secure remote access – Waterfall Security Solutions

Remoting Into Renewables – the latest guidelines for secure remote access applied to renewables generation

Andrew Ginter — Thu, 28 Aug 2025 12:03:00 +0000

OT Insights Center PowerRemoting Into Renewables – the latest guidelines for secure remote access applied to renewables generation

Remoting Into Renewables – the latest guidelines for secure remote access applied to renewables generation

Watch the webinar to learn how secure access can enhance both safety and performance in renewable energy operations.

As renewable energy continues to dominate new power generation projects across North America and the EU, organizations must find ways to support remote operations without compromising cybersecurity. Wind and solar sites, often remote and digitally connected, demand secure access solutions that meet both operational and regulatory needs.

This webinar explores how energy leaders are balancing efficiency with cyber resilience. We’ll cover the latest guidance from CISA, CCCS, and others, with a spotlight on hardware-enforced, unidirectional remote access, now widely recommended for high-consequence OT environments.

Whether you're planning a new facility or optimizing an existing one, you'll gain insights into:

The business impact of secure remote access

Safe, scalable deployment strategies

Aligning cybersecurity with operational goals

Real-world adoption: how renewables operators are deploying these technologies today.

About the Speakers

Andrew Ginter

Andrew Ginter is the most widely-read author in the industrial security space, with over 35,000 copies of his three books in print. He is a trusted advisor to the world's most secure industrial enterprises, and contributes regularly to industrial cybersecurity standards and guidance.

Lior Frenkel

With more than 20 years of hardware and software research and development experience, Mr. Frenkel leads Waterfall Security with extensive business and management expertise. As part of his thought leadership and contribution for the industry, Lior serves as member of management at Israeli High-Tech Association (HTA), of the Manufacturers’ Association of Israel and Chairman of the Cyber Forum of HTA.

3 OT Security Myths

May 10, 2026

Webinar: Everything You Know About OT Security Is Wrong

May 5, 2026

8 (and a Half) Questions for Your OT “Secure” Remote Access Vendors

April 1, 2026

Stay up to date

Subscribe to our blog and receive insights straight to your inbox

The post Remoting Into Renewables – the latest guidelines for secure remote access applied to renewables generation appeared first on Waterfall Security Solutions.

Rethinking Secure Remote Access for Industrial and OT Networks

Waterfall team — Wed, 06 Aug 2025 09:38:01 +0000

OT Insights CenterRethinking Secure Remote Access for Industrial and OT Networks

Rethinking Secure Remote Access for Industrial and OT Networks

Remote access is essential—but traditional solutions like VPNs and jump hosts are increasingly under fire from both attackers and regulators. With guidance from CISA and CCCS urging organizations to move beyond legacy remote access tools, the stakes for industrial and OT networks have never been higher.

This ebook demystifies secure remote access technologies, from classic firewalls and 2FA to hardware-enforced solutions and unidirectional gateways. Discover which approaches truly protect against today’s threat landscape—and which leave critical operations exposed.

Download the book now to:

Gain a deep understanding of modern and legacy remote access technologies – including VPNs, firewalls, 2FA, jump hosts, cloud systems, and hardware-enforced solutions.

Explore common attack scenarios and assess how different combinations of security technologies perform against actual threats

Learn which security measures are most effective for specific attack types, helping you make informed decisions about protecting remote access in your organization

About the author

Waterfall team

FAQs About Remote Access

What is Remote Access?

Secure Remote Access: Everything You Need to Know in 2025

Waterfall team — Mon, 16 Jun 2025 10:03:08 +0000

OT Insights CenterSecure Remote Access: Everything You Need to Know in 2025

Secure Remote Access: Everything You Need to Know in 2025

Securing remote access to operational technology (OT) networks requires specialized approaches that protect critical infrastructure while maintaining real-time performance. This guide covers the unique challenges, essential security layers, major risks, and key considerations for choosing OT remote access solutions that balance operational continuity with robust cybersecurity.

Waterfall team

June 16, 2025

What is Secure Remote Access and Why Does it Matter Today?

Secure remote access is the use of security technologies and policies that allow users to safely connect to corporate networks and data from remote locations. It relies on encryption, multi-factor authentication (MFA), VPNs, and Zero Trust Network Access (ZTNA) to prevent unauthorized access and protect sensitive information in hybrid work environments.

Secure remote access for OT (Operational Technology) networks represents one of the most critical cybersecurity challenges facing industrial organizations today. Unlike traditional IT environments, OT networks control physical processes in manufacturing plants, power grids, water treatment facilities, and other critical infrastructure. Secure remote access in these environments must balance operational continuity with stringent security requirements, ensuring that authorized personnel can monitor and maintain industrial systems without exposing them to cyber threats.

In OT environments, secure remote access solutions must address unique challenges that don’t exist in conventional IT networks. Industrial control systems often run legacy protocols and software that weren’t designed with modern security in mind. These systems require specialized secure remote access approaches that can protect SCADA systems, PLCs, and HMIs while maintaining the real-time performance requirements essential for safe operations. The stakes are particularly high because a security breach in OT networks can result in production shutdowns, safety incidents, or even physical damage to equipment and infrastructure.

