PROTECT YOUR SITES AND INDUSTRIAL CONTROL SYSTEMS (ICS).

Full-scale Secure Access for Operational Technology (OT) 

Manage on and off-site secure IoT access to any ICS/OT target at scale in industrial automation and manufacturing businesses.

Get the OT White PaperDownload the OT Buyer's Guide

Beyond Secure Remote Access (SRA), VPNs and Firewalls 

PrivX OT Edition is a full-blown secure access management solution integrated with IT/OT systems and providing access to both modern and legacy OT targets in hybrid environments. Unlike many traditional Secure Remote Access tools, it manages the entire OT industrial remote access lifecycle in a holistic manner.
 
The solution supports  granular, least privilege and just enough access (JEA) models not available in VPNs/Firewalls that grant too broad access to industrial ICS targets. The solution grants Zero Trust access just-in-time (JIT)  -  without the risk of shared or leave-behind credentials.

Learn how to choose the best secure remote access (SRA) solution to protect your enterprise OT

Download the OT Buyer's Guide

Maintain and troubleshoot remotely

Leverage workflow approvals, granular privilege restrictions and audit trails for all remote sessions. Troubleshoot problems without a team on-site, reduce downtime and the risk of lost production time. Allow always-verified access to production data for predictive maintenance.

Optimize OT products & processes

 Allow your engineers and product experts all arurnd the world to analyze process and product data remotely to make recommendations on improvements. All this without the fear of compromising the data, risk of ungoverned remote IoT access or unverified identities.

Use IT/OT data for real-time decisions 

Combine financial and real-time production data when estimating the cost/benefit impact of adjustments to process parameters or critical machinery settings at the operational level.  Grant verified, role-restricted secure access just-in-time (JIT) in just minutes.

OT ICS access security for Industrie 4.0 

System up time is critical in IIoT/OT environments. This requires constant monitoring and management of the devices and systems within them.

With IT/OT convergence, site engineers, administrators, maintenance personnel, remote operators and consultants access industrial OT targets remotely, including:

  • Industrial control systems (ICS)
  • Supervisory control and data acquisition (SCADA)
  • Programmable logic controllers (PLC)
  • Discrete process control systems (DPC)
  • the human-machine interface (HMI) remote terminal units (RTU)

Access to these  resources must be governed, identified, authorized, approved, compliant, audited and monitored in a secured and restricted manner.

PrivX_OT_Edition_Architecture

PrivX OT Edition aligns industries in operational technology with the Zero Trust cybersecurity framework that advocates the principle of ‘Never trust, always verify’, providing  just-in-time access for every connection for operational and cost efficient access management.

Learn more about the unique PrivX Technologies behind the solution.

PrivX Technologies

zero trust access WITH no leave behind credentials

Secure access to your production sites

Checklist

Approve, restrict, authorize

  • workflows for managing roles, approving sessions and segregation of access to targets and sites
  • on-site and off-site secure access for 3rd parties, remote operators and maintenance engineers  
  • least privilege and just enough access (JEA) for each task
  • Just-in-Time Zero Trust access without credentials left behind for misuse
Number-one

Centralized control

  • synchronize identities from multiple directories, including  Active Directory (AD) Lightweight Directory Access Protocol (LDAP), and OpenID and map them automatically to the right roles.
  • Manage all accessible targets  from a single pane of glass.
  • multi-factor authentication (MFA), role-based access control (RBAC), audit trails and session recording.
Secure-file-transfer

Access IT/OT targets as one

  • support for IT protocols like SSH, RPD, HTTPS and VNC for access
  • remote access using any TCP/IP protocol prevalent in OT by granting access on a network level
  • support for protocols or targets using OT proprietary technology 
Cloud

Easy to use and secure

  • Enhance productivity through a single-sign-on (SSO) and HTML5 ‘thin-client’ user interface
  • Fast-to-deploy OT solution that offers consistent UX for internal and external workforce alike
  • No software agents on the client or the server, no complex configurations
  • Internet Content Adaptation Protocol (ICAP) for scanning data in transit before it is sent to the destination
compliant secure remote accesS

Comply with regulations 

Regulations

ISA/IEC 62443

ISA/IEC 62443 Industrial Automation and Control Systems Security series of cybersecurity standards is applicable to automation and control system applications. 

Regulations

ISO 27001

ISO 27001 is one of the most recognized industry standards. In particular annex A.9.1 of ISO 27001:2013 focused on the business requirements of access control. 

Regulations

NIS/NIS2.0

The European Network And Information Security Directive (NIS) is applicable to measures for the security of network and information systems across the Union. 

Regulations

NIST

National Institute of Standards and Technology  (NIST) has several recommendations for proper access control and governance, including NIST Special Publication 800-210 for General Access Control Guidance for Cloud Systems.

Customer cases and use cases

Secure role-based access for maintenance engineers

Premise: The customer is a leading manufacturing company operating in the field of industrial equipment. As a part of their services, the business offers remote maintenance of their operational technology (OT) devices.

The customer is using multiple connection protocols (including SSH, RDP, and VNC) that were previously managed via a combination of VPN- and firewall-based security controls.

Challenge: The prior security controls lacked granularity and functionality that the customer needs to be able to provide their services easily and securely.  For example, the customer could not verify that only personnel with the right roles could access only the right targets. The previous solution lacked transparency and proper auditing capabilities. There was a clear need for a lean and easy-to-use solution that would provide secure access between the cloud, customer facilities, and end-target devices.

