M) or VPN access to prevent malware from hopping from a technician's laptop to OT assets.
2. **Vulnerability Assessment of SRA Software:** Review the patching history and known zero-day vulnerabilities of your current software-based SRA and MFA providers.
3. **Harden the IT/OT Interface:** Move away from relying solely on software firewalls, which can be bypassed by sophisticated exploits or misconfigurations.
### Long-term Strategy (3+ months)
1. **Implement Engineering-Grade Protection:** Replace or augment software security with hardware-enforced solutions, such as Unidirectional Gateways or hardware-isolated remote access (e.g., Waterfall HERA).
2. **Deterministic Defense Architecture:** Design the OT environment to remain safe even if the IT network or the SRA software itself is compromised.
3. **Zero-Trust for OT:** Move toward a model where no remote connection is trusted by default, regardless of credentials, unless passed through hardware-mediated inspection.
## Implementation Guidance
### For Small Organizations
- Focus on mandatory MFA and strictly limiting remote access to H2M (Screen sharing) rather than full VPNs.
- Ensure all software is updated weekly to mitigate known vulnerabilities in SRA tools.
### For Medium Organizations
- Implement a dedicated "Jump Server" or gateway that terminates connections in a DMZ before passing them to the OT environment.
- Standardize on hardware tokens for MFA to reduce the risk of SIM-swapping or mobile-based phishing.
### For Large Enterprises
- Deploy hardware-enforced Unidirectional Gateways at the IT/OT boundary.
- Integrate SRA logs into a centralized SOC, but ensure the "kill switch" for OT access is hardware-based or physically air-gapped when not in use.
## Configuration Examples
- **Certificate Validation:** Set `StrictCertChecking=True` (or equivalent) in SRA clients to prevent Man-in-the-Middle attacks.
- **Protocol Limitation:** Configure gateways to allow only specific OT protocols (e.g., Modbus, OPC UA) and block generic tunneling protocols like RDP or SSH over the WAN.
## Compliance Alignment
- **IEC 62443:** Requirements for system integrity and zone/conduit separation.
- **NIST SP 800-82:** Guide to Industrial Control Systems (ICS) Security.
- **NERC CIP:** Standards for Electronic Security Perimeters (ESP) and remote access management.
## Common Pitfalls to Avoid
- **The "Secure" Fallacy:** Assuming a product is safe just because it is marketed as "Secure" Remote Access; software always contains defects.
- **M2M Over-extension:** Allowing remote laptops to act as nodes on the OT network via VPN, which facilitates the spread of ransomware.
- **Over-reliance on Detection:** Depending on an Incident Response team to catch an attack in progress rather than using hardware to prevent the attack from entering.
## Resources
- **Waterfall HERA (Hardware-enforced Remote Access):** `https://waterfall-security[.]com/technology-and-products/hera/`
- **Webinar: 13 Ways to Break OT SRA:** `https://waterfall-security[.]com/ot-insights-center/ot-cybersecurity-insights-center/webinar-13-ways-to-break-secure-ot-remote-access-systems/`
- **NIST OT Security Guidelines:** `https://csrc.nist[.]gov/publications/detail/sp/800-82/rev-3/final`