The importance of secure remote access for OT networks has grown exponentially as industrial organizations embrace digital transformation and Industry 4.0 initiatives. Remote monitoring, predictive maintenance, and centralized operations management all depend on secure remote access capabilities. The COVID-19 pandemic further accelerated this need, forcing many industrial organizations to enable remote access for maintenance technicians, engineers, and operations personnel who previously worked exclusively on-site.

Modern secure remote access solutions for OT environments typically employ air-gapped architectures, dedicated secure gateways, and protocol-aware security controls. These systems create secure tunnels that allow authorized users to access OT networks without direct internet connectivity, often using jump servers or secure remote desktop solutions specifically designed for industrial environments. Advanced solutions incorporate OT-specific monitoring capabilities, protocol inspection, and integration with industrial security information and event management (SIEM) systems to provide comprehensive protection while enabling necessary remote operations.

How Secure Remote Access Actually Works

Secure remote access for OT networks operates through a multi-layered architecture designed to protect critical industrial systems while enabling authorized personnel to perform essential monitoring and maintenance tasks. The process begins with establishing a secure perimeter around OT assets, typically using dedicated secure gateways or jump servers that act as intermediaries between external users and sensitive industrial control systems. These secure remote access solutions create an isolated pathway that prevents direct internet connectivity to OT networks while maintaining operational functionality.

The authentication process in OT secure remote access systems is particularly robust, often requiring multi-factor authentication combined with role-based access controls specific to industrial environments. Users must first authenticate to the secure remote access gateway, which then validates their credentials against both IT identity systems and OT-specific authorization databases. Once authenticated, the system establishes encrypted tunnels using industrial-grade protocols that can handle the unique communication requirements of SCADA systems, PLCs, and other OT devices while maintaining the low-latency performance critical for real-time operations.

Data transmission in OT secure remote access solutions employs protocol-aware filtering and inspection capabilities that understand industrial communication standards like Modbus, DNP3, and OPC. The secure remote access system monitors all traffic flowing between remote users and OT devices, applying security policies that block unauthorized commands while allowing legitimate operational activities. Advanced solutions include session recording and audit capabilities that capture every action performed during remote sessions, providing complete visibility into who accessed which systems and what changes were made.

Modern OT secure remote access implementations often incorporate zero-trust principles specifically adapted for industrial environments. This means that every connection attempt is verified and validated, regardless of the user’s location or previous access history. The secure remote access system continuously monitors session behavior, device health, and network traffic patterns to detect anomalies that might indicate a security threat. When suspicious activity is detected, the system can automatically terminate sessions, alert security personnel, and initiate incident response procedures to protect critical OT infrastructure from potential cyber attacks.

The 5 Biggest Security Risks When Accessing Networks Remotely

1. Compromised Endpoints and Device Security

One of the most significant threats to secure remote access in OT environments comes from compromised endpoints used by remote workers. Personal devices, unmanaged laptops, or inadequately secured workstations can serve as entry points for malware that subsequently infiltrates industrial networks. In OT environments, this risk is particularly dangerous because infected devices can potentially disrupt critical infrastructure operations or provide attackers with persistent access to SCADA systems and industrial controls.

2. Man-in-the-Middle Attacks and Network Interception

Secure remote access connections are vulnerable to man-in-the-middle attacks, especially when users connect from unsecured public networks or compromised internet connections. For OT networks, these attacks can be catastrophic because intercepted communications might reveal sensitive operational data, system configurations, or real-time process information. Attackers who successfully position themselves between remote users and OT systems can potentially inject malicious commands or steal critical infrastructure intelligence.

3. Credential Theft and Authentication Bypass

Weak authentication mechanisms represent a fundamental vulnerability in secure remote access systems. Stolen credentials, password attacks, or authentication bypass techniques can grant unauthorized access to critical OT networks. In industrial environments, compromised credentials can allow attackers to manipulate production processes, disable safety systems, or access proprietary operational data. The challenge is compounded by the fact that many OT systems still rely on default passwords or shared accounts that are difficult to secure effectively.

4. Insider Threats and Privileged Access Abuse

Secure remote access systems can inadvertently enable insider threats, particularly when privileged users abuse their legitimate access rights. In OT environments, authorized personnel with remote access capabilities might intentionally or unintentionally cause operational disruptions, data theft, or safety incidents. The remote nature of access makes it more difficult to monitor user behavior and detect anomalous activities that might indicate malicious intent or compromised accounts.

5. Lateral Movement and Network Segmentation Failures

Once attackers gain initial access through compromised secure remote access connections, they often attempt lateral movement to expand their foothold within OT networks. Poor network segmentation, excessive user privileges, or inadequate monitoring can allow threats to spread from initial access points to critical industrial systems. In OT environments, this lateral movement can potentially impact multiple production lines, safety systems, or even entire facilities, making proper network isolation and access controls essential for maintaining operational security.

