Vendor remote access you can see, approve and switch off.
Most plants we look at have more ways in than anyone has written down, like an integrator's VPN, a remote desktop tool on an engineering workstation, or a cellular modem on a skid. We find them, close the ones nobody needs, and rebuild the rest around named identities and recorded sessions.
Engineering workstationvendor tools · project filesPLCs and HMIszone per process areaPlant historianPI · tag data
CyberArkBeyondTrustDelineaMicrosoft Entra ID
in short·20-second read
Industrial IoT links plant equipment, controllers and sensors to enterprise and cloud systems.
Our job at Cohash is securing that link. We map OT networks into IEC 62443 zones and conduits, set target security levels, and take out the shared vendor logins and standing VPNs. In their place goes brokered remote access with a named identity, an approval and a recording for every session. We work to NIST SP 800-82 Rev. 3 and current CISA guidance on OT connectivity.
you probably need this if
An integrator still connects through a standing VPN that nobody has reviewed in years.
Engineering workstations still have remote desktop tools on them from vendors you no longer even work with.
Operators share one HMI login per shift and nobody can say who changed a setpoint.
From the first call to a setup your own team can run.
Here's what usually prompts a call about your Industrial IoT, what we do about it and in which order, and where you end up.
01 · where it hurts02 · what we change03 · how it runs04 · where you end up
incident board · industrial iot3 open
openAn integrator still connects through a standing VPN that nobody has reviewed in years.
recurringEngineering workstations still have remote desktop tools on them from vendors you no longer even work with.
blockedOperators share one HMI login per shift and nobody can say who changed a setpoint.
exposure
Connectivity and exposure…Zones, conduits and target…Brokered vendor remote accessOT identity and shared accountsIT and OT boundary designService provider requirements
startrehearsehandover
Site walk and passive…
Risk assessment and zone…
Remote access rebuild
Monitoring and handover
we are here
ready to hand over
Every controller change ties back to a named person and a recorded session.
The skid's connection is either gone or it's documented, monitored and in the contract.
OT connectivity inventory with owner and justification per path
Zone and conduit diagram with target security levels
chapter 01 · where it hurts
Why teams reach out
An integrator still connects through a standing VPN that nobody has reviewed in years.
Engineering workstations still have remote desktop tools on them from vendors you no longer even work with.
Operators share one HMI login per shift and nobody can say who changed a setpoint.
chapter 02 · what we change
How we solve it
Connectivity and exposure inventory
Zones, conduits and target security levels
Brokered vendor remote access
OT identity and shared accounts
IT and OT boundary design
Service provider requirements
chapter 03 · how it runs
Our approach
Site walk and passive discovery
Risk assessment and zone design
Remote access rebuild
Monitoring and handover
chapter 04 · where you end up
What changes
Every controller change ties back to a named person and a recorded session.
The skid's connection is either gone or it's documented, monitored and in the contract.
OT connectivity inventory with owner and justification per path
Zone and conduit diagram with target security levels
what we do
Where we spend the hours
6 areas of work, each one done by an engineer who has run it in production.
We trace every path into the OT network to an owner and a business reason, whether it's a VPN, a jump host, a remote support tool, a cellular gateway or a cloud connector. If nobody claims it, it gets closed.
We group plant assets into zones and define the links between them as conduits, then set each zone's target security level from its risk, using the IEC 62443-3-2 assessment process. Not every zone needs SL 3.
There's one hardened way in for remote sessions. Each session needs MFA and its own approval, expires, and gets recorded. We build it on CyberArk or BeyondTrust when you already own them.
Shared HMI and engineering-station logins replaced or vaulted where the equipment allows it, mapped to IEC 62443-3-3 FR1, identification and authentication control. Where a controller can only take one password, we rotate it and log who checked it out.
Industrial DMZ, one-way data flows where the risk calls for them, and historian and cloud data paths that don't open inbound connections to the control network.
