Acquire management over OT distant entry with session monitoring, recording, and termination

Zero Belief Community Entry (ZTNA) is a safe distant entry service. It verifies distant customers and grants them entry to the suitable sources on the proper instances primarily based on id and context insurance policies. That is half 3 in our weblog collection about ZTNA for operational know-how (OT). Take a look at Half 1 for why ZTNA beats out always-on VPNs for OT distant entry and Half 2 for the way ZTNA reduces the assault floor by proscribing entry strategies and verifying distant customers’ safety posture.

Video cameras are in all places, together with in services with the strictest bodily entry controls. Even in case you belief a person to enter a delicate space, you continue to want to watch their actions as soon as they’re within the door. Seeing a suspicious exercise, you possibly can step in to cease it. And if issues crop up after the go to, reviewing a recording may also help pinpoint what went incorrect.

Monitoring and recording actions are equally vital on the subject of distant customers accessing your OT networks. It’s not sufficient to confirm the id of distant workers, distributors, and contractors. Neither is it sufficient to know who’s linked to what OT/ICS property. You additionally have to know what customers are doing throughout distant entry classes. Most organizations lack that visibility at the moment, a shortcoming for cybersecurity compliance, governance, the power to cease and get better from breaches, and incident investigation.

Conveniently, Cisco Safe Tools Entry (SEA) offers you an all-in-one answer to grant distant entry, implement entry controls, and monitor and file distant session exercise. Listed here are 3 ways you possibly can make the most of Cisco SEA to actively management OT distant entry.

1 – Monitor, be a part of, and terminate lively classes

See an inventory of all lively classes on the Cisco SEA console. By clicking on the session between ‘Consumer A’ and ‘Asset B’ you possibly can watch session actions as they occur, together with instructions despatched to the asset. Watching a vendor configure an OT/ICS asset may be useful for coaching, for instance. And in case you see one thing suspicious, like an try to vary the code or a variable in a programmable logic controller (PLC), you possibly can terminate the session with a click on and disconnect the distant person. Distant session termination is required by ISA/IEC62443-3-3 FR2.

2 – Preserve an entire log of previous classes

Cybersecurity greatest practices require sustaining an in depth historical past of all previous classes, helpful for safety audits, forensic investigations, and regulatory compliance. The EU’s NIS2 Directive, for instance, requires a full audit path for each occasion that impacts vital infrastructure and OT safety requirements similar to ISA/IEC62443-3-3 require information of all login makes an attempt. Cisco SEA logs each system-generated and user-generated occasions. For instance, assessment how distant customers authenticate, together with usernames, time, system posture, and session actions. Or see who added new customers or new property to the system.

3 – Report classes to see what occurred

Optionally file classes for chosen property, just by choosing the asset on the console and checking a field. Recordings enrich your audit path and may be significantly useful for troubleshooting. If an asset like a robotic arm, wind turbine, or freeway signal stops working, for instance, you would possibly uncover {that a} vendor not too long ago upgraded the software program or made a typo in a brand new configuration. Sooner troubleshooting helps you place the asset again into manufacturing sooner.

Maintain it easy, with an all-in-one answer for safe gear entry

Summing up, Cisco SEA offers you a single interface to guard your ICS and OT property with ZTNA. Require all distant customers to authenticate by a single level. Management which property they’ll entry and at what instances. And do what a video digital camera does by monitoring all distant session actions and recording knowledge for safety audits.