Essential Building Blocks of Effective Secure Remote Access Solutions

Building a robust secure remote access solution for OT networks requires integrating multiple security technologies and architectural components that work together to protect critical industrial infrastructure. Unlike traditional IT environments, OT secure remote access solutions must accommodate the unique requirements of industrial control systems while maintaining the stringent security standards necessary to protect operational technology from cyber threats. The following essential building blocks form the foundation of any effective secure remote access architecture designed for industrial environments, each serving a specific role in creating comprehensive protection for remote connectivity to critical OT assets.

Identity Verification: The Foundation of Secure Remote Access

Identity verification serves as the cornerstone of any secure remote access system, particularly in OT environments where unauthorized access can lead to catastrophic operational disruptions or safety incidents. In industrial networks, robust identity verification goes beyond traditional username and password combinations to incorporate multi-layered authentication mechanisms specifically designed for the high-stakes nature of operational technology. Effective identity verification for OT secure remote access must balance stringent security requirements with the operational realities of industrial environments, ensuring that authorized personnel can quickly access critical systems during emergencies while maintaining ironclad protection against unauthorized intrusion attempts.

Protecting the Connection: Encryption and Tunneling Technologies

Once identity verification establishes user authenticity, encryption and tunneling technologies become the critical defense mechanism that protects data transmission in secure remote access systems. In OT environments, these technologies must safeguard sensitive industrial communications while accommodating the unique protocols and real-time requirements of operational technology networks. Effective encryption and tunneling for OT secure remote access requires specialized approaches that can handle industrial communication standards like Modbus, DNP3, and OPC while maintaining the low-latency performance essential for safe and efficient industrial operations. The challenge lies in implementing robust encryption that protects against sophisticated cyber threats without compromising the deterministic communication patterns that many industrial control systems depend upon for reliable operation.

Securing Every Device: Endpoint Protection for Remote Access

Endpoint protection represents a critical vulnerability point in secure remote access architectures, as compromised devices can serve as launching pads for attacks against OT networks and industrial control systems. In operational technology environments, endpoint security takes on heightened importance because a single infected device connecting remotely to industrial networks can potentially disrupt entire production processes or compromise safety systems. Effective endpoint protection for OT secure remote access must address the diverse range of devices used by remote workers, from personal laptops and mobile devices to specialized industrial terminals and ruggedized field equipment. The challenge is implementing comprehensive endpoint security measures that can validate device health, detect malware, and enforce compliance policies without creating operational barriers that prevent authorized personnel from accessing critical OT systems when needed.

Managing Access Rights: Granular Control of Remote Resources

Access rights management forms the final layer of defense in secure remote access systems, determining precisely what resources, systems, and functions each authenticated user can access within OT networks. In industrial environments, granular access control becomes paramount because different personnel require varying levels of access to operational technology systems based on their roles, responsibilities, and operational requirements. Effective access rights management for OT secure remote access must implement role-based permissions that align with industrial hierarchies while maintaining the principle of least privilege to minimize potential attack surfaces. The complexity increases when considering that OT environments often require emergency access protocols, temporary elevated permissions for maintenance activities, and real-time access adjustments based on operational conditions, all while maintaining comprehensive audit trails and compliance with industrial security standards.

Real-World Examples: Secure Remote Access in Action

Power Generation and Grid Operations

Electric utilities worldwide rely on secure remote access solutions to monitor and control power generation facilities and distribution networks from centralized operations centers. During severe weather events or grid emergencies, operators use secure remote access to quickly assess system status, reroute power flows, and coordinate restoration efforts across multiple substations and generation plants. These OT secure remote access systems enable real-time monitoring of SCADA networks while maintaining strict isolation between corporate IT networks and critical power grid infrastructure, ensuring that remote operations personnel can respond to outages without exposing the electrical grid to cyber threats.

Manufacturing and Production Control

Global manufacturing companies implement secure remote access to enable engineers and technicians to troubleshoot production issues, perform predictive maintenance, and optimize manufacturing processes from remote locations. For example, automotive manufacturers use secure remote access solutions to allow headquarters engineering teams to remotely diagnose problems at plants worldwide, reducing downtime and travel costs while maintaining production quality. These systems provide encrypted connections to industrial control systems, enabling remote access to PLCs, HMIs, and manufacturing execution systems while preventing unauthorized access to sensitive production data and intellectual property.

Water Treatment and Municipal Infrastructure

Water treatment facilities and municipal utilities deploy secure remote access solutions to enable 24/7 monitoring and emergency response capabilities for critical infrastructure systems. Operations personnel can remotely monitor water quality parameters, adjust treatment processes, and respond to system alarms from off-site locations, ensuring continuous service delivery while maintaining cybersecurity. These OT secure remote access implementations often include redundant communication paths and fail-safe mechanisms that automatically secure systems if unauthorized access attempts are detected, protecting public health and safety infrastructure from potential cyber attacks.