We write contract and technical requirements for integrators and maintenance vendors, based on IEC 62443-2-4. That standard covers remote access, patching, user management and logging for IACS service providers.
capability 01 / 06in production
Connectivity and exposure inventory
We trace every path into the OT network to an owner and a business reason, whether it's a VPN, a jump host, a remote support tool, a cellular gateway or a cloud connector. If nobody claims it, it gets closed.
We group plant assets into zones and define the links between them as conduits, then set each zone's target security level from its risk, using the IEC 62443-3-2 assessment process. Not every zone needs SL 3.
There's one hardened way in for remote sessions. Each session needs MFA and its own approval, expires, and gets recorded. We build it on CyberArk or BeyondTrust when you already own them.
Shared HMI and engineering-station logins replaced or vaulted where the equipment allows it, mapped to IEC 62443-3-3 FR1, identification and authentication control. Where a controller can only take one password, we rotate it and log who checked it out.
Industrial DMZ, one-way data flows where the risk calls for them, and historian and cloud data paths that don't open inbound connections to the control network.
We write contract and technical requirements for integrators and maintenance vendors, based on IEC 62443-2-4. That standard covers remote access, patching, user management and logging for IACS service providers.
We pieced these together from Industrial IoT situations that come up a lot. They're patterns. You won't find a specific client in them.
case file 01
Integrator VPNs into every plant and one shared engineering login
composite · not a client story
Beforethe situation
Each plant has a site-to-site VPN for its system integrator and a shared Windows login on the engineering workstation that staff and vendors use for PLC programming software. Nobody can say who last changed a controller program.
What we dothe work
We list every remote path and who uses it, then stand up a PAM broker in the plant DMZ. Vendors get named accounts with MFA, and sessions to the engineering workstation are approved per job and recorded. The shared login becomes named local accounts, and each VPN closes once its vendor has moved over.
Afterwhere you end up
Every controller change ties back to a named person and a recorded session. Vendor access exists only during approved windows.
case file 02
A cellular modem on a packaged skid that no asset list mentions
composite · not a client story
Beforethe situation
Nobody knew about it until passive discovery at a treatment site picked it up. A packaged skid was talking to its OEM's cloud portal over a cellular modem, around the plant firewall, with no mention in any asset list or supplier contract.
What we dothe work
We document the path, confirm with the OEM what the portal does and which credentials it uses, and decide with operations whether it stays. If it stays, it moves behind a defined conduit with monitoring. The supplier contract gains IEC 62443-2-4 style requirements for remote connectivity.
Afterwhere you end up
The skid's connection is either gone or it's documented, monitored and in the contract. Cellular paths are part of the asset inventory now.
How vendor remote access reaches the plant through PAM
Remote engineers sign in through your identity provider with MFA, then the PAM broker in the industrial DMZ approves, time-limits and records their session to a jump host. Plant data leaves the control network one way, and session logs go to the SOC.
01 · Remote users
Vendor engineerintegrator · OEM support → Identity provider · SAML or OIDC + MFA
Plant engineeron call · off site → Identity provider · SAML or OIDC + MFA
02 · Enterprise IT
Identity providerEntra ID · Okta · MFA → PAM broker · authenticated user
Plant historianPI · tag data → Historian replica · one-way replication
Read the diagram as text
Vendor engineer → Identity provider: SAML or OIDC + MFA
Plant engineer → Identity provider: SAML or OIDC + MFA
Identity provider → PAM broker: authenticated user
PAM broker → Hardened jump host: approved session
Hardened jump host → Engineering workstation: RDP or SSH
Engineering workstation → PLCs and HMIs: vendor protocol
Plant historian → Historian replica: one-way replication
PAM broker → SIEM and SOC: session recordings
how it runs
A typical engagement
We don't start a step until the last one has produced something you can check.
step 01
Site walk and passive discovery
We start with a site visit and passive network monitoring, never active scanning on live control networks without the plant's sign-off.
