Learn Automation with MINATA #78: Remote Access for Maintenance — Support From a Distance, With Control and Evidence
Remote Access for Maintenance: Support From a Distance, With Control and Evidence
Remote support can shorten downtime considerably — provided it is turned into a procedure that is granted and recorded, rather than a permanently open door. A remote channel left open for convenience is a permanent security risk.
Define who, into what, when and to do what
Before opening remote access, answer four questions: who may connect, into which system, within what time window, and to do what. Permission to read SCADA is not permission to go online with a PLC; going online is not permission to download a program. Each role should hold the minimum rights its work requires.
A controlled architecture
A sound remote access architecture usually has:
- A managed access point — a jump host or controlled VPN — never a port opened straight into the PLC.
- Multi-factor authentication, as far as the systems allow.
- Session logging: who connected, when, and what they did.
- Approval by the person responsible at the plant before each support session.
- The ability to disconnect from the site whenever needed.
Do not share accounts
Do not use one shared vendor account for every machine and every person. When an incident or an unintended change occurs, a shared account makes it impossible to establish who did what. A distinct identity per person or role is the precondition for an audit trail that means anything.
A worked engineering situation
When a machine develops a fault that needs the manufacturer's help, the vendor engineer connects through a managed jump host after the person responsible at the plant approves the session. The rights are limited to that machine and that task, and the session is logged. When the work is finished, the connection is closed. The log records who came in and what they did, so it can be compared against any later change in the machine.
The architecture, the access rights and the approval procedure all follow the organisation's security policy.
Common mistakes
- Leaving the remote channel permanently open for convenience.
- Opening a port from outside straight into the PLC.
- Granting download rights to a role that only needs to read.
- One shared vendor account used across every machine.
- No session logging, so nothing can be compared when something changes.
Remote access checklist
- [ ] Who, into which system, when and to do what are all defined.
- [ ] Access goes through a managed point, never a direct port into the PLC.
- [ ] Multi-factor authentication and session logging are in place as far as possible.
- [ ] Each support session is approved by the person responsible at the site.
- [ ] Every person or role has its own identity; no shared accounts.
Controlled remote access turns distance into an advantage rather than an exposure. #79 goes into FAT and SAT: acceptance backed by evidence.
Read more automation knowledge at MINATA: https://minatavn.com/en/blog/industrial-automation
Previous — #77: OT network segmentation: https://minatavn.com/en/blog/automation-77-ot-network-segmentation
Next — #79: FAT and SAT evidence: https://minatavn.com/en/blog/automation-79-fat-sat-evidence
View all MINATA technical articles