Oil and Gas Pipeline Operations

Pipeline operators use secure remote access systems to monitor thousands of miles of pipeline infrastructure, compressor stations, and pumping facilities from centralized control rooms. Field technicians can securely connect to remote terminal units (RTUs) and pipeline monitoring systems to perform maintenance, collect operational data, and respond to emergencies without physically traveling to remote locations. These secure remote access solutions incorporate specialized protocols for industrial communications while providing the real-time data transmission capabilities essential for safe pipeline operations and environmental protection.

Evaluating Secure Remote Access Solutions: What to Look For

Which OT remote access solution is right for you? It depends on the sensitivity of your OT/physical process, on your risk tolerance, and on your assessment of credible threats. In Waterfall’s upcoming webinar, we look at the landscape of available OT remote access solutions, how they compare risk-wise, and what a decision tree for choosing between the alternatives looks like.

One core assumption: we are trying to prevent cyber attacks pivoting from the Internet (possibly via intervening IT and other networks) into sensitive OT networks and sabotaging physical operations.

Different types of solutions include:

2FA, DMZ, VPN, Jhost, NGFW – this is a conventional IT/OT remote access system, such as the system described as the minimum acceptable for NERC CIP Medium Impact sites, including (more or less) two-factor authentication, a demilitarized zone “network between networks,” a virtual private network, a jump host, and a next-gen firewall.
OT SRA – is a typical OT “secure” remote access solution that works roughly like Microsoft Teams – there is a client in the OT network and it reaches out through an IT/OT firewall to connect to remote laptops and other clients, either by contacting those clients directly or by reaching into a cloud service or other server to rendezvous with clients.

Timed switch – a timed hardware switch that temporarily connects / disconnects a conventional type (1) or (2) software-based remote access solution to an IT network or the Internet. The timed switch is normally in a disconnected state and enables temporary remote connectivity infrequently.
Hardware-Enforced Remote Access – Waterfall’s HERA, which consists of cooperating inbound and outbound gateways designed to prevent attacks pivoting from the Internet into OT systems.
Unidirectional remote screen view technology – tech that lets the remote user “look but not touch” and requires an engineer or other human operator in the protected OT network to cooperate with the remote expert providing remote support.

Features & Characteristics of Remote Access Solutions

To compare risks in these solutions, we look at a number of features & characteristics:

High connectivity – CISA and other authorities recently requested that high-consequence sites stop using VPNs for remote access, in large part because VPNs very often provide more connectivity into IT and OT networks than is needed and is wise.

Dangerous features – many “secure” remote access solutions have a myriad of features including dangerous ones such as file transfers (of potentially malicious files) and clipboard cut-and-paste operations (of potentially large attack scripts).

Firewalled – most “secure” remote access solutions demand a firewall at the IT/OT interface. Firewalls have a role inside OT networks and inside IT networks but are often not strong enough to defend a consequence boundary – when OT and IT networks have dramatically different worst-case consequences of compromise.

Server pivot – most “secure” remote access solutions have fairly constant IP addresses. They are in a sense “sitting ducks” for any adversary who cares to test them, any time that adversary cares to test them – for zero days, for unpatched known vulnerabilities, for misconfigurations and so on. And once these remote access servers are compromised, the attacker can pivot through the compromised remote access equipment, using the compromised equipment to attack more valuable assets deeper into the OT network.
Client pivot – most remote access solutions can be misused by attackers if he remote workstation or laptop is taken over. Two-factor authentication makes this harder, but not impossible, since 2FA is also software with vulnerabilities, both known and zero-day. Attackers thus are able to pivot through a compromised remote endpoint into the protected OT network.

Constant exposure – most remote access solutions are “always on” – constantly exposed to attacks from compromised external networks, such as IT networks and the Internet.

Personnel – most remote access solutions are designed for unattended operation, meaning that no OT personnel need be present at or internally connected to remote sites, such as substations, pump stations, lift stations, compressor stations or other remote installations. Attended operation systems that work only if there are local personnel present to help them along tend to be more secure, but those personnel are not always available.

How do we use these characteristics to choose between the options?

Well, we need to understand our needs and especially the criticality of our physical operations. A key question: what is the worst consequence possible due to a credible attack scenario? The question has three key parts:

Worst possible consequence – what is the worst that can happen if compromised computers either fail to function correctly, or more often are deliberately made to function maliciously. And beware – many risk programs have blind spots, such as bricked control equipment. What happens if the bad guys get in and load dummy firmware into most of our 10-year-old PLCs, damaging them so thoroughly that it is now impossible to reload them with correct firmware? Where do we get spares to replace these components when the manufacturer no longer produces this equipment?

Credible attacks – in the spectrum of possible attacks (see Waterfall’s report on the Top 20 Cyber Attacks on Industrial Control Systems), which attack scenarios and consequences do we deem credible threats, given the defenses we have already deployed and the remote access systems we are considering, and which consequences and attacks do we not believe will be realized in our network or in any similar networks, any time soon?
Acceptable consequences – which credible consequences, due to credible attacks on our systems, do we deem acceptable vs. unacceptable?

All this and more, in greater detail, with industry-specific examples, can be learned by watching our past webinar ‘Building a Game Plan for OT Remote Access‘.