step 02
Risk assessment and zone design
Zones, conduits and target security levels agreed with operations, engineering and safety, documented in a form an auditor can follow.
step 03
Remote access rebuild
One brokered path brought up and tested in parallel, then old paths cut over vendor by vendor during planned maintenance windows.
step 04
Monitoring and handover
Session logs and OT alerts sent to your SOC, with runbooks for approving, revoking and reviewing vendor access.
you keep
What you're left with
We write these for your Industrial IoT setup, and they're working documents. Your team should be able to keep things running from them long after we've gone.
inventory01
OT connectivity inventory with owner and justification per path
yours to keep
design02
Zone and conduit diagram with target security levels
yours to keep
design03
Remote access architecture and vendor onboarding procedure
yours to keep
plan04
Shared-account remediation plan per asset type
yours to keep
document05
Service provider security requirements for contracts
yours to keep
runbook06
Runbooks for session approval, review and revocation
Some clients want a project team, some want a couple of engineers on theirs. Either works. Onsite, nearshore or offshore, with handovers across time zones that keep things moving.
Onsite
Engineers at your sites in the US
Nearshore
Overlapping hours with US teams
Offshore
Overnight progress on your backlog
All time zones
Coverage handed over across time zones
24-hour coverage · US Central time
OnsiteUS business hours
Nearshoreoverlapping US hours
Offshoreovernight progress
Combinedhandover, not hand-off
00:0006:0012:0018:0000:00
roles we staff
OT security engineer
Industrial network engineer
OT remote access and PAM engineer
SCADA integration engineer
Historian data engineer
due diligence · industrial iot
Questions to ask any partner, including us.
Put these to anyone bidding on your Industrial IoT work. The ones who've done it answer differently from the ones who've read about it.
Q1
How will you find assets and connections without active scans on the control network?
Active scans can crash older PLCs and HMIs. Passive monitoring from span ports, plus configuration review, is the safer way to start.
Q2
Where will the remote access broker sit? And what happens when the WAN link drops?
A broker with no local fallback can lock operators out during an outage. Ask for the on-site break-glass path and who holds it.
Q3
How will target security levels be set for each zone, and who signs them off?
IEC 62443 security levels drive cost. They should come from a risk assessment that plant and IT both sign, not a default applied everywhere.
Q4
Which shared accounts can't be replaced, and how will you control those?
Some controllers and HMIs support one account or none at all. Those need compensating controls such as vaulted credentials and session recording.
Q5
How will vendor obligations get written into our supplier contracts?
Remote access rules hold only if suppliers agree to them. IEC 62443-2-4 gives you the vocabulary for service provider requirements.
01Do we have to comply with IEC 62443?
Depends on your sector and who you sell to. Plenty of places treat it as voluntary, yet it's often written into contracts, insurer questionnaires and national rules anyway. And even if nobody makes you, its zones, conduits and security levels give your plant and IT people a shared way to talk.
02Can we use our IT PAM tool for OT remote access?
Often, yes. Tools like CyberArk and BeyondTrust can broker and record OT sessions. What changes is the design, including where the broker sits in the DMZ, how sessions reach legacy protocols, and what happens when the WAN link is down.
03Will this disrupt production?
It shouldn't. We use passive discovery, build the new access path alongside the old one, and cut vendors over during maintenance windows the plant chooses. Anything that touches a controller is scheduled with operations.
04How does this fit with zero trust?
CISA's April 2026 guide on adapting zero trust to OT says you can't copy IT controls into OT unchanged. It concentrates on zones and conduits, supply chain risk and identity. That's how we already work. Identity and access control go in, but in ways the equipment can live with.
05Do you work on safety instrumented systems?
We define the boundary around them and keep remote access away from them. Changes to safety system logic stay with your safety engineers and the system vendor.
related
Often paired with
Projects on Industrial IoT usually end up touching one of these, so they're worth a look.
