Remote access is the common thread in several public OT incident reports: VPN credentials in Ukraine in 2015, desktop sharing software at a US water plant in 2021, and internet-exposed PLCs in 2023. Lock it down with private connections, phishing-resistant multifactor authentication, least privilege, and time-limited vendor sessions.
What the advisories describe
CISA's alert on the 2015 Ukraine outages says attackers likely used legitimate credentials over VPN and existing remote administration tools. The 2021 water plant advisory says weak passwords, an outdated operating system and possibly desktop sharing software were involved. The 2023 PLC advisory says devices were reachable from the internet with default or no passwords.
None of the three needed an exotic technique. Each used a door that someone had opened for legitimate reasons.
Who needs access, really
Make a list by role:
- Operators who need to view and sometimes adjust.
- Engineers who program controllers.
- Vendors and integrators who support equipment.
- Managed service providers who maintain systems.
Each group needs a different level, and most need it only part of the time. CISA's Ukraine alert advises operator-controlled, time-limited access and avoiding persistent vendor connections into control networks.
A lockdown checklist
- Remove direct exposure. Nothing that controls a process should be reachable from the public internet.
- Route access through a controlled entry point, such as a VPN or gateway, then on to a DMZ rather than straight to controllers.
- Require multifactor authentication, preferably phishing-resistant, and use dissimilar factor types where you can.
- Give each person an individual account. Shared accounts hide who did what.
- Disable unattended access in remote control tools, as the 2021 advisory suggests, and require host confirmation beyond view-only sessions.
- Disable dormant accounts on a schedule.
- Log every session and review the logs, including for protocols such as RDP.
- Set vendor access to expire, and switch it on only when a ticket exists.
Questions for your vendors
Ask how they connect, with what credentials, and who at their end can use them. Ask whether sessions can be recorded. Ask what happens to access when an employee leaves. Our checklist on supplier questions goes through this in detail.
What not to rely on
An IP allowlist alone is weak if an attacker can first take over an allowed machine. A VPN is only as strong as the credentials and the device behind it. Treat each as one layer.
Quick check
Is a VPN enough for OT remote access?
No. CISA's 2025 mitigations pair VPNs with strong passwords, phishing-resistant multifactor authentication and least privilege.
Should vendors have permanent access?
CISA's Ukraine alert advises avoiding persistent vendor connections into control networks and making access operator-controlled and time-limited.
Safeguard covers the software side, including agent identity and policy controls for tools that touch your code and pipelines, though not OT remote access gateways.
Sources
- CISA, IR-ALERT-H-16-056-01
- CISA, AA21-042A
- CISA et al., AA23-335A
- CISA, Primary Mitigations to Reduce Cyber Threats to Operational Technology
Last reviewed: 19 October 2026.
