Chapter 8 — Remote access for vendors
Lesson map
Lesson 08 published. Map, example, EX029.
flowchart TD
N0["Learning outcomes"]
N1["8.1 Why vendors connect"]
N2["8.2 What the advisory found"]
N3["8.3 A safer pattern"]
N4["8.4 Ending the session"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX029"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["8.1 Why vendors connect"]
N2["8.2 What the advisory found"]
N3["8.3 A safer pattern"]
N4["8.4 Ending the session"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX029"]
[Learning outcomes]
|
v
[8.1 Why vendors connect]
|
v
[8.2 What the advisory found]
|
v
[8.3 A safer pattern]
|
v
[8.4 Ending the session]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX029]
Learning outcomes
You will (1) describe how vendors reach plant systems remotely; (2) explain lessons from the 2021 Oldsmar water advisory; and (3) run a remote session following a simple checklist.
8.1 Why vendors connect
Machine builders support their equipment remotely to diagnose faults without travelling. That is useful, but a permanent, always-on link into the line is also a permanent way in for anyone who steals the credentials.
At HPFL the wrapper builder occasionally needs to read fault logs. That need is real, and refusing all remote access would mean waiting days for a visit. The answer is to allow access only through a controlled route, for a specific job, under the site's watch.
8.2 What the advisory found
CISA advisory AA21-042A describes the compromise of a U.S. water treatment facility in 2021 in which remote access software was used to reach a control system. Its recommendations include using multi-factor authentication, strong passwords for remote desktop, closing unused remote desktop ports and auditing remote connections. Those points apply directly to a packaging line.
At HPFL that means checking that no remote desktop software runs directly on HMI-1 or ENG-LT, that vendor accounts use multi-factor authentication, and that remote sessions are logged and reviewed. The lessons meeting in Chapter 16 later found a remote desktop port on HMI-1 opened by a contractor, exactly the kind of route the advisory warns about.
8.3 A safer pattern
Remote access goes through one site-controlled gateway in the DMZ, never software installed directly on HMIs. Each vendor has a named account with multi-factor authentication. The connection is disabled by default and enabled for a ticketed session window. Someone at the site watches the session and can end it. Sessions are logged and reviewed.
Write the pattern into a short procedure that vendors receive before their first session. The supervisor opens a ticket with a time window; the technician enables the account and watches. If a vendor asks for permanent access, the request goes to the supervisor and is normally refused.
8.4 Ending the session
When work finishes, the account is disabled again, the change is recorded, and the operator confirms the line behaves normally. A session left enabled "for next time" is the commonest failure.
At HPFL Tomás disabled the vendor's account at 14:38, before the window closed, and recorded the start and end times in the ticket. Check vendor accounts weekly to confirm none are left enabled. An account found enabled outside a ticket is reported as a finding. Confirm also that the vendor's change appears in the register.
Worked example (synthetic HPFL)
The wrapper builder needs to read a fault log. The supervisor opens ticket 4471 for 14:00–14:45. Tomás enables the vendor's gateway account, watches the screen share, sees the engineer only open the fault viewer, and disables the account at 14:38.
Synthetic case — HPFL. The ticket, vendor and times are invented.
Errors and limits
Some machines arrive with built-in cellular modems for vendor support; they bypass the gateway entirely and must be found and controlled. Watching a session cannot catch everything; logging and review add a second check.
Exercises
- EX029 — Advisory recommendations. Name three recommendations from AA21-042A. Rubric: 3 = three of MFA, strong RDP passwords, close unused RDP ports, audit remote connections; 2 = two; 1 = one; 0 = none.
- EX030 — Always-on link. Explain why "the vendor link is always on so support is faster" is a risk. Rubric: 3 = permanent entry for stolen credentials, unattended use; 2 = vague risk; 1 = agree; 0 = none.
- EX031 — Session record. What should Tomás write in ticket 4471 after the session? Rubric: 3 = vendor name/account, start/end, what was done, account disabled, line normal; 2 = some; 1 = "done"; 0 = none.
- EX032 — The hidden modem. During a walk-down Tomás finds a cellular modem in the filler cabinet. Why is it important? Rubric: 3 = bypasses gateway/MFA/logging, unmanaged path; report to owner; 2 = one; 1 = remove it himself; 0 = none.
Synthesis
Vendor access is through one gateway, named and multi-factor, enabled only for watched, logged windows.
Continue studying — chapter 08 of 18
← Chapter 07 (draft) · Course chapter index · Chapter 09 (draft) →