Vendor Remote Access Into a Flat OT Network
A mid-size food and beverage manufacturer runs three filling lines controlled by Siemens S7 PLCs and WinCC HMIs. The OT network shares a flat /16 with corporate IT; there is no inventory of OT assets, no monitoring on the OT side, and two HMIs still run Windows 7 because the line vendor has not certified anything newer. Downtime is costed at $40,000 per hour. The packaging-equipment vendor that supports the case packer on line 2 has requested a persistent site-to-site VPN into the plant with a single static credential shared by its support desk, so it can 'proactively monitor' the equipment. Today its technicians use a line-side laptop with TeamViewer and internet access. The support contract renews in two weeks and the vendor's security annex currently says only that it will 'maintain industry-standard security'. The plant manager supports the request because last quarter's unplanned stoppage took nine hours to resolve with the vendor on the phone.
1. Respond to the vendor's request. State what you would approve, what you would refuse, and what compensating controls make the approved portion acceptable within the two-week deadline.
Read the worked answer
Refuse: a persistent, always-on VPN terminating inside a flat /16 with one shared static credential. That is a standing door that reaches corporate systems and two unsupported HMIs, and a shared credential means no attribution and no revocation without breaking the vendor's whole support desk.
Approve in principle: vendor remote support. The business need is real - nine hours of downtime at $40,000 per hour is a strong argument, and refusing outright just pushes staff back to the existing TeamViewer laptop, which is arguably worse because it is unmanaged and internet-exposed.
What to approve within two weeks:
- On-demand, brokered access: vendor raises a ticket, a plant engineer approves and starts the session, it is time-boxed (e.g. four hours), recorded, and auto-terminates.
- Named vendor individuals with MFA - no shared account.
- Source restricted to the vendor's published egress IPs.
- Termination at a jump host in a DMZ that is the only thing able to reach line 2; no route to corporate.
- Firewall rule limited to the line 2 subnet and the specific industrial ports required, not 'any to any'.
If brokering tooling cannot be deployed in two weeks, keep the line-side host as the session endpoint, harden it, and have the plant engineer start and stop each session with logging. If the vendor will not accept named accounts and MFA, escalate to procurement - a shared credential is not an acceptable control for remote access into production.
2. You cannot stop production for a segmentation project. How do you sequence improving the OT/IT boundary, and what do you do first?
Read the worked answer
Sequence by blast-radius reduction per unit of production risk - reversible changes first.
- Passive asset discovery. You cannot segment what you cannot see. Mirror a span port on the OT switch; do not actively scan PLCs, which can crash legacy controllers. Produce the inventory first.
- Remove direct internet egress from OT. This is fast, reversible and high value. The exception is the line-side support laptop, which moves to its own VLAN with the remote-support path explicitly defined.
- Install a firewall between corporate and OT and run it in log-only mode, then enforce default-deny with a documented allow-list of industrial flows. Observe before blocking - an undocumented flow you cut stops a line.
- Zone and conduit design (IEC 62443 style): each line in its own zone with its HMIs; engineering workstations in a separate zone reached only via jump host; DMZ for vendor access. This can be done one line per maintenance window.
- Compensate for the Windows 7 HMIs now: host firewall, blocked USB, application allowlisting, no browsing or email on those hosts. Replacement follows the vendor's certification timeline.
- Passive OT monitoring fed from span ports, plus an agreed patch and maintenance window plan with production.
The first three steps touch no controller, need no downtime, and together remove the most likely path from corporate IT (and the internet) into the process.
3. How do you frame the risk to the plant manager and negotiate the contract renewal?
Read the worked answer
Frame it in the plant manager's terms, not as compliance. The comparison is $40,000 per hour of stoppage against a multi-day shutdown if a compromised vendor credential crosses from corporate into OT - plus quality and food-safety consequences if a line is manipulated. Also be honest that the risk already exists: today's TeamViewer laptop is an internet-exposed path into a flat OT network. The vendor's request does not create a new risk class; it formalises and widens one. The choice is managed versus unmanaged risk, not risk versus no risk - which usually moves a plant manager more than a control framework does.
Negotiate concrete annex terms: named accounts with MFA, session logging available on request, notification of vendor-side incidents within 24 hours, right to audit or accept a SOC 2 report, subcontractor flow-down, indemnity for incidents caused by vendor access, and a defined incident/response SLA.
Keep the last point central. The nine-hour outage was plausibly a support-responsiveness problem, not a remote-access problem. A two-hour response SLA may deliver more value to the plant than a persistent VPN ever would - and it is cheap for the vendor to concede. Use the renewal as leverage: security terms as a condition of renewal, not something to negotiate afterwards. If the vendor refuses basic terms, record the decision in the risk register with the business owner's acceptance.