Key Takeaways: Securing Remote Access in a Changing World

As operational technology environments embrace digital transformation, securing remote access to critical industrial systems has become both essential and increasingly complex. Unlike traditional IT networks, OT environments control physical processes where security breaches can lead to production shutdowns, safety incidents, or infrastructure damage.

Security Requires Multiple Layers

Effective OT remote access security cannot rely on any single control. The most resilient implementations combine robust identity verification, encrypted communications, endpoint protection, and granular access controls. This multi-layered approach addresses the five major threat categories: compromised endpoints, man-in-the-middle attacks, credential theft, insider threats, and lateral movement opportunities.

Balance Security with Operations

The greatest challenge lies in balancing stringent cybersecurity requirements with operational realities. Industrial control systems require deterministic communication and real-time performance that cannot be compromised. Effective solutions must natively understand industrial protocols, maintain air-gapped architectures, and provide the reliability that critical infrastructure demands.

The Future is Zero-Trust for OT

Traditional perimeter-based security is inadequate for modern OT environments. The shift toward zero-trust architectures – where every connection is verified and continuously monitored – represents the future of OT cybersecurity. However, implementation must carefully consider industrial workflows and emergency access requirements to avoid operational disruptions.

Preparing for Tomorrow

As organizations continue embracing remote operations capabilities, comprehensive OT remote access security becomes a strategic enabler rather than a barrier. Organizations that invest in protocol-aware protection, air-gapped architectures, and scalable solutions today will be better positioned to capitalize on future opportunities while maintaining security and reliability.

The path forward requires viewing OT remote access security as an enabling capability that allows safe adoption of operational flexibility and efficiency. With the right foundation, remote access becomes a competitive advantage in the digital transformation of industrial operations.

About the author

Waterfall team

FAQs About Secure Remote Access

What makes OT remote access different from regular IT remote access?

Secure Remote Access for Critical Infrastructure: What’s at Stake?

Waterfall team — Tue, 31 Dec 2024 07:34:04 +0000

OT Insights CenterSecure Remote Access for Critical Infrastructure: What’s at Stake?

Secure Remote Access for Critical Infrastructure: What’s at Stake?

OT Remote Access needs to be far more secure than IT remote access. There is a good reason why.

Waterfall team

December 31, 2024

In our hyper-connected world, critical infrastructure—power plants, water systems, transportation networks, airports, seaports, and anything else that can’t simply be “turned off”—is the backbone of modern society. These systems provide essential services that underpin daily life and economic stability. However, as these infrastructures become increasingly digitized and interconnected, the challenge of securing them from cyber threats becomes ever more important.

One of the most significant vulnerabilities when it comes to OT security for critical infrastructure are the risks posed by the use of remote access into OT. While remote access is essential for operational efficiency and emergency response, it also opens doors for potential cyberattacks. Understanding what’s at stake and how to address these challenges is vital for understanding what is required when it comes to securing critical infrastructure.

Critical infrastructure is a juicy target for cybercriminals [and] nation-state actors…

The High Stakes of Critical Infrastructure

Critical infrastructure is a juicy target for cybercriminals, nation-state actors, and hacktivists. A successful breach can lead to:

Widespread Disruption: An attack on the power grid could result in prolonged blackouts, affecting millions. Similarly, a breach in water systems could disrupt supply or even compromise water safety.

Economic Impact: Downtime in transportation networks or energy systems can cost billions in lost productivity and revenue.

Public Safety Risks: Malicious actors could manipulate transportation systems, potentially causing accidents, or disrupt healthcare facilities reliant on stable power.

National Security Threats: Infiltration of critical systems can serve as a precursor to broader attacks during geopolitical conflicts.

You get the picture. Critical infrastructures are heavily cyber-targeted. And at the same time the option of “turning it off” is not a good option, and if it does go off, it must come back on as a top priority.

Challenges in Securing Remote Access

Securing remote access to critical infrastructure is uniquely challenging due to several factors:

So Many Legacy Systems: Many critical infrastructure systems run on legacy technology designed decades ago. Back then they didn’t build with cybersecurity in mind. Retrofitting or replacing these systems with modern security measures is overly complex and not cheap.

The OT vs IT Standoff: OT environments prioritize availability and safety, while IT focuses on data confidentiality and integrity. Bridging this cultural and technological gap is a persistent challenge across many critical industries. Large strides have been made on this issue with Cyber-informed Engineering (CIE). One interesting facet about CIE, which was originally championed by the Idaho National Laboratory, is that it presents new solutions to cyber security problems that don’t need to exist in the first place.
Get a complimentary copy of Andrew Ginter’s new book on this topic >>

Far and Away: Critical infrastructure often spans vast and distant areas, requiring remote access for maintenance and monitoring. This reliance on remote connectivity increases the attack surface if not done in a way that deterministically keeps away remote threats.

Cloudy with a chance of Third-Party Access: Vendors and contractors often require remote access for system updates and repairs. Sometimes that access is even required as part of warranty agreements. Many of the more recent analytical services require connecting critical machinery to the cloud. This external access poses a significant attack surface.

