I had a conversation with a site engineer this week who casually mentioned they’d set up a ‘temporary’ internet connection on the production network during the pandemic so the vendor could troubleshoot a PLC/DDC remotely. That was in 2020. They asked if they should probably close it.
Spoiler: they should.
Here’s the uncomfortable bit – we’re not actually that good at this yet. Remote access remains one of the easiest doors attackers use to get into operational systems, and most organisations haven’t properly locked it since the rush to remote work. The problem isn’t the technology. It’s that we treated emergency measures like they’d vanish when normal work came back.
What makes it dangerous is straightforward: a hacker gets one weak credential or finds one of these standing connections, they’re in. From there, they start spreading across your systems. And in OT, that means downtime. Real consequences – fuel supplies interrupt, power goes offline, water systems stop.
The uncomfortable truth is organisations recognise this is a problem but haven’t actually fixed it. They know what needs to happen: inventory what remote access points actually exist, limit them to only what’s needed, lock them down with strong authentication and encryption. Basic housekeeping. But ‘basic’ doesn’t always happen when uptime pressure is real and security budgets move slowly.
Two things worth checking this week:
Do you actually know which remote access points exist in your environment right now? Not what you think exists. What actually exists.
For each one, who has access and do they still need it?
Have a good week,
Damien Pope
Need help securing your OT environment? IEC 62443 gap analysis • Network segmentation • OT incident response – Talk to us
