How to Secure Remote Access to Company Resources

𝗪𝗲 𝘂𝘀𝗲 𝗮 𝗩𝗣𝗡. That's a good start—but it's not an OT remote access strategy. VPN, Jump Host and PAM are not competing technologies. They solve different problems, and the strongest OT architectures use them together. 🔹 𝗩𝗣𝗡 • Encrypts the communication path to the OT network. • Authenticates remote users. • Does not control privileged activities after the connection is established. 🔹 𝗝𝘂𝗺𝗽 𝗛𝗼𝘀𝘁 • Provides a single hardened entry point into the OT environment. • Centralizes remote access and improves session visibility. • Helps reduce opportunities for lateral movement. 🔹 𝗣𝗔𝗠 (𝗣𝗿𝗶𝘃𝗶𝗹𝗲𝗴𝗲𝗱 𝗔𝗰𝗰𝗲𝘀𝘀 𝗠𝗮𝗻𝗮𝗴𝗲𝗺𝗲𝗻𝘁) • Protects privileged credentials through credential vaulting. • Enables just-in-time and time-bound privileged access. • Provides session recording, auditing and accountability. 💡 𝗔 𝘀𝗶𝗺𝗽𝗹𝗲 𝘄𝗮𝘆 𝘁𝗼 𝗿𝗲𝗺𝗲𝗺𝗯𝗲𝗿: 🚪 VPN → Gets you to the door. 🏢 Jump Host → Controls which room you can enter. 📝 PAM → Records what you did and ensures you only had the right privileges for the right time. 𝗥𝗲𝗰𝗼𝗺𝗺𝗲𝗻𝗱𝗲𝗱 𝗢𝗧 𝗿𝗲𝗺𝗼𝘁𝗲 𝗮𝗰𝗰𝗲𝘀𝘀 𝗮𝗿𝗰𝗵𝗶𝘁𝗲𝗰𝘁𝘂𝗿𝗲: Vendor / Engineer ⬇ VPN ⬇ Jump Host ⬇ PAM ⬇ OT Assets (PLC • HMI • Historian • Engineering Workstation) 𝗞𝗲𝘆 𝘁𝗮𝗸𝗲𝗮𝘄𝗮𝘆: A VPN secures the connection. A Jump Host secures the entry point. A PAM solution secures privileged access. Together, they provide a far more resilient remote access architecture for OT than any one technology alone. #OTSecurity #ICSSecurity #IndustrialCybersecurity #RemoteAccess #PAM #JumpHost #ZeroTrust #VendorAccess #IEC62443 #CriticalInfrastructure

MFA is critical — but MFA alone is not a cybersecurity strategy. Many organizations have made great progress by requiring multi-factor authentication for remote access. That is a major step forward. But from a CISO perspective, we have to be honest: attackers have evolved. Today’s threats include stolen session tokens, MFA fatigue attacks, compromised vendor accounts, unmanaged devices, exposed remote access tools, weak conditional access policies, and credentials purchased from the dark web. If remote access is protected only by MFA, but the environment behind it is flat, over-permissioned, poorly monitored, or accessible from unmanaged endpoints, the organization still has significant risk. MFA should be one layer in a broader access control strategy — not the finish line. Strong remote access security should include: - Device posture checks before access is granted. - Conditional access based on user risk, location, and behavior. - Least privilege access so users and vendors only reach what they need. - Privileged access controls for administrative accounts. - Session monitoring and logging. - Network segmentation to limit lateral movement. - Strong vendor access governance. - Rapid disablement of accounts when risk is detected. Cybersecurity leadership requires us to move beyond checking the box. The real question is not, “Do we have MFA?” The better question is, “If an attacker gets past MFA, how far can they go, how quickly can we detect it, and how fast can we contain it?” That is where security maturity really begins.