Advancing Advanced Threats: Attackers targeting critical infrastructure are often highly skilled and well-funded, employing sophisticated methods such as supply chain attacks and zero-day vulnerabilities. They seem to be growing as governments are able to build-up and develop their cyber capabilities.

Hardware Enforcements for Secure Remote Access

Despite all these challenges and evolving threats, Waterfall has several solutions to all these problems:

HERA – Hardware Enforced Remote Access. HERA uses hardware to enforce the remote access. Software can be hacked from afar, but hardware can only be modified when you are standing right next to it. This is how HERA provides secure OT remote access:

One-way remote screen connection: HERA’s outbound connection that shows the remote screen is independent of the inbound connection. The remote screen is duplicated using a one-way fiber-optic cable and then that duplicate is viewed remotely. The hardware required for sending information back through this connection is physically missing, denying such a possibility to cyberattackers.

One-way connection for mouse and keyboard: HERA’s inbound connection also flows in only one direction, from a dedicated laptop using the ███████ protocol, and only transmitting mouse movements and keyboard strokes. No files or images can be uploaded over this connection. No information from this connection can flow back into the laptop, only outbound, and only mouse moves and keys.

There are no TCP/IP packets crossing the IT/OT boundary. If you’d like clarification regarding this technical point, we encourage you to speak to one of our OT remote access specialist that can fully explain how it works Contact us >>

Additional hardware measures for additional security: Additional security measures are in place on the embedded hardware of the laptop, such as Intel’s TPM, while the keystrokes and mouse moves are encrypted.

The Strictly Unidirectional Option: For certain systems and machinery, a Unidirectional Security Gateways will suffice, without the need for full remote access. The machinery’s OT data is duplicated onto a server which is then accessed remotely. The data going to the duplicate server is constantly updated in real-time using a unidirectional connection. This way it can be updated immediately, yet not a line of code can ever make it back onto the machinery’s systems. If occasional changes need to be made remotely, the remote user can phone someone physically near the machinery and have them make the required adjustments.

Waterfall Tamperproof Blackbox

Tamper-proof Logs: While unidirectional technology is able to neutralize remote threats, there still persists the risk from insiders as well as embedded threats -threats that might come from foreign-made machinery that has a “backdoor” embedded into the technology, such as ship-to-shore cranes. Cyberattacks that make use of such sophisticated attacks are known for “covering their tracks” and erasing event logs of their actions. By maintaining a tamper-proof copy of the logs, if any breach is ever suspected, the logs can be compared for any discrepancies so that whatever was deleted is quickly found. This usually also helps narrow down what the attackers were after.

Let’s Not Forget Compliance and Regulations

Unidirectional technology and hardware enforced OT remote access also boast strong regulatory compliance. This includes adherence to IEC 62443, NIS2, NERC CIP, and many more, including recommended best practices such as connecting OT to AWS (Amazon Web Services).

So, in Conclusion

The stakes for securing remote access to critical infrastructure could not be higher. Disruptions to power, water, or transportation systems can ripple across societies, causing economic turmoil, public safety crises, and national security vulnerabilities. While the challenges in securing remote access for OT are complex, a deterministic approach that combines hardware enforcement with advanced software can neutralize these risks, safeguard these vital systems, and all while adhering to strict regulatory requirements.

In this digital age…the question is not if we can afford to invest in secure remote access but if we can afford not to.

In this digital age, ensuring the security of critical infrastructure is not just an operational necessity—it is a strategic imperative. The question is not if we can afford to invest in secure remote access but if we can afford not to.

Want more details about Waterfalls secure remote access solutions?
Speak to an ot remote access expert >>

About the author

Waterfall team

Cyber-Informed Engineering Recognized with Cyber Policy Award for Research Impact

March 18, 2026

Waterfall Security Solutions recognized by Gartner®

March 9, 2026

Consequential OT Breaches Dropped in 2025 – What Happened?

March 5, 2026

Stay up to date

Subscribe to our blog and receive insights straight to your inbox

The post Secure Remote Access for Critical Infrastructure: What’s at Stake? appeared first on Waterfall Security Solutions.

Webinar: Navigating OT Remote Access – Technologies, Limitations, and the Latest Recommendations

Andrew Ginter — Tue, 08 Oct 2024 12:13:04 +0000

OT Insights CenterWebinar: Navigating OT Remote Access – Technologies, Limitations, and the Latest Recommendations

Webinar: Navigating OT Remote Access – Technologies, Limitations, and the Latest Recommendations

Watch the webinar to discover cutting-edge OT remote access strategies.

Watch the insightful webinar where we delve into the rapidly evolving landscape of OT remote access. With the surge in remote access to OT networks, industrial operations and critical infrastructures are under pressure to enhance their security measures.

In this webinar, Andrew Ginter takes us through:

The Rise of Remote Access: Understand the dramatic increase in remote access to OT networks and its implications.

Technology Choices: Explore a variety of remote access technologies, each with unique costs, benefits, and security limitations.

