Give vendors access to a jump host in the industrial DMZ, not a route into the control network. Open it for a named person, a named target, and a time window. Require MFA to reach the jump host, record the session, and close it when the work ends.
Most remote access problems I see are not exotic. A VPN account made for a commissioning job is still active 3 years later. A cellular router on a panel still has its default password. Nobody owns the list. CISA’s guidance on reducing OT cyber threats lists limiting exposure of OT to public networks and securing remote access among its primary mitigations, and NIST SP 800-82 Rev. 3 treats remote access as a boundary that needs its own controls.
The pattern
- The vendor authenticates to a gateway with MFA.
- The gateway hands them a session on a jump host in the iDMZ (Level 3.5 in the Purdue model).
- From the jump host, a firewall rule allows one inbound path to one named target, such as the engineering workstation.
- The session is recorded, and the recording is kept.
- The access window closes by itself.
The vendor’s own laptop never has an IP route to a PLC. If the vendor needs their programming software, install it on the engineering workstation or a controlled virtual machine behind the jump host. This is the remote access conduit in the zones and conduits worked example.
The controls, and what each one stops
| Control | What it stops |
|---|---|
| Jump host in the DMZ | A compromised vendor laptop reaching the plant directly |
| Per-person accounts | Shared logins nobody can attribute |
| MFA | Stolen or reused passwords |
| Time-bound access | The forgotten account and the always-open tunnel |
| Session recording | Disputes over what changed, and slow incident review |
| One named target | Lateral movement from the engineering host to everything else |
| Approval by the operator | Surprise sessions during production |
Time-bound access works best when someone at the plant approves each session by phone or ticket. It is a small step, and it catches the unexpected login, which is the one you most want to catch.
View-only first
Many support calls are diagnostic. Some jump host and remote access products can give a view-only session first, with a second approval for a session that can change logic. Not every tool supports this, so ask.
What to ask the vendor
- Do you connect through our jump host, or do you require your own tunnel or modem?
- Are your technicians named, and do they use MFA?
- Which ports and protocols do you need, and to which devices?
- What remote support tools run on your laptops, and who patches them?
- Do you keep copies of our project files, and where are they stored?
- How do you tell us if you suspect your own environment was compromised?
- Do your practices align with IEC 62443-2-4 for service providers?
If a vendor insists on a permanent cellular modem inside a panel, record it as an exception with an owner and a review date. Do not let it go unrecorded.
When the vendor pushes back
Some vendors want their own tunnel because it is how they support every customer. That is a reasonable thing to say and a poor reason to accept it. Offer the jump host, a test window, and a named contact on your side. A vendor that cannot work through a customer-controlled gateway is worth recording as a supplier risk, with an owner and a review date.
Hardening the jump host
Treat it as a sacrificial, well-watched system. Patch it, keep it off the business domain if you can, disable clipboard and file transfer unless the job needs them, and send its logs somewhere the vendor cannot reach. Block outbound internet from it except what the gateway needs.
Remote access also leaves a trail you can use. Pair it with passive monitoring and an inventory so a session that touches an unexpected device shows up.
The wider set of controls is in Security controls for OT networks that hold up in production, and the site overview is on industrial OT networks. The boundary design is taught in Hardening Control Networks and covered in the free OT networks course. The OT and IT convergence advisory covers the organizational side.
If you want help designing or reviewing a vendor access path, see /book/.