Remote Access

What is Remote Access?

Remote access is the ability of users, suppliers or systems to connect from another location to a network, device or application and work on it as if they were physically present. In IT it is routine for home working and server administration. In OT environments, remote access is used for management, maintenance, Monitoring and support of PLCs, SCADA systems and HMIs, without anyone having to travel to the plant. Because an external connection can end up directly at systems that control a physical process, remote access is also one of the most abused entry points into industrial networks.

🧠 What is remote access used for in OT?

Remote access makes it possible to:

• Log in to servers, PCs or controllers — for example an Engineering Station to change PLC logic
• Fix faults and adjust configurations without travel time
• Install software updates and patches on HMIs, servers and MES systems
• Monitor Real-time data via SCADA, HMIs or dashboards
• Provide remote support by suppliers, system integrators or the in-house IT department

Typical users are the organisation’s own on-call engineers outside office hours, the machine builder carrying out diagnostics on equipment at a customer’s site, and maintenance contractors watching over dispersed sites such as pumping stations and water-treatment plants. Supplier access for maintenance is covered in more detail in Remote Maintenance.

🔧 Which technologies are used for remote access?

The key difference is scope: a classic VPN places a user inside the network, whereas a Zero Trust solution (ZTNA) only grants access to the one system the task requires.

🔐 Why is remote access such a major risk for OT?

Every external connection is a conduit between an untrusted network and the control of a physical process. Incidents keep showing the same pattern:

• Oldsmar (February 2021) — at a water-treatment plant in Florida, the sodium hydroxide setpoint was raised via TeamViewer from 100 to 11,100 ppm. An operator reversed the change straight away. In 2023, the former city manager stated that the FBI could not confirm a targeted intrusion and that an employee was probably the cause. Above all, the event shows how little control there was over who could operate the process through which tool.
• Colonial Pipeline (May 2021) — attackers got in through an unused but still active VPN account without MFA whose password had leaked. The DarkSide ransomware hit the IT environment, but the pipeline was shut down as a precaution from 7 to 12 May.
• Aliquippa (November 2023) — an internet-connected Unitronics PLC with HMI at a drinking-water booster station was taken over by the Iran-linked group CyberAv3ngers using the default password 1111.
• Internet-facing VNC (2025) — in December 2025, CISA warned about pro-Russian hacktivists who reached HMIs in water, energy and food production through unsecured VNC connections and weak passwords.

The common causes are systems connected directly to the internet, shared or default passwords, missing MFA, dormant accounts and remote tools installed outside the administrator’s view.

🏗️ What does a secure remote access architecture look like?

A secure architecture follows the Purdue Model and the zones and conduits model from IEC 62443. No external connection ever lands directly in the OT network:

1. Access terminates in the IDMZ — the VPN or ZTNA connection ends in an industrial DMZ between IT and OT, shielded by firewalls.
2. Via a jump server — from there the user works on a hardened intermediate host; only that host may talk to the target system over defined ports.
3. Strong authentication — personal accounts with MFA, preferably phishing-resistant; SMS-based 2FA is a minimum, not the standard.
4. PAM and least privilege — administrator passwords held in a vault, with access rights per task and per system.
5. Just-in-time access with approval — accounts are disabled by default; the operator or process owner approves a session for a fixed time window.
6. Session recording and logging — every session is recorded and can be replayed afterwards; logs go to a SIEM or OT SOC.
7. Automatic termination — sessions close after inactivity or at the end of the window, and the operator can always disconnect a session manually.

Dedicated Secure Remote Access platforms bundle these functions into one product. They often use an outbound connection from the OT zone, so no inbound ports need to be opened.

📋 What do IEC 62443 and NIS2 require for remote access?

Supplier security is a recurring theme: NIS2 requires you to manage supplier risks, and remote access by machine builders and integrators is the most concrete example of that.

🛠️ How do you set up remote access step by step?

1. Inventory every access path — look for VPNs, 4G routers, remote tools and supplier modems. There are often more connections than anyone knew about.
2. Close direct internet connections — no RDP, VNC or PLC ports exposed to the internet, and remove default passwords.
3. Choose one central access route — via the IDMZ and a jump server or an SRA platform, and prohibit standalone tools.
4. Define an access process — who requests, who approves, how long the session lasts and who watches along during critical changes.
5. Include requirements in contracts — personal accounts, MFA, incident notification duties and compliance with IEC 62443-2-4.
6. Monitor and review — check session logs, disable dormant accounts and review permissions periodically.

Common rules of thumb in practice (not normative values): sessions of at most 4 to 8 hours, an inactivity timeout of 15 to 30 minutes and a quarterly review of all external accounts.

❓ Frequently asked questions

Is a VPN enough for remote access to OT?

A VPN on its own is not enough for remote access to OT, because it gives a user access to an entire network rather than to a single system. A VPN should terminate in an IDMZ, followed by a jump server with MFA, restricted permissions and session recording.

What is the difference between remote access and remote maintenance?

Remote access is the general term for any remote connection to a network or system. Remote maintenance is a specific application of it, in which a supplier or technician carries out maintenance, updates or fault analysis remotely.

Can a supplier install its own remote access box in my plant?

A supplier’s own remote access box is acceptable if it is under your control: connected via the IDMZ, with visible sessions, approval per session and the ability for you to cut the connection. A box that opens its own tunnel into the OT network directly over 4G or the internet bypasses your security and is a serious risk.

What is ZTNA and why does it suit OT?

ZTNA (Zero Trust Network Access) gives a user, after verification, access only to the specific application or system needed, never to the whole network. That makes it attractive for OT, because a compromised account cannot then move freely through the production environment.

Why is session recording important for remote access?

Session recording captures what an external user did on screen during a remote access session. It helps when investigating faults and incidents, and it makes suppliers demonstrably accountable for their actions.

Does NIS2 require remote access to be secured?

Article 21 of NIS2 does not mention remote access by name, but it requires access control policies, multi-factor authentication and supply chain security. For organisations covered by the Dutch Cybersecurity Act, this means in practice that remote access to OT must be secured with MFA, logging and supplier agreements.

📌 In summary

Remote access lets employees and suppliers manage and monitor systems remotely, but in OT it is one of the most abused entry points. A secure setup runs through one central route via the IDMZ and a jump server, with MFA, just-in-time approval, network segmentation and session recording in line with IEC 62443, NIS2 and good security practice.