With third-party access, security teams face the challenge of making decisions about who, what, and how external partners, vendors, or contractors requiring network access for collaboration or service provisioning, will get it. VPNs have been the staple of Remote Access security, but networks have grown more complex and so too have the threat vectors. This article will explore some differences between Cloud and On-prem resources, and considerations about different approaches and technologies.
Jump to section:
Different Approaches for Cloud vs. On-Prem Accessed Resources
Considerations of secure, controlled access
Alternatives to VPNs for Third-Party Access
Drawbacks to Technologies that Provide 3rd Party Access Capabilities in OT environments
A New Approach: Benefits of Isolating Third-Party Access
Allowing Third Parties into your network with Byos
Different Approaches for Cloud vs. On-Prem Accessed Resources
Cloud resources generally benefit from built-in security measures due to their public-facing nature, so this blog addresses the challenges associated with on-premise network security. On-premises assets traditionally rely on a complex set of perimeter, network, application, and endpoint protections, as well as incorporating network segmentation, access controls, detection systems, vulnerability management, and security awareness training. Because of the multifaceted nature of most corporate networks, allowing access to enterprise assets by third-parties isn’t as straightforward as it should be. There are often many different ways of achieving remote access, but these different approaches often create a trade off decision between security and convenience.
There are lots of technologies that simply allow third-parties to have access to the network, but ensuring that access is secure and controlled is another. There are several considerations to be thought of when selecting remote access solutions for highly critical assets inside of networks:
For additional understanding the deep technical aspects of mitigating these considerations, refer to these articles:
When it comes to remote access in OT, there are several alternatives to both traditional and hardware VPNs, each with its own benefits and drawbacks. Hardware VPNs provide a dedicated device for secure remote access, offering enhanced security through hardware-based encryption and authentication. But, their limitations lie in security, visibility and control.
Unidirectional gateways / Data Diodes offer a one-way flow of data between devices, providing protection against unauthorized access. However, they present limitations in terms of data transfer options and compatibility with complex protocols. Their primary drawback is the lack of bidirectional communication, which can restrict certain applications or require additional configurations for necessary interactions. Additionally, the complexity of deployment and management can pose challenges, requiring careful configuration and ongoing monitoring to ensure proper functionality and secure data transmission.
ZTNA (Zero Trust Network Access) is gaining popularity as an alternative approach to secure remote access in IT. Elements of ZTNA are not optimal for OT because almost all ZTNA vendors require an agent to fully implement their solutions, which eliminates the compatibility with legacy and unmanaged devices. The primary objection to ZTNA for OT lies in the complexity of implementation, requiring significant planning and coordination to seamlessly integrate with existing network infrastructure and applications.
In evaluating alternatives to VPNs in OT environments, organizations should carefully assess their specific requirements, considering factors such as scalability, level of expertise & number of resources required to administer, and the complexity and timeframes for implementation. It is crucial to strike a balance between security, usability, and operational efficiency to establish strong and effective third-party controls.
Among the alternatives used by organizations to address remote access for third parties in OT environments, the reality is that each comes with a variety of different limitations and drawbacks. The table below lays out a comparison among these technologies in terms of their limitations with regards to security, practicality, visibility and control - and thus the challenges one would face with implementing each of these technologies.
As a result of these limitations, organizations typically find themselves with new difficulties in terms of ease-of-access and inefficiencies or become straddled with increasingly complex setups to try and make up for these drawbacks. These approaches also often fail to account for the differences in the OT environment compared to IT, leaving gaps in the overall security posture, areas which still can be exploited by threat actors, as well as other tradeoffs in order to provide network access to third-parties. OT specific network security technologies have been created to address the challenges and limitations of these traditional technologies, centered around the idea of isolating the devices from the network - to provide maximum control over communication between devices and prevent the spread of attacks should any device be compromised.
At Byos, we have taken this different approach to securing remote access, which involves a few core principles:
To give a third party access to your assets on-prem, Administrators can create Guests within the Byos Overlay network.
To read more about the Byos Solution and how it works for enabling third party access, read the Securing Industrial Control Networks use case
The two fastest growing cybersecurity threats are the susceptibility of OT and the focus that attackers have on supply chain security. Combine those threats with the risks of third-party access into OT, this has increased the priority of executives in manufacturing and critical infrastructure to address those concerns. If you would like to learn more about the latest state-of-the-art OT security technologies that address third-party access, reach out to Byos to speak with an expert.