Remote support through TeamViewer connecting directly to the SCADA PC is a common security weakness in plants. TDL designs the access path following the IEC 62443 zones and conduits principle: a VPN or jump host placed outside the control network, individual accounts for each person, access sessions switched on and off by the plant, and a log of every session. TDL or vendor support engineers can connect when the plant opens a session, and the plant knows who connected and when.
Secure remote access setup for technical support
Open a remote support path into the control system in a controlled way: individual accounts, sessions switched on and off by the plant, and an access log.
Scope
- Assessment of current access methods and risks
- Design of the access path (VPN/jump host) separated from the control network
- Configuration, per-person permissions, per-session enable/disable
- Access log
- Operating guide for IT and maintenance
Not included
- Continuous OT monitoring
What the plant prepares
- Plant IT involvement
- Customer's security policy
| Duration | Confirmed after a survey — TDL states the scope and number of days before work starts |
|---|---|
| Price | Quoted per scope after the survey |
Related services:
Industrial networks & OT security
Related technical articles
- ControlLogix and CompactLogix I/O and Connection Fault Codes: 16#0204, 16#0203 and Other Common Codes
- ControlLogix 5580 and 1756-EN4TR Syslog: Reading Events to Trace Lost Connections and Unexpected Stops
- DLR or PRP: Choosing Redundancy for an EtherNet/IP Network
- Firewalls for FactoryTalk and Logix systems: open the right ports, not "any"
- Rockwell Allen-Bradley PLC security: off the internet, RUN keyswitch, port 44818 blocked, firmware, backups