Describe the access task
NIST defines remote access in terms of communication through an external network. For a project, we propose describing the intended task: viewing SCADA, collecting records or performing authorized maintenance. Each task may require different permissions. In a rural example, monitoring a reservoir through a dashboard and changing a remote station's program are different activities that should appear separately in the scope and approval process.
Organize identities and destinations
We recommend avoiding shared accounts and recording who approves and closes each access. Based on a technical assessment, the design can include an intermediate maintenance point, defined destinations and authentication suited to the equipment. CISA provides guidance on risks and management of remote access software. The tunnel does not remove the need to protect connected devices and review permissions when staff or suppliers change.
Test routine use and interruption
Before handover, we recommend testing the connection from the actual working environment without exposing configurations or credentials in the user procedure. Verify authorized routes, session records and access termination. If the link fails during a task, the team needs to know the communication and continuity procedure. The plan should also assign responsibility for updates, account expiry and monitoring the equipment that establishes the connection.
What to assess for your project
- Describe tasks and approved destinations.
- Identify users and approval owners.
- Test connection, interruption and closure.
- Define maintenance and permission reviews.
COM3
How COM3 can help
COM3 can help assess existing connectivity, design VPN networks and implement remote access for supervision and maintenance within the approved scope. Work can include connections between sites, tests and documentation of allowed destinations, together with operations and the responsible security team, so the deployed connection follows the agreed access workflow.
Topics in this article
Further reading and references
Technical sources consulted for the fundamentals of this content. Project recommendations are an editorial synthesis by COM3.