Industry 4.0 Blog #4: Controlling Third Party & Remote Access to OT

The pressure to increase your operations’ efficiencies, agility, and competitiveness can be daunting.

One way to help relieve that pressure is leveraging the best minds available to get the job done quickly, effectively and efficiently. In our hyper-connected world, those resources are available to you. But whether they are on your payroll, or from a vendor or consultant, remote access is important for their availability.

The Objective of Industry 4.0:  Speed to Market and Reduced Cost

Remote access is necessary for these kinds of situations you might encounter:

• A vendor specialist who has experience with the problem you’re experiencing is located more than four times zones away.  

• The engineer who has been working on the update for critical design change is working from home and is ready to transfer the update to the PLCs in three different plants.  

• Finding out that the vendor that manages your data collectors has outsourced their support to a new subcontractor.

On top of that, the work-from-home phenomenon has evolved to work-from-anywhere. You find yourself needing to authorize access to factory systems from anywhere, at any time, and from all kinds of networks and devices. And for this reason, remote access plays a key role in enabling Industry 4.0 - whether in data analytics, sensor monitoring, troubleshooting, or process automation. 

And as Industry 4.0 technologies continue to advance, we can expect remote access to become even more critical. But it must be done in a way that does not increase the chance of improper access.

In a backward kind of way, this “Anytime, Anywhere, Any device” access is making OT security better, because it simplifies the security architecture and makes the way that users access the network consistent and simpler.  In the “Challenges” section below, we will explore why that is.

Making the Business Case for Secure Remote Access for OT

One of the key considerations when implementing remote access is whether it provides a hard-dollar return-on-investment (ROI). You can make the case for secure remote access using the same areas that you made for your operational technology initiatives. The cost is high if a bad actor manipulates equipment or sensors – especially since such a breach could impact production for weeks before the problem is identified, much less resolved. Such an attack against your organization could impact:

• Efficiency –Increase waste or energy usage, emissions, and other sustainability factors.

• Productivity – Changes in dimension tolerances that dramatical impact quality. Preventative maintenance or production schedules, and other metrics that reduce OEE.

• Agility – Manipulation of inventory or changeover assignments.

• Speed-to-Market – Reverting to previous versions of design updates.

In addition to calculating the potential losses above, quantify the improvement in metrics such as reducing the time required to get a piece of critical equipment back online by having problems remotely diagnosed, rather than delays due to travel time or not having the best support resource immediately available.

Challenges in Securing Remote Access

The basics of improving overall security of operations involves implementing limits to remote access to internal operations, authenticating the identity of anyone needing access, and encrypting all communications. But, it’s more than just installing technology.

Developing a secure remote access plan involves three areas:

• Technical - Implementing strong authentication, encryption, and access controls assumes that the person or computer requesting access has the absolute least privileges necessary to get their job done.
• Organizational - Clear policies and procedures make administration, regular security audits and monitoring simpler. For third parties accessing your operations, establish clear processes and communication channels for collaboration and decision-making.
• Human - Streamline the processes for support for front-line operators, and select technology that keeps day-to-day operations simple and effective.  Train them so that secure best practices are intuitive, and they are an important part of the process.

You can have secure remote access without adding risk. Manufacturers who fail to step up will fall behind.

Step-by-Step to Securing Remote Access for OT

1. Establish strict, well-defined access policies and controls that are specified in vendors’ contracts 

2. Educate yourself on the  terms “zero trust”, “secure overlay network” and “microsegmentation”.  Network security has evolved extremely fast over the last few years. These approaches are the state-of-the-art for remote access network security today. Tips about how to select the right technology are in the next section.

3. Regularly monitor and audit the access of third parties on the OT network, to ensure that they are only accessing authorized resources and not engaging in any unauthorized activities.  The key questions for you to ask: Who has access to my network? What Zones are they able to access? Am I able to cut off access easily? How does traffic move through my network? Can I identify the top 20% most critical assets in my network?

4. Use network segmentation and isolation techniques to limit the scope and impact of any potential security breaches that may occur through third party access to the OT network.

5. Conduct regular security assessments and penetration testing of the OT network, to identify and address any potential vulnerabilities that may be exploited by third parties.

6. Ensure that all third party users are made aware of and trained on the security policies and procedures for accessing the OT network, and that they are held accountable for complying with these policies and procedures.

Keys to Selecting the Right Remote Access Technology 

1. Limit Breach Exposure - If a bad actor gains access to one device, your network security design should limit them from being able to access other computers on the network. It is vital to limit the ability to "see" any other devices on the network except those that it must absolutely communicate with. Require your short-listed vendors to explain in detail, with a network security specialist involved, exactly how they limit network lateral movement to an absolute minimum. 

2. Temporary Access - When remote access to an internal device needs to be granted, access should be limited only to that device, and only for the time required. The reasoning for this is that an outside party’s device cannot be guaranteed to be free of malware or some other type of security breach. This limits access in the event that a compromised computer accesses your network.

3. Easy to Use - Because things move quickly when equipment is down, the technology should empower plant floor operators to add or change or delete access permissions for the equipment for which they have responsibility. OT operates at a different pace and in a different way than IT, so having this capability is vital at times to get equipment back in production.

4. Remote Access core to the offering - Another capability that you should be very careful to investigate is whether remote access functionality is "baked in" to the core design of the OT network security architecture. If remote access is a different module (separate licensing is your first indication that there's a problem), having to add an appliance or a separate computer, or if there is a different procedure or screen used on the administrative console for remote access, are also indications that the underline architecture has been piecemealed together. The reason that this is a problem is because the two technologies have been made to work with each other.  The underlying security modules do not share a uniform design. This can result in ‘gaps' in the security procedures that are used between the two systems that were not built “from the ground up”. It would be analogous to trying to retrofit an engine from automobile ‘A’  into the chassis of automobile ‘B’. It all looks good when you drive it off the lot. But when you hit 10,000 miles, things start to rattle or fall off.

What’s Next?

This is the fourth of a six-part series laying the groundwork for a successful, secure “Industry 4.0 Digital Transformation” initiative. This blog explores the issues and tradeoffs for securing remote access, and provides a roadmap to prioritize how you build your operational security plan. Expect practical, real world insight from successful implementations that you can use in your initiative.

#1 Industry 4.0 Digital Transformation

#2 How Visibility & Security Can Coexist in Manufacturing

#3 Hardening the OT Network

#4 Controlling Third Party & Remote Access into OT  ← this blog

#5 Conclusion and Resources for Your Success

Our objective is to provide you with information that you can use to communicate inside your organization where Industry 4.0 stands today, how to set the foundation for a successful OT security program, and how to get started.

Follow this blog series for a roadmap for creating a secure and manageable OT network. In our next piece, we provide resources and references that you can dig deeper into the details you need to make your project a success. To learn more about how you can prevent malicious actors from gaining access and doing harm to your operations start here, or follow Byos on LinkedIn to receive updates as the series continues.