Change: The access to OT target devices is now done via the PrivX OT Edition solution, which is utilized as a part of the customer’s own service business. Maintenance engineers have access to over 30k devices in various customer environments in a fast and secure way. They are granted just enough access (JEA) in a just-in-time (JIT) fashion.

The PrivX OT solution provides the customer with a centralized management system that ensures increased, layered security. The system also provides improved verification capabilities to identify and authenticate users, without the end-users seeing any of the vaulted secrets. Additionally, the customer can audit and monitor maintenance-related sessions through optional sessions recording.

Read more

Global IoT Device Provider Secures Maintenance Operations 

Premise: Headquartered in Europe, the customer is a manufacturer of home appliances with a turnover of +10 B€, +50K employees and +35 factories worldwide. The company’s brand portfolio includes more than 10 well-known appliance brands. 

The customer was looking for a secure access management solution that would radically reduce the risk of sharing a 'golden key' that grants access to all their IoT devices.

Challenge: The golden key was shared among all QA Engineers that connected to customer IoT devices to perform maintenance tasks. This was a serious security risk since often the identity of key users was unclear. The QA Admins were also constantly manually rotating and managing new golden keys.

IOT_OT_architecture

Solution: With PrivX Privileged Access Management solution, the customer was able to ensure that their Quality Assurance Engineers would be able to maintain IoT devices as easily as before but without actually handling, sharing, or seeing keys anymore.

Moreover, all sessions are identified and tracked, the QA Engineers are assigned the right role for the task at hand on login and the golden key is used through a vault. The key is safe from misuse, accidental misconfigurations or ending up in the hands of bad actors looking to steal intellectual property (IPR). Moreover, QA Admins no longer need to replace and rotate keys all the time.

Learn more in the full case study below.

IoT Customer Case

Secure OT access for 3rd  party engineers in power plant

Premise:A global energy company operating dozens of electricity plants. Each plant has critical equipment (OT devices) from 3rd party vendors with service contracts. Access to OT devices is realized through an application gateway. The company needed a secure remote access solution to allow 3rd party vendor technicians to perform scheduled and on-demand maintenance.

Challenges: 3rd parties had visibility into the whole OT environment. No visibility into the use os shared credentials.  Granting access took a long time and revoking access was cumbersome No session monitoring or audit trail.

PrivX OT Edition- Power plant-1

Change: Direct access to the application servers is restricted, and externals don't  handle shared credentials. No one ever sees any access secrets. User IDs are verified by multi-factor authentication (MFA) and are visible with access sessions. Effective workflows for access requests and approvals.  Time-boxed access for the OT target site; automatic revocation after the job is done.  Always up-to-date list of OT targets  based on user role (RBAC). Session recordings and auditing events for SIEM.

PrivX_OT_Marine_Vessel_V3

A Marine Vessel Operator Secures Remote Access and IoT Data Collection 

Premise: With the help of IoT sensors, on-board computing, satellite communication and cloud-based analytics, the customer aimed to enhance operational profitability.  However, connectivity from the public cloud environment to mission critical vessel systems came with risks.

Challenges: Limited transparency into the remote access without visibility into the sessions. The VPN connections to the ship networks were  always on. Indiscriminate access to all areas once logged in to VPN service. Untracked and unidentified connections to ship subsystems. Shared accounts and manually managed access credentials.

Change: Increased transparency and compliance via audit trail and session recording. Secrets secured and managed centrally for risk mitigation. Automated linking of roles to identities. Just-in-Time (JIT) access granting and revocation with least privileged for granular security. Scalable cloud deployment and increased level of automation for easy fleet expansion.

Industrial_automation

Secure OT remote access for 3rd party vendors in an industrial automation environment

Premise: The customer is a global manufacturing company operating in dozens of factory sites in multiple regions. There are production-critical automation equipment on each site that needs to be accessed by multiple 3rd party vendors and in-house personnel.

RDP, SSH, and VNC connections were managed via Citrix and (programmable logic controller) PLC access is administered on the VPN and network level. The company needed modern centralized solution for all access protocols as well as role-based approval process tool.

Challenges: The previous solution lacked transparency and a proper audit trail for sessions and tasks performed on the device. No visibility into the use of shared credentials. The VPN solution did not provide needed granularity to be secure.

Change: Access to OT targets inside the demilitarized (DMZ) network is now done via PrivX and its Extender component (reverse proxy) offering secure connections between sites. Internal and External users (such as on and offsite maintenance engineers) now have access to the required resources with just enough access (JEA) permissions needed to get the job done and based on their roles.

Access can be granted quickly for a predefined timeframe and in just-int-time (JIT) fashion. Available resources are listed in a single view which allows easy and more efficient way of work. User IDs are verified by multi-factor authentication (MFA) and are linked to individual, monitored sessions.

Access requests are handled via built-in workflow tools providing a proper approval process. Connections are authenticated with Ephemeral Certificates or vaulted secrets that are not visible for end user.

Why the Manufacturing Industry Should Get Serious About Zero Trust and Just-in-time Access

IT/OT convergence is shaking up the utility, transportation, energy and manufacturing industries. Learn why secure remote access is at the center of this transformation and how companies can protect their critical operations.

Read the blog

Zero trust remotE access for OT

White Paper: Secure Access Management for Operational Technology (OT) and Critical Infrastructure

Learn why OT and IIoT need to transcend VPNs, firewalls and various remote access tools to stay safe from threats and risks. Fill in the form to get your copy of this White Paper by SSH.COM.

Thanks for submitting the form.

Click to download the PDF

mockup_OT_whitepaper