Security Challenges: Learn why CISA and other authorities are advising against traditional VPNs and other “secure” remote access technologies.

In-Depth Analysis: Get a detailed look at the limitations of current technologies and the evolution of the solution space.

Latest Recommendations: Discover the cutting-edge OT remote access technologies recommended by recent government guidelines.

Meet Your Expert Guide:

Andrew Ginter

How to Apply the NCSC/CISA 2026 Guidance

March 1, 2026

Webinar: 2026 OT Cyber Threat Report

February 25, 2026

2026 OT Cyber Threat Report

February 18, 2026

Stay up to date

Subscribe to our blog and receive insights straight to your inbox

The post Webinar: Navigating OT Remote Access – Technologies, Limitations, and the Latest Recommendations appeared first on Waterfall Security Solutions.

Hardware-Enforced Remote Access (HERA) – Under the Hood

Andrew Ginter — Wed, 17 Jul 2024 08:32:39 +0000

OT Insights Center OT security standardsHardware-Enforced Remote Access (HERA) – Under the Hood

Hardware-Enforced Remote Access (HERA) – Under the Hood

Waterfall's Hardware-Enforced Remote Access is something new in the world - true interactive OT remote access with unidirectional protection for OT networks. How is this possible?

Andrew Ginter

July 17, 2024

HERA® - Big Picture

The big picture of HERA is similar to that of conventional, software-based remote access solutions:

In a highly automated mine, for example:

A remote user – say a laptop is on a conference hotel’s Wi-Fi network remoting into the mine across the Internet,
The HERA gateway is located at the protected mine site, and
The protected OT network is “behind” the gateway – in this example the mining safety and other automation.

The big difference from conventional software-based remote access is what happens inside the HERA gateway.

“The big picture of HERA is similar to that of conventional, software-based remote access solutions….The big difference from conventional software-based remote access is what happens inside the HERA gateway.”

HERA Gateway

Under the hood of HERA are two instances of Waterfall’s flagship Unidirectional Security Gateways technology. One Unidirectional Gateway is oriented from the protected OT network out to the Internet-exposed IT network or to the Internet directly. That gateway’s hardware is physically able to send information in only one direction – the gateway sends HERA screen images out to the remote user across the Internet. Nothing can get back.

The second gateway under the hood of HERA is a variation of the standard Unidirectional Gateway. This gateway does two things. First, this second gateway sends HERA encrypted keystrokes and mouse movements (KMM) back into the OT network through the unidirectional hardware – nothing can get back out through that hardware. Second, the inbound hardware has gate array logic built in, and this logic scans the unidirectional communications and allows only the very simple encrypted HERA KMM information to pass – all other attempts at communication are rejected. Finally, on the OT network, that gateway’s receiving CPU runs virtual machine (VM) software, creating a brand new VM for each remote user session.

To recap, under the hood of the HERA gateway is:

An inbound Unidirectional Gateway, which contains:
- An Internet-exposed CPU interacting with the remote user / laptop,
- One-way hardware that permits only encrypted KMM data to pass, and
- A CPU on the OT network receiving the encrypted KMM data, decrypting that data and sending keystrokes and mouse movements to the remote users’ session VMs,
An outbound Unidirectional Gateway, which contains:
- A CPU on the OT network receiving screen images from the HERA VMs,
- One-way hardware,
- A CPU on the IT/Internet sending copies of HERA’s session VM screens across the Internet to remote users.

The whole solution fits in 2u of rack space.

A HERA Session

With that background, what does a HERA session look like? The remote user launches the HERA application on their desktop or laptop and chooses one of the configured destinations. This app runs only on computers equipped with a hardware-based Trusted Platform Module (TPM) and uses the TPM hardware to encrypt two (2) standard TLS connections to the HERA gateway. One connection sends encrypted KMM information, and the other receives screen images. The remote user sees the image of a VM screen come up, and the user is challenged for a username and password. This is in fact two-factor authentication, with the HERA encryption credentials stored in the laptop’s KVM hardware being the second form of authentication.

At this point, the user can move the mouse and type on the keyboard. The HERA app encrypts each keystroke and each mouse movement – this time using a different key in the TPM hardware. The app sends the encrypted KMM through the encrypted TLS connection into the HERA gateway.

Here’s the tricky part: the Internet-exposed CPU on the HERA gateway decrypts the TLS connection using its own TPM but does not have the keys to decrypt the encrypted KMM. So, the Internet-exposed CPU sends the encrypted KMM through the one-way hardware into the OT CPU in the HERA device. That OT CPU has the keys to decrypt the KMM and sends the decrypted KMM into the remote user’s virtual session. The virtual mouse moves. Keystrokes are used by the VM, and new screen images are sent back to the user.

How Secure Is this?

