◇ OpenCyber Academy
Professional · Chapter 7 · English

Chapter 7 — Contractor and vendor remote access

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 7 — Contractor and vendor remote access

Lesson map

Lesson 07 published. Map, example, EX031.

flowchart TD
  N0["Learning outcomes"]
  N1["7.1 Many hands"]
  N2["7.2 Lessons from AA21-042A"]
  N3["7.3 A controlled process"]
  N4["7.4 Removing the old routes"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX031"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["7.1 Many hands"]
  N2["7.2 Lessons from AA21-042A"]
  N3["7.3 A controlled process"]
  N4["7.4 Removing the old routes"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX031"]

[Learning outcomes]
    |
    v
[7.1 Many hands]
    |
    v
[7.2 Lessons from AA21-042A]
    |
    v
[7.3 A controlled process]
    |
    v
[7.4 Removing the old routes]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX031]

Learning outcomes

You will (1) inventory every remote route into building systems; (2) apply CISA AA21-042A lessons; and (3) design a controlled remote access process for contractors.

7.1 Many hands

A hospital may have separate contractors for BMS, chillers, lifts, fire alarms and access control, each wanting remote support. Without a policy, each installs its own route: a remote desktop tool on the workstation, a router, a cellular modem.

At Millbrook Aisha found four separate routes, three of them installed by contractors for their own convenience. None was malicious, but each was a way in that the hospital did not control. The first task is to list every route, with who installed it, what it reaches and whether anyone still uses it.

7.2 Lessons from AA21-042A

The CISA advisory on the 2021 compromise of a U.S. water treatment facility describes remote access software being used to reach a control system. Its recommendations include multi-factor authentication, strong remote desktop passwords, closing unused remote desktop ports and auditing remote connections. MITRE ATT&CK for ICS describes misuse of such routes as T0886 Remote Services.

For Millbrook the lessons map directly onto the routes Aisha found. A remote desktop tool on BMS-WS is the same kind of route described in the advisory. Requiring multi-factor authentication, auditing connections and closing unused remote desktop access are practical steps estates and the contractors can agree, without waiting for a larger project.

7.3 A controlled process

One hospital-owned remote access gateway; a named, multi-factor account for each contractor engineer; accounts disabled by default and enabled per ticket; access limited to the specific system the contractor maintains; sessions recorded where possible; the account disabled when the session ends.

Write the process in a short document that contractors sign, so they know how to get access in an emergency as well as for planned work. Test it once with each contractor before the old routes are removed. Review gateway accounts weekly, because accounts left enabled after a session are themselves a finding, as Millbrook's risk report later shows.

7.4 Removing the old routes

Once the gateway is in place, remove remote desktop tools installed directly on building workstations and disconnect unmanaged modems — in agreement with the contractor and estates, at a planned time, so support is not lost during an emergency.

At Millbrook the order was agreed with estates: the remote desktop tool was removed only after the BMS contractor's gateway account worked, the chiller router a week later, and the lift link restricted rather than removed. Record each removal with the date and who confirmed it, then check the route inventory again to make sure nothing has reappeared.

Worked example (synthetic Millbrook)

Aisha's route inventory finds four ways in: the gateway, a remote desktop tool on BMS-WS installed by the BMS contractor, the lift's cellular link, and a chiller vendor's router. Estates agrees a plan: the remote desktop tool is removed in week 1 after the contractor's gateway account works; the chiller router in week 2; the lift link is restricted to the lift contractor's service centre with a ticket requirement.

Synthetic case — Millbrook. Routes and timing are invented.

Errors and limits

Some lift and fire alarm links are required for safety monitoring; restrict and record them rather than removing them blindly.

Exercises

Synthesis

All remote help goes through one gateway with named, multi-factor, ticketed accounts; legacy routes are retired carefully.

Continue studying — chapter 07 of 12

← Chapter 06 (draft) · Course chapter index · Chapter 08 (draft) →