Vendor Remote Access with a Legacy DCS and No PAM Appliance
A chemical plant operates six control systems, including a DCS that the vendor supports remotely. The current process uses a shared VPN account named vendor1 with full network access, no MFA, and session logging disabled. Vendor engineers connect from home, often on personal laptops. Last month, one vendor laptop was infected with malware; logs showed it had reached an engineering workstation, though no outage occurred. The plant wants to keep 24/7 vendor support but reduce risk. Constraints: the legacy DCS cannot support MFA or endpoint agents; there is no budget for a new privileged access management appliance; one jump server is available; the plant has an existing SIEM and firewall that can enforce ACLs. The vendor contract requires response within four hours and allows remote access only during approved sessions.
1. Design a remote-access workflow using the available jump server, VPN, firewall, and SIEM. What controls are mandatory before a vendor engineer reaches the DCS?
Read the worked answer
Mandatory controls before DCS access: unique per-engineer VPN accounts with MFA; VPN access restricted to the jump server only; jump-server session approval tied to a ticket and time window; firewall ACLs from the jump server to only the specific DCS assets needed; session recording and command logging; SIEM alerting on logins, file transfers, and denied traffic. The vendor engineer never connects directly to the DCS. The shared vendor1 account is disabled. The jump server is hardened, patched, and has no internet access. The vendor uses its own laptop only to reach the VPN; if personal devices are allowed, use a VPN posture check or provide a managed virtual desktop. Document the workflow in the contract and require vendor acknowledgment.
2. The vendor says its DCS cannot support MFA. How do you satisfy the intent of MFA without modifying the DCS?
Read the worked answer
Because the DCS cannot do MFA, put MFA at the VPN and again at the jump server, and require a second approval from the plant operator or shift supervisor to open the session. Use one-time credentials or certificate-based VPN accounts. This satisfies the intent: something you know plus something you have before any DCS access. Do not rely on a shared password. If the DCS has local accounts, rotate them after each session or use a password vault with check-in/check-out. Record the compensating control in the risk register and test it before the next vendor session.
3. What would you log and monitor to detect misuse, and what residual risk remains?
Read the worked answer
Log VPN authentication, MFA results, jump-server session start/stop, commands, file-transfer attempts, firewall denies, and DCS login events. Alert on out-of-window access, multiple failed MFA attempts, new source countries, clipboard or file transfer, and access to unexpected PLCs. Residual risk includes vendor endpoint malware, session-recording gaps, insider misuse, and DCS local-account sharing. Mitigate with contract clauses, endpoint attestation where possible, least-privilege ACLs, and periodic review. Accept residual risk with a review date and evidence that the controls were tested.