Give remote access to control systems only when it is needed, make it operator controlled and time limited, require phishing resistant multifactor authentication, scope it to the asset and task, and log it. Avoid persistent vendor connections into control networks.
What the evidence says
CISA's alert on the December 2015 Ukraine power outages said attackers likely obtained legitimate credentials beforehand and then used remote administration tools or remote ICS client software over VPN connections. Its mitigations include limiting remote access, avoiding persistent vendor connections into control networks, making access operator controlled and time limited, and using strong multifactor authentication.
The May 2025 joint OT guidance says the same in modern terms: reconsider the risk tradeoffs of remote access, move to a private IP connection if it is essential, use a VPN with phishing resistant MFA, apply least privilege by asset, user role and scope of work, and disable dormant accounts.
Design the path
- List every route in: vendor VPNs, cellular modems, remote desktop, cloud portals.
- Remove the ones nobody can justify.
- Land the rest in the DMZ, on a jump host or bastion, not directly on the control network.
- Require individual accounts. Shared vendor logins hide who did what.
- Enable access per session, with an expiry, approved by someone on the operations side.
- Record sessions or at least log connections and commands where tools allow.
Contracts and integrators
CISA's advisory on Siemens S7 PLCs urges owners to share its guidance with system integrators and managed service providers who have remote access. Put security terms into integrator contracts: MFA, named accounts, notification of staff changes, and a duty to report incidents.
What to log and watch
- Who connected, from where, and for how long.
- Which assets they touched.
- Connections outside the agreed window.
- Dormant accounts that suddenly log in.
The Volt Typhoon advisory advises closely monitoring all connections into OT networks for misuse or anomalous activity, which is only possible if the paths are few and known.
Emergency access
Plan for the night a vendor must connect urgently. Write down who can approve it, how it is opened, and how it is closed again. Review every emergency session the next day.
A note on convenience
Permanent vendor links exist because they are convenient. Replace that convenience with a fast, documented approval path, so the secure route is also the easy one. If approval takes a day, people will find a shortcut.
Quick check
Is a VPN alone enough for vendor access?
No. Agencies pair it with phishing resistant MFA, least privilege, time limits, monitoring and removal of dormant accounts.
Should vendors have a permanent connection?
CISA advises against persistent vendor connections into control networks. Open access per task and close it afterwards.
Sources
- CISA, Ukraine Power Grid Cyber-Attack alert IR-ALERT-H-16-056-01
- CISA, Primary Mitigations to Reduce Cyber Threats to Operational Technology
- CISA, Defending Against an Active Threat to Siemens S7 Series PLCs, AA26-231A
- CISA, Volt Typhoon advisory AA24-038A
Last reviewed: 19 October 2026.
