Vendor remote access without opening your cell network

The request always comes with a deadline. The machine builder needs to look at the PLC to diagnose a fault, and production is waiting. What usually follows is either a “temporary” tunnel that is still there two years later, or a refusal that costs a day of output and a difficult phone call with the plant manager.

The pattern that works

End the external session in the DMZ, on a jump host that records it, and open exactly one conduit into the cell zone for the length of the intervention. Not a route to the whole cell network. A single conduit, with a firewall rule that has a start time and an end time.

In practice that means four things. Multi-factor authentication happens on the jump host, because the PLC cannot do it. The session is recorded, so the intervention can be replayed and reviewed afterwards, which also settles most arguments about who changed what. The conduit carries one direction and one protocol, to the one machine concerned. And the supplier’s account is disabled by the calendar, not by someone remembering to do it on Friday evening.

That last point matters more than it looks. An access that only expires when a person remembers to close it is a habit, and habits slip the first week someone is on holiday.

The organisational half

The technical part takes about a week to build. Agreeing the rest takes longer: who authorises an intervention, who watches it while it runs, what the supplier signs before the first session, and how a change made remotely enters change control like any other. Write that down once, and the next twenty interventions are a form to fill in rather than a debate.

Germany’s Federal Office for Information Security sets out the same principles, in more detail, in its three-page recommendation on remote maintenance; we went through it in BSI-CS 108, line by line.