Remote Access Is a Governance Problem

Part 1Executive briefing

Four findings. Each states what the evidence says (Data), then what it means for the plant's security lead and for the machine builder (Interpretation).

1. 1. Both verified incidents turned on valid access, not on broken connectivity.

   DataIn the Colonial Pipeline case the chief executive testified that the attacker used a legacy VPN profile that was no longer meant to be in use, protected by a single factor. That VPN led into the company's IT network, where the attack was detected; the hearing record does not describe industrial remote access. In the 2015 attack on Ukrainian power distribution companies, the agency alert records that the attackers held legitimate credentials and operated breakers over existing remote administration tools and VPN connections. Part 7 quotes both records.

   DataSources: Colonial Pipeline hearing record, S. Hrg. 117-429; Ukrainian power distribution companies agency alert, IR-ALERT-H-16-056-01.

   InterpretationFor the plant: The control that mattered was who held a working credential and whether it should still have existed, not the strength of the tunnel.

   For the builder: Every service account you leave behind at a customer site is part of the customer's attack surface, whether or not anyone uses it.

2. 2. The EU rules describe remote access as governance, not as a technology.

   DataNIS2 lists access control policies, asset management, supply chain security and, where appropriate, multi-factor authentication among the minimum measures, and makes management bodies approve and oversee them. None of these provisions names a product or a technology.

   DataSources: Directive (EU) 2022/2555, Art. 21(2)(i); Directive (EU) 2022/2555, Art. 21(2)(j); Directive (EU) 2022/2555, Art. 21(2)(d); Directive (EU) 2022/2555, Art. 20(1).

   InterpretationFor the plant: What an auditor can ask for is a policy and the evidence that it is followed. The artefact is a register and a record, not a purchase order.

   For the builder: Customers in scope will ask how your access is governed, because their own management has to approve how they manage supplier risk.

3. 3. Product law moves part of the evidence burden onto the machine builder.

   DataThe Cyber Resilience Act requires products with digital elements to protect against unauthorised access and to record relevant access activity. The Machinery Regulation requires machinery to record evidence when its software or configuration is intervened in or modified, whether legitimately or not, and connections from remote devices must not lead to a hazardous situation.

   DataSources: Regulation (EU) 2024/2847, Annex I, Part I, point (2)(d); Regulation (EU) 2024/2847, Annex I, Part I, point (2)(l); Regulation (EU) 2023/1230, Annex III, section 1.1.9.

   InterpretationFor the plant: Ask the builder what the machine itself records about remote interventions, and how you can read it.

   For the builder: The service channel shipped with a machine is part of what is placed on the market, so its access controls and records are design questions, not only service-desk questions.

4. 4. Most machine builders meet these rules through their customers first.

   DataBy headcount, enterprises with 50 or more persons employed are 8.9% of machinery and equipment manufacturers (NACE C28) in Belgium and 9.5% in the Netherlands (Appendix C), so most are unlikely to be in NIS2 scope on size alone. NIS2 still brings the questions to them: in-scope customers must weigh the security practices of each direct supplier and service provider.

   DataSources: Eurostat sbs_sc_ovw, 2024; Directive (EU) 2022/2555, Art. 2(1); Directive (EU) 2022/2555, Art. 21(3).

   InterpretationFor the plant: Your supplier questionnaire is how the rules reach most of the builders you depend on. Make it ask governance questions (Appendix A), not product questions.

   For the builder: Expect the customer's questionnaire to be the real compliance channel, and prepare evidence once for all customers.

Part 2How remote access spreads

InterpretationRemote access grows by multiplication, not addition. Each supplier brings its own technicians, and each of them may need to reach each site. This model does the arithmetic on your own numbers so the size of the governance job is visible before anyone discusses tools.

ModelAssumptions

• Every technician of a supplier with access can reach every site that supplier serves. Where access is narrower, P is smaller; use your own inventory.
• A shared account is shared per supplier per site, so every technician of that supplier knows it.
• Each technician change at a supplier (a joiner or a leaver) touches that supplier's access at every site: a shared credential to rotate, or a named account to create or remove.

InterpretationReading the model

• Named accounts do not remove the administrative work: a technician change touches every site either way. They change what the work achieves. Removing one named account removes one person. Rotating a shared credential disrupts everyone else who uses it, so each rotation has a cost for people who did nothing wrong.
• A shared credential known by E people cannot show which of them connected. Every shared credential is a gap in the evidence trail as well as in identity.
• The model counts paths, not risk. A path that is closed between jobs and opened on request carries less exposure than a standing one; that is the availability dimension in Part 4.

Where sprawl hides

• Dealers and subcontractors. The technicians who connect may work for a dealer or subcontractor of the supplier, so the plant may not know E, and it can change without the plant being told.
• Temporary accounts on the plant side. Accounts created for one commissioning job or one urgent repair, and never removed because nobody owned their removal.
• Standing tunnels. Connections left up between jobs because reconnecting is inconvenient, so access exists whether or not anyone is working.

Part 3How governance fails

InterpretationFive ways governance of remote access fails. Each shows what it looks like, which rule or public record it maps to, and what fixed looks like. The descriptions and fixes are our reading; the evidence line under each is marked Data.