What does this mean security-wise? Well imagine that an attacker reaches across the Internet into the target’s IT network and uses a zero-day vulnerability to compromise both of the Internet-facing CPUs in the HERA gateway. What is the worst that can happen? Well, the attacker can interrupt the flow of screen images and KMM. But – can the attacker send arbitrary attack messages into the OT network to propagate the attack further into the network? No. The outbound gateway hardware lets nothing back in, and the HERA inbound gateway hardware lets only encrypted KMM messages back in. And if the attacker tries to forge keystrokes and mouse movements, it does not work – the compromised CPU does not have the keys to encrypt and authenticate keystrokes. Those keys are on the protected OT-resident CPU.

Contrast this with a firewall and software-based remote access solution. Exploit unpatched vulnerabilities in the firewall, VPN server or a complex remote access protocol server and we are in serious trouble. The attacker can reach through the compromised system software and send whatever messages they wish into the OT network to wreak havoc there. Yes, an attack on HERA’s Internet-exposed CPUs can cause the remote access solution to become inoperative, but at most sites this is an inconvenience, not a serious incident. At most sites, remote access saves a little money by reducing travel costs – remote access is generally not required to assure minute-by-minute correct operation of the industrial process.

Bottom Line - a Spectrum of Security

Where does HERA fit within the broader spectrum of remote access solution security? In the illustration, HERA is positioned as stronger than software security, between Unidirectional Secure Bypass and Unidirectional Remote Screen View technologies:

Conventional software-based remote access products at the bottom of the diagram have vulnerabilities, and rely on firewall software secure OT networks,
Secure Bypass is a technology that temporarily enables bi-directional communications into a conventional software-based solution – Secure Bypass provides the OT site with local, physical control over when and how long remote users can access OT networks,
HERA is hardware-enforced remote access,
Unidirectional Remote Screen View makes copies of OT screen images out to external users through unidirectional hardware, while remote experts provide real-time feedback over the phone to engineers on site moving the mouse, and
No remote access at all at the top of the illustration is the most secure option, but is also generally the most expensive option, because industrial sites are unable to take advantage of remote services and service providers.

The bottom line – HERA is something new in the world – the benefits of true interactive remote access without the risk that Internet-based attacks will use remote access vulnerabilities to attack OT targets.

For more details, please contact Waterfall to request a free consultation with a Waterfall HERA expert.

About the author

Stay up to date

Subscribe to our blog and receive insights straight to your inbox

The post Hardware-Enforced Remote Access (HERA) – Under the Hood appeared first on Waterfall Security Solutions.

secure remote access – Waterfall Security Solutions

Remoting Into Renewables – the latest guidelines for secure remote access applied to renewables generation

Remoting Into Renewables – the latest guidelines for secure remote access applied to renewables generation

Watch the webinar to learn how secure access can enhance both safety and performance in renewable energy operations.

Whether you're planning a new facility or optimizing an existing one, you'll gain insights into:

About the Speakers

Andrew Ginter

Lior Frenkel

Share

Trending posts

Stay up to date

Tags

Rethinking Secure Remote Access for Industrial and OT Networks

Rethinking Secure Remote Access for Industrial and OT Networks

Download the book now to:

About the author

Waterfall team

FAQs About Remote Access

Secure Remote Access: Everything You Need to Know in 2025

Secure Remote Access: Everything You Need to Know in 2025

Waterfall team

What is Secure Remote Access and Why Does it Matter Today?

How Secure Remote Access Actually Works

The 5 Biggest Security Risks When Accessing Networks Remotely

Essential Building Blocks of Effective Secure Remote Access Solutions

Real-World Examples: Secure Remote Access in Action

Evaluating Secure Remote Access Solutions: What to Look For

Features & Characteristics of Remote Access Solutions

How do we use these characteristics to choose between the options?

Key Takeaways: Securing Remote Access in a Changing World

About the author

Waterfall team

FAQs About Secure Remote Access

Secure Remote Access for Critical Infrastructure: What’s at Stake?

Secure Remote Access for Critical Infrastructure: What’s at Stake?

OT Remote Access needs to be far more secure than IT remote access. There is a good reason why.

Waterfall team

The High Stakes of Critical Infrastructure

Challenges in Securing Remote Access

Hardware Enforcements for Secure Remote Access

Let’s Not Forget Compliance and Regulations

So, in Conclusion

About the author

Waterfall team

Share

Trending posts

Stay up to date

Tags

Webinar: Navigating OT Remote Access – Technologies, Limitations, and the Latest Recommendations

Webinar: Navigating OT Remote Access – Technologies, Limitations, and the Latest Recommendations

Watch the webinar to discover cutting-edge OT remote access strategies.

In this webinar, Andrew Ginter takes us through:

Meet Your Expert Guide:

Andrew Ginter

Share

Trending posts

Stay up to date

Tags

Hardware-Enforced Remote Access (HERA) – Under the Hood

Hardware-Enforced Remote Access (HERA) – Under the Hood

Waterfall's Hardware-Enforced Remote Access is something new in the world - true interactive OT remote access with unidirectional protection for OT networks. How is this possible?

Andrew Ginter

HERA® - Big Picture

HERA Gateway

A HERA Session

How Secure Is this?

Bottom Line - a Spectrum of Security

About the author

Andrew Ginter

Share

Trending posts

Stay up to date

Tags