Day 10 – Remote Access in OT: Necessary, But High Risk Remote access is one of the most important — and most dangerous — capabilities in OT security. Manufacturing plants depend on it. Vendors need it to troubleshoot equipment. Engineers need it to support production. Operations teams need it to reduce downtime. But if remote access is poorly designed, it can become a direct path into the plant floor. OT remote access is risky because many environments were originally designed for local, physical access — not persistent external connectivity. Common weaknesses include: • Direct VPN access into OT networks • Shared vendor credentials • No MFA at the OT boundary • Unrecorded remote sessions • Persistent access after support work ends • Direct RDP, VNC, or SSH to HMIs and engineering workstations • Vendor tools installed without monitoring • No clear owner for third-party access In a manufacturing environment, this can become a serious issue. Example: A packaging equipment vendor connects remotely to troubleshoot a drive issue. Without proper controls, that vendor session may have broad network access, shared credentials, no session recording, and no automatic expiration. If the vendor account is compromised, the attacker may not need malware or a zero-day. They already have a trusted path into the environment. A secure OT remote access model should include: • Industrial DMZ jump server as the mandatory access point • PAM-brokered sessions • MFA before entering the DMZ • Just-in-time access tied to a work order • Named individual vendor accounts • Session recording and monitoring • Time-limited connections with automatic termination • No split tunneling • No direct RDP or SSH from IT into OT • Access scoped to specific assets, protocols, and time windows • Regular vendor access reviews ZTNA is also becoming important in OT, but it must be implemented carefully. Traditional VPN grants network-level access. ZTNA should broker access to specific OT assets through identity-aware, policy-controlled connections. But in OT, Zero Trust is not just a product. It is an operating model: • Verify identity. • Validate device posture. • Scope access. • Limit duration. • Record the session. • Monitor behavior. • Revoke immediately when the work is complete. AI SOC can also strengthen remote access monitoring by correlating PAM logs, VPN events, firewall traffic, OT NDR alerts, asset inventory, and change records. For example, if a vendor session occurs outside an approved window and is followed by unexpected PLC communication, that should become a high-priority alert. The key principle: Remote access should never mean open access. In OT, every remote connection must be owned, approved, scoped, monitored, recorded, and revocable. Because in manufacturing, remote access is not just an IT convenience. It is a production, safety, and business continuity risk. #SCADA #RemoteAccess #PAM #ZTNA #ManufacturingSecurity #CyberSecurity

One forgotten admin account can quietly become your company’s biggest security risk. Most breaches do not start with advanced hacking. They start with access nobody reviewed. ↳ An old vendor account ↳ A former employee with active permissions ↳ A shared admin password used for years The dangerous part? Everything looks normal until damage is already done. That is why strong PAM practices matter. Not as a compliance checkbox. As operational discipline around your company’s master keys. Here’s the simplest way to think about it: 1- Discover every privileged account You cannot protect accounts you do not know exist. Most companies find far more admin accounts than expected once they audit cloud systems, databases, SaaS tools, and internal platforms. 2- Limit access aggressively Not everyone needs permanent admin rights. ↳ Role-based access ↳ Time-limited permissions ↳ Department separation Small access decisions prevent massive exposure later. 3- Replace permanent admin access with JIT access Think visitor pass instead of permanent master key. Temporary access reduces the value of stolen credentials dramatically. 4- Record every privileged session When incidents happen, logs answer everything. ↳ Who accessed what ↳ What changed ↳ When it happened That visibility cuts investigation time fast. 5- Rotate credentials automatically Static passwords create silent risk. If shared admin credentials have not changed in years, attackers are hoping they stay that way. 6- Enforce MFA everywhere VPNs, cloud consoles, admin dashboards, production systems. Privileged access should never rely on passwords alone. 7- Review and certify access quarterly Projects end. Teams change. Permissions should not stay forever by default. Simple rule: No review = no continued access. PAM is not just a security tool. It is the process that protects the systems running your business. And the cost of ignoring it is always higher after a breach. ♻️ Repost if your company still has unchecked admin access risks 🔔 Follow Jegan for practical cybersecurity and identity security insights

Internet traffic from remote devices is one of the most underestimated blind spots in enterprise security. Remote work is now a permanent reality. Employees connect from home networks, coffee shops, hotels, and public Wi-Fi. While secure tunnels like DirectAccess allow access to corporate resources, Internet traffic may still bypass the company network if it is not properly controlled. When this happens, security teams lose visibility. Corporate filtering, inspection, and monitoring policies may no longer apply to remote devices. The good news? Microsoft Intune can help mitigate this risk. By enforcing the right policy through the Intune Settings Catalog, organizations can control how Internet traffic is routed when remote clients connect to the corporate network. Instead of relying on network location or user behavior, traffic control becomes enforced by policy. This ensures that security controls remain active even when users work outside the office. Why This Matters Without proper traffic routing controls, remote access may allow: • Internet traffic to bypass corporate security inspection • Reduced monitoring of remote user activity • Increased exposure when connecting from public networks With Microsoft Intune, organizations can: ✅ Route remote Internet traffic through the corporate network ✅ Maintain visibility and monitoring outside the office ✅ Enforce corporate security filtering policies ✅ Strengthen endpoint and remote access security ✅ Support Zero Trust security principles In this article, I show how to configure this policy using Microsoft Intune, assign it to device groups, monitor deployment status, and validate enforcement directly on the endpoint. Because in modern endpoint security, remote traffic should never become a blind spot. How is your organization controlling Internet traffic for remote devices today? Full tunnel? Split tunnel? Secure proxy? Or Intune-managed policies? #MicrosoftIntune #EndpointSecurity #WindowsSecurity #ZeroTrust #CyberSecurity

