VPNs Pose Significant Risk to OT Networks, Advocate for VPN-less Solutions
Traditional VPNs are a major security vulnerability for Operational Technology (OT) networks, granting overly broad access that traditional IT security models fail to address, according to a new analysis.
Operational technology (OT) environments, designed for isolation, are increasingly exposed due to IT/OT convergence, driven by demands for efficiency, analytics, and remote maintenance. This convergence has made industrial control systems (ICS), SCADA servers, and PLCs accessible across networks. However, the reliance on third-party remote access, essential for tasks like OEM servicing, system integration, and remote troubleshooting, has become a primary entry point for attackers. Numerous industrial intrusions have exploited leaked VPN credentials, exposed remote desktop services, and vendor connections, with compromised sessions in OT environments posing risks not just to data but to production, environmental safety, and human lives.
Securing OT environments requires a different approach than traditional IT security. In OT, availability and safety are paramount, outweighing confidentiality. Industrial assets often operate on long lifecycles with outdated operating systems, making them fragile and difficult to patch. While segmentation frameworks like the Purdue model aim to structure plants into secure zones, the critical security control becomes managing precisely who can access what, using which protocols, and for how long. This makes the design of remote access pathways a more defining security decision than any perimeter appliance.
Traditional VPNs, designed for IT, fall short in OT settings because they grant network-level access rather than task-specific permissions. Once a VPN tunnel is established, a remote device gains a routable path into the entire zone it connects to. This is often exacerbated by shared vendor accounts, standing VPN tunnels that remain active 24/7, lack of session recording, and the potential for an unmanaged contractor laptop to bridge the internet directly to the plant floor. Furthermore, VPN appliances themselves are internet-exposed and are frequent targets for attackers scanning for vulnerabilities, undermining the very segmentation principles they are meant to support.
Jump servers offer a partial solution by softening the blast radius but introduce their own complexities, including additional credentials to manage, more systems to patch, and still lacking per-asset authorization. The article highlights that a VPN grants a standing, network-level path into the plant, whereas a more secure VPN-less solution would expose only a single, approved asset for a limited, defined window.
VPN-less remote access solutions utilize a broker architecture to replace standing VPN tunnels. Lightweight connectors within each OT zone establish outbound TLS connections to an access gateway. Remote users or vendors connect to this gateway via a browser, eliminating the need for inbound firewall rules or exposed ports. Crucially, no routable network path is ever established between the remote device and the industrial asset. Sessions are protocol-isolated, meaning only screen output and keystrokes are transmitted, not raw network packets.
These VPN-less systems enforce identity-based, per-asset authorization. A vendor might be approved for access to a single PLC or engineering workstation for a specific, limited time window, adhering to just-in-time policies rather than standing entitlements. Credential management is also enhanced, with OT account passwords stored securely in a vault and injected into sessions by the broker. This means third parties authenticate themselves with MFA but never directly handle or see the asset's credentials.
Every session initiated through a broker is monitored live, can be recorded end-to-end, and can be terminated with a single click. This approach embodies zero trust principles applied to industrial connectivity: never trust a network location; always verify an identity for a specific asset, every time. Solutions like BeyondTrust Privileged Remote Access (PRA) are already being deployed in industrial environments to replace insecure standing VPN tunnels with controlled, brokered connections.
The lifecycle of a controlled OT session involves multiple security layers: access is requested for a specific asset, not a network; identity is verified with MFA; an asset owner approves a bounded access window; the broker establishes the session, injecting vaulted credentials; operations teams monitor and record all activities; and upon expiration of the window, access is automatically revoked.