Session Recording

What is Session Recording?

Session Recording is the automatic capture, storage and playback of the content of administrative sessions, such as RDP, SSH, VNC and console sessions, on systems that require elevated privileges. A recording shows afterwards exactly what a user did: which screens they opened, which commands they typed, which files they transferred, when and on which system. Where ordinary logging only registers individual events (user X logged in at 14:02), session recording shows the entire session in context.

In OT environments, session recording is an important means of achieving traceability, incident investigation and compliance, especially for remote access to PLCs, SCADA servers and engineering stations. Many OT systems log very little themselves, so the recording is often the only complete account of a change.

🎯 What do you use session recording for?

Session recording also has a deterrent effect: people who know their session is being recorded work more carefully and are more likely to follow agreed procedures. That also helps against insider threats.

🧠 What does a session recording capture?

A good solution masks passwords typed during the session, so that the recording itself does not leak credentials. Text recordings of SSH sessions are small and easy to search, whereas video of graphical sessions takes up far more storage.

🔧 How does session recording work technically?

There are two main architectures:

• Gateway or proxy based - the administrator does not connect directly but goes through a jump server, a proxy or a PAM gateway in the IDMZ. That intermediate step records the session without any software on the target system. This is the preferred approach in OT, because you do not have to install anything on certified or legacy systems.
• Agent based - an agent on the server itself records the session, for example for local console sessions. On Linux this can be done with tools such as tlog or pam_tty_audit with auditd. In OT this is less suitable, because suppliers of control software often do not support additional agents.

Session recording is usually part of a PAM platform. The session then runs as follows:

1. The user logs in to the gateway with two-factor authentication.
2. An approval workflow or just-in-time access grants access to a single target system for a limited time window.
3. The gateway injects the credentials from a password vault; the user never sees the password.
4. The session is recorded and stored encrypted; an operator can watch live in real time and terminate the session immediately if behaviour looks suspicious.
5. Metadata and event markers are sent to a SIEM for correlation and alerting.

📋 What do standards and legislation say about session recording?

None of the common standards literally requires a video recording. They do require you to control, register and be able to reconstruct privileged and external access. Session recording is one of the strongest ways to demonstrate that.

Notably, NIST explicitly points to privacy risks in AU-14. A recording contains personal data about the administrator, which in the EU brings the GDPR (AVG in Dutch) directly into play.

🏭 How do you apply session recording in OT environments?

A well-known example of why this matters is the incident at the Oldsmar (Florida) water treatment plant in February 2021. According to the sheriff, someone used TeamViewer to raise the sodium hydroxide setpoint from about 100 to 11,100 ppm. In March 2023 the former city manager stated that it was an employee’s mistake; the FBI then said only that it could not confirm the incident had been initiated by a targeted cyber intrusion. More than two years on, it was still unclear what had really happened. A full recording of the session through a controlled remote access route could have answered that question conclusively.

🔐 How do you set up session recording properly?

A practical six-step approach:

1. Define the scope - record at least all external and privileged sessions to SCADA, engineering stations, DCS servers, firewalls and domain controllers.
2. Enforce a single route - route all administrative access through the gateway in the IDMZ and block direct connections with segmentation, so nobody can bypass the recording.
3. Address privacy - establish a lawful basis, carry out a DPIA and inform users in advance (see the FAQ).
4. Protect the recordings - encrypt them, restrict access to authorised auditors and preferably store them immutably, similar to an immutable backup.
5. Set a retention period - 90 days to one year is common, depending on risk and sector; keep them longer only for a concrete reason, because the GDPR requires that you do not keep data longer than necessary.
6. Use the recordings - link event markers to the SIEM, review samples during audits and include the recordings in your incident response procedure.

Always combine session recording with MFA, least privilege and time-limited access. A recording tells you what happened but does not prevent damage by itself; the other measures limit what a user can do in the first place.

❓ Frequently asked questions

Can an employer record employees’ administrative sessions?

Yes, under certain conditions. Session recording processes personal data, so under the GDPR the employer needs a lawful basis (usually legitimate interest), must inform employees in advance and should limit recording to administrative sessions on critical systems. In the Netherlands, systematic monitoring of employees is on the Dutch Data Protection Authority’s list of processing operations that require a DPIA.

Does the works council have a say in session recording?

In the Netherlands it often does. Article 27(1)(l) of the Dutch Works Councils Act gives the works council a right of consent over facilities suitable for observing or monitoring the attendance, behaviour or performance of employees. A system that records the administrative sessions of your own staff usually falls under this; for external suppliers you arrange it through the contract.

What is the difference between session recording and logging?

Logging records individual events, such as a login or a changed setting, as lines of text. Session recording captures the full content of a session, including the screen image and context. The two complement each other: logs suit detection in a SIEM, while recordings suit reconstruction and evidence.

Should I also record local sessions on an engineering station?

Preferably yes, because much of the change work in OT happens locally, for example during a service visit. Have technicians work through the PAM gateway on site as well, or use an agent on the engineering station if the supplier supports it. Without recording local sessions, precisely the most far-reaching work stays invisible.

How long should I keep session recordings?

There is no fixed legal retention period for session recordings. In practice organisations choose 90 days to one year, so that incidents discovered late can still be investigated, and they retain recordings related to an ongoing incident for longer. The GDPR requires you to be able to justify the chosen period and to delete recordings afterwards.

Does session recording protect against session hijacking?

Not directly. Session recording makes visible afterwards what happened in a session, even if an attacker took it over, but it does not prevent session hijacking. That requires encrypted connections, MFA, short session lifetimes and automatic termination of inactive sessions.

📌 In summary

Session recording captures the full content of administrative sessions and so shows who did what, when and where. In OT this is especially valuable, because PLCs and HMIs log little themselves and external suppliers carry out many of the changes. Standards such as IEC 62443, NIST SP 800-53 and ISO 27001 call for auditable privileged access, and recording through a gateway in the IDMZ is a strong way to demonstrate it. Do settle the privacy side beforehand: lawful basis, DPIA, informing employees and, in the Netherlands, works council consent.

Session Recording provides visibility and control over administrative access to critical OT and IT systems, and together with PAM, MFA and least privilege it is an essential part of responsible cybersecurity in industrial environments.