Remote access has become indispensable for efficient maintenance of substations: vendors and maintenance partners no longer need to be physically present for every configuration change. That same access is, however, also one of the most commonly used attack paths towards OT environments, precisely because this connection comes from outside your own organisation.
Where it often goes wrong
A common pattern is that a vendor can log in directly to equipment in the substation via its own VPN connection, without involvement of the asset owner. When the credentials of this connection are compromised — for example at the vendor itself — an attacker potentially has direct access to critical OT equipment.
Principles for secure remote access
- Centralise access via one controlled remote access gateway, instead of separate VPN connections per vendor or maintenance partner.
- Use multi-factor authentication for every remote session, regardless of who the requester is.
- Grant time-bound authorisation. Access is explicitly opened for a planned session and automatically withdrawn again, instead of remaining permanently active.
- Record sessions. Record who logged in, when and with which rights, and consider session recordings for critical systems.
- Limit what a session can reach. A remote session for maintenance on a specific IED does not need access to the entire substation LAN.
- Review access periodically. Remove access for parties that no longer have an active role.
Relationship with IEC 62443-2-4
These principles align directly with the requirements of IEC 62443-2-4 for service providers, which address, among other things, management of privileged access and secure remote maintenance. An asset owner can lay down these requirements contractually and have the service provider demonstrate them on handover.
Practical example
A grid operator sets up a central remote access gateway in the control centre. Every maintenance party requests a time window via a portal, after which access to only the relevant equipment is opened for the duration of the session. All sessions are logged and spot-checked by the security operations centre.
Common mistake
Allowing remote access via generic, shared accounts used by multiple employees of a vendor. Without personal authentication it cannot be traced who was actually responsible for a specific change.