System visuals
What It Is
Industrial cybersecurity protects control-system availability, integrity and recoverability through asset governance, segmentation, identity, secure configuration, monitoring, backups and response. Remote access is one controlled service within that architecture, not a direct public path to controllers.
Applications and Operating Objectives
Applications include OT risk assessment, secure vendor support, jump hosts, network segmentation, asset inventory, backup/recovery, logging, account governance, hardening and incident-response readiness.
System Workflow and Architecture
Remote users terminate through an approved gateway or jump service, receive least privilege for a defined duration and cannot expose PLC/SCADA services directly to the internet. Safety and production continuity govern every control.
Main Equipment and Software Components
Components may include firewalls, secure remote-access gateway, jump hosts, MFA through owner-approved service, privileged-access controls, logging/SIEM connector, asset inventory, backup system and endpoint protection compatible with OT.
Capacity and Design Basis
Design uses asset criticality, access roles, vendor/support needs, network topology, authentication policy, recovery targets, legacy constraints, logging and regulatory or contractual requirements.
| Operational scale | Assets, accounts, vendors, simultaneous sessions, zones, rules, logs, retention, backup volume and site count are quantified. |
|---|---|
| Interfaces | Identity, ticket/approval, firewalls, jump hosts, directory, logging, backup, endpoint and incident systems have clear trust and failure boundaries. |
| Acceptance performance | Acceptance verifies role and approval, denied paths, session logging where required, timeout, account expiry, rule behavior, backup/restore and emergency revocation. |
| Unknown/TBC | Unverified counts, latency, accuracy, availability, savings and integration assumptions remain TBC until survey and testing. |
Utilities and Infrastructure
Secure management network, gateway/jump hosting, redundant connectivity where required, time service, log storage, backup vault, owner administration and recovery access are assessed.
Required Customer Engineering Inputs
Customers provide asset and account inventory, network/configuration backups, vendor list, support workflows, critical operations, recovery targets, current incidents/gaps and security policies.
Data, Automation and Control
Cyber tools must not impair deterministic control. Changes use tested maintenance windows, rollback and owner approval; UNKNOWN assets remain quarantined or under review.
Cybersecurity and Access Control
Core principles include unique identity, least privilege, MFA where supported, segmentation, monitored remote sessions, secure configuration, offline/immutable backup and rehearsed incident response.
CAPEX and OPEX Drivers
CAPEX depends on site and vendor scale, legacy remediation, gateway/logging/backup infrastructure and integration. OPEX includes monitoring, access administration, reviews, patching, testing, licenses and incident exercises.
Safety, Compliance and Lifecycle
Security actions consider process hazards; emergency isolation and recovery cannot create an uncontrolled plant state. Credentials and internal topology are never exposed in public content.
Outputs and Acceptance Basis
Outputs include current/target architecture, asset/access inventory, rule and role matrix, configured remote-access workflow, logging, backup/restore evidence, incident procedures, tests and training.
Implementation and Commissioning
Delivery starts with read-only discovery and risk prioritization, then lab or staged configuration, approved cutover, access and recovery tests, documented exceptions and ongoing review.
Project Evidence
Frequently Asked Questions
Can a PLC be connected directly to the internet?
No. Remote support should pass through controlled segmented access with authorization and monitoring.
Is MFA always possible in OT?
It is applied where technically supported and risk appropriate; compensating controls are documented for legacy constraints.
Can vendors keep permanent accounts?
Access should be unique, least privilege, reviewed and preferably time-bounded; shared permanent credentials are avoided.
Will security scanning stop production?
Testing methods are selected for OT risk; active scanning requires explicit approval and controlled conditions.
How are backups protected?
With versioning, restricted access, offline or immutable copies where appropriate and tested restoration.
What is session recording for?
It supports accountability and review where policy requires, with clear retention and privacy rules.
How are legacy systems handled?
Segmentation, allow-listing, jump access, monitoring, backup and controlled replacement compensate for unsupported features.
What proves remote access is secure?
Documented architecture, denied-path tests, role/approval evidence, logs, expiry/revocation and recovery testing.
Related Engineering Links
Smart & Intelligent Solutions overview · AI Vision Inspection · Digital Twin & Data Platform · Projects & Cases · Request a Project Evaluation
Request a Project Evaluation
Provide system inventory, network and control drawings, data samples, user and security requirements, existing backups, operational constraints and acceptance priorities. Unknown information may remain TBC.