Managed Industrial Remote Access

In Wastewater Operations Case Study: Zero Trust Remote Operations and Asset Management we discussed the motivators of providing an ongoing remote-operations service, which Water Control Automation achieved using Agilicus AnyX. One of the key discussion points with the end customer was: who should manage the Industrial Remote Access, and how would this be shared across the customer’s staff as well as other vendors. In this document we discuss some of the key reasons that Water Control Automation’s customers chose to buy Industrial Remote Access as a managed service as part of Water Control Automation’s Remote Operations service.

Key discussion points include:

1. User Management, Single-Sign-On
2. Audit depth and accuracy
3. Request on demand to allow ad-hoc access
4. Consolidation of existing ‘shadow IT’ backdoor systems such as Ewon, TeamViewer
5. Ongoing usage by end-customer staff
6. Key trust points such as VNC/HMI with read-only access or simultaneous local + remote access
7. Shared Custody Model of configuration and Audit

Water Control Automation leveraged their experience in acquiring, commissioning, and operating complex systems to provide a managed industrial remote access system to their customers, meeting their customers security requirements, increasing their utility of systems, using Agilicus AnyX.

In Wastewater Operations Case Study: Zero Trust Remote Operations and Asset Management we discussed Water Control Automation, a full-service system integrator and engineering company. They have an in-house panel shop and expertise in Schneider Electric, Rockwell Automation’s Allen-Bradley Programmable Logic Controllers. A large part of their business is creating and supporting Human Machine Interfaces, using either VTScada or Ignition.

When discussing their proposed Remote Operations service with various potential customers (operators), Water Control Automation learned of a set of requirements for Industrial Remote Access for each of the various users in the ecosystem. Initially it appeared that their customers wanted to manage all Remote Access themselves. Upon discussion, Water Control Automation’s customers were finding the variety of systems and requirements overwhelming and wanted a managed system that they controlled the authorisation and worked universally across their own staff as well as all 3rd party support staff.

End-Customer / Operator Requirements

Water Control Automation’s customers own the risk, own any bad outcomes. As a consequence, they expressed their requirements as

• Can individual enable requests in real-time (e.g. user A requests access to B)
• Staff can have first-class access with single-sign-on and multi-factor authentication
• Full audit trail of configuration changes as well as resource access
• All users including external have multi-factor authentication
• HMI remote access would not lock out local (screen would not go black)
• No inbound ports allowed on firewall
• No VPN access allowed to full network
• Must work with Starlink/Cellular NAT’d connections for remote locations
• Must allow inspection by existing next-generation firewall
• No end-user password set/reset flows
• Shared administration (user authentication, resource authorisation)

From above we can see that the operator has a strong requirement for security, for transparency.

In addition, the operator expressed some frustration with existing shadow-IT point solutions such as Ewon and TeamViewer. Each of these was incompatible with some of the above requirements, and, were also not ubiquitously available to all users or all systems.

Manufacturer Requirements

The operator’s have various manufacturers. These in turn have two use cases, one being ad-hoc support, and one being ongoing connectivity needs for license-managers, outbound data streaming. For the first case, the manufacturers expressed a strong preference for the following:

1. Existing company identity (no new users)
2. Web-based (no new software)
3. Simple ability to request access

For the outbound connectivity (license-manager, data streaming), the manufacturer expressed no preference, leaving this decision making to the system integrator.

System Integrator / Support Requirements

The system integrators were involved from design through initial deployment of new systems, with warranty and ad-hoc support for some short time after commissioning. These users expressed set of requirements, but were ultimately accepting of whatever the operator provided. Their requirements were:

1. Avoid IP adjacency / requirement to change local subnets
2. Avoid multi-factor authentication (or, be consistent with other systems they used)
3. Operate with a wide variety of resources as if local (e.g. PLC program, read tags)

Requirements Summary

Water Control Automation thus became aware that there was an opportunity to solve the above requirements in a way that was acceptable to each player, but also provided strong (and sticky) value.

Agilicus AnyX introduces a Zero Trust framework tailor-made for industrial control systems in public water utilities Zero Trust is the best current practice for Cyber security in Industrial Control Systems for Public Water Infrastructure. It integrates effortlessly with existing networks and offers an affordable and low-risk method to enhance both efficiency and security. Whether you already have deployed an IEC-62443 Zone and Conduit model, or are driven more by the Purdue Model, Agilicus provides a low-risk method to enhance both efficiency and security, providing an ideal platform for Zero Trust Managed Industrial Remote Access.

From an end-user perspective (whether Water Control Automation’s team, or, each of their customer’s teams), the system proved very simple to use. All devices, regardless of operating-system or form-factor, support a browser, the only tool they need for the HMI access (VNC, Ignition, VTScada). For Water Control Automation’s team, they use their familiar PLC programming software. No VPN, no worry about overlapping IP, they can work on two customers simultaneously from the same laptop.

For the single-sign-on, each user uses their existing, native, corporate credentials. Typically this means no sign in is needed, even for the users with the on-premise Active Directory: it behaves similarly to signing into Office 365.