Here's something building owners and facilities directors need to understand about how cyber attacks on buildings actually happen. It's usually not a sophisticated hacker exploiting some technical flaw. More often, someone just uses a stolen username and password to walk straight in through the front door. The systems that control your building — heating, cooling, access control, lighting — are increasingly managed through web-based portals. Tridium Niagara, Johnson Controls Metasys, Honeywell. Your engineers log into these systems remotely, often saving their passwords in a browser for convenience. There's a category of malware called infostealers. Their entire job is to find and steal those saved passwords. Cheap to deploy. Hard to detect. Increasingly common. Once an attacker has those credentials, they don't need to break anything. They log in with legitimate details and your own system thinks it's your engineer. New intelligence from H2 2025 confirms this is accelerating. At Kelso Building Services, we built our secure remote access program specifically around this threat. Every remote session into a customer's BAS environment runs through an isolated, monitored access layer — no saved credentials, no direct exposure, full audit trail. MFA required. Every time. If you manage a building and you don't know whether your controls contractor accesses your systems this way, that's the question to ask this week. Not next quarter. This week. #OTSecurity #BuildingAutomation #FacilitiesManagement #CyberSecurity

Remote work has become increasingly popular over the past few years, and the COVID-19 pandemic only accelerated this trend. While remote work offers many benefits, it also comes with its own set of security challenges. To keep your team and your company safe, it's important to follow these remote worker best practices: ✅Use strong and unique passwords: Encourage remote workers to use complex passwords that are difficult to guess. It's also important to use different passwords for different accounts to minimize the impact of a potential breach. ✅Enable multi-factor authentication (MFA): This can help prevent unauthorized access to accounts. ✅Be cautious of phishing emails: Phishing emails are a common method used by cybercriminals to trick users into revealing sensitive information. Teach remote workers how to identify suspicious emails and avoid clicking on suspicious links or downloading attachments from unknown sources. ✅Keep software and devices up to date: Regularly updating software and devices is crucial for maintaining security. Updates often include important security patches that address vulnerabilities and protect against potential threats. ✅Use a virtual private network (VPN): A VPN creates a secure connection between a remote worker's device and the company's network. This helps protect sensitive data by encrypting the connection and making it more difficult for hackers to intercept. ✅Secure home Wi-Fi networks: Remind remote workers to secure their home Wi-Fi networks with strong passwords and encryption. This helps prevent unauthorized access to their network and protects sensitive data. ✅Educate employees on cybersecurity best practices: This can include topics like identifying social engineering tactics, avoiding public Wi-Fi networks, and safely handling sensitive information. By following these best practices, remote workers can help keep themselves and their companies safe from cyber threats. Stay safe 🔒

As founder of a remote data company, I’m increasingly aware of the impact that remote working poses to data privacy. While the flexibility of remote work has been a welcome change for many, it also raises important questions about data security and privacy. Despite not having a centralised office, at Onyx Data we take a number of steps to ensure our clients' data is all handled securely. Here are some key points to consider:   Secure Access - It's essential to ensure that employees can access company resources securely from any location. Implementing strong VPNs and multi-factor authentication is a must.   Data Encryption - With sensitive information frequently shared across networks, we use end-to-end encryption for all data, both in transit and at rest.   Employee Training - Regular training on cybersecurity best practices can significantly reduce the risk of data breaches caused by human error.   Device Management - Utilising Mobile Device Management (MDM) solutions helps secure company data on personal devices used for work purposes. Remote work doesn’t have to come at the expense of protected data. It is possible to have both - successfully. I’d love to hear your thoughts in the comments below on on how we can better balance remote work and data privacy - what would you add to the list? #RemoteWork #DataPrivacy #Cybersecurity