Secure Remote Access
Secure remote access is the set of controls that allow suppliers, maintainers and operators to reach OT systems from outside the operational network without exposing those systems to attack. It covers how connections are authenticated, brokered, restricted in scope and time, recorded and monitored.
How it works
Instead of direct connections into the OT network, remote users connect to a hardened intermediary, often called a jump host or remote access gateway, located in a demilitarised zone between IT and OT. Access requires multi-factor authentication and is granted per user, per target system and, ideally, per approved maintenance window. Sessions are recorded, and the gateway allows only the specific protocols needed for the task.
Mature implementations add an approval workflow, so a supplier's engineer cannot connect until an operator authorises the session, and integrate with network monitoring so that any activity on the OT side that goes beyond the approved scope is detected. IEC 62443 addresses these requirements through its zone and conduit model and access-control requirements, and the TSA directives specifically call for controlling and monitoring remote access to OT.
Why it matters for security
Remote maintenance connections are the most common path by which attackers reach OT systems in real incidents, including those affecting rail. Suppliers often need access to interlockings, onboard systems and SCADA for diagnostics and updates, and historically that access was granted through modems, permanent VPN tunnels or shared accounts that nobody tracked.
Every such connection is also a conduit in the security model, and an unfulfilled SecRAC if it is not controlled as the supplier assumed. Knowing which remote sessions exist, what they touched and whether they stayed within their approved scope is a core piece of evidence in any rail OT security program.
Related solution
Building a rail security operations center
Detecting remote sessions that reach systems or issue commands outside their approved scope.
See the solution →
