Vendor Remote Access During Peak Beverage Production
A 24/7 beverage plant produces 18,000 units per day on seven PLC-controlled lines. A third-party integrator requests remote access to all seven PLCs to apply a firmware update. The plant has a flat OT network, a shared local-admin password on the HMI servers, and a VPN appliance that is past end-of-life. The integrator proposes installing remote-support software on an HMI and connecting from the vendor's office. The requested change window is four hours during peak production. Two of the PLCs interlock with a safety instrumented system. The plant has no OT logging, no MFA, and no tested rollback procedure. The engineering manager asks whether to approve the request as submitted.
1. Decide whether to grant the integrator's request as submitted. Justify your decision using the most important risk drivers.
Read the worked answer
Deny the request as submitted. The main drivers are not the firmware itself but the access path and change control. Direct remote-support software on an HMI, over a flat OT network, with shared local-admin credentials and an end-of-life VPN, creates a path from an external vendor environment into all seven lines. A single compromised vendor laptop could reach every PLC. The absence of MFA, session logging, and tested rollback means the plant could neither detect nor recover from an unauthorized or failed change.
The two safety-interlocked PLCs raise the consequence. A firmware change can alter scan behavior, communication timing, or safety-related logic; without a safety impact review, the plant cannot show that the interlock remains valid. Peak production also removes the recovery margin. The right decision is not a permanent refusal but a controlled alternative that isolates the vendor, limits privilege, and verifies safety before and after the change.
2. Design a controlled remote-access and change-execution plan that could allow the update within a four-hour window.
Read the worked answer
Use a zone-and-conduit design. Put a jump host in an OT DMZ, require MFA, and give the integrator a time-bound account with least privilege. The vendor connects only to the jump host, not to HMIs or PLCs directly. Record the session, scan the vendor endpoint, and prohibit split tunneling. Permit access only to the specific PLC being updated, one at a time.
Before the window, export configurations, verify backups, and obtain a written rollback procedure. Review the firmware release against the PLC model and safety impact. For the two interlocked PLCs, either exclude them from this window or perform a documented safety verification with operations and safety engineering.
During the window, update a non-safety line first, then verify I/O, scan time, alarms, and communication. Keep the line in a known safe state and have operations confirm readiness. After each change, test the affected interlocks and record results. Stop and roll back if any line fails verification. Four hours is feasible only for a staged subset, not all seven PLCs.