IND.3.2 Remote Maintenance in Industry

In industry, a uniform, central remote maintenance concept MUST be established for all remote maintenance systems for all of an organisation's OT. The following aspects MUST be considered in the OT remote maintenance concept:

• Specific requirements from system manufacturers
• Specific requirements of decentralised infrastructures
• Specific requirements for remote maintenance connections
• Specific requirements for the availability of remote maintenance
• Specific requirements due to environmental conditions
• Specific requirements due to existing plants

All these aspects MUST be coordinated with all the internal and external entities involved.

All remote maintenance access points that provide possible access to an organisation's ICS MUST be recorded in central documentation.

When purchasing new machines with remote maintenance functions, the corresponding information security requirements MUST be coordinated with the supplier.

An organisation SHOULD seek to standardise the remote maintenance solutions it uses. As soon as standardised solutions for remote maintenance are planned, the OT and the office and building IT at hand MUST be jointly coordinated.

In industry, OT and office and building IT MUST jointly record and document all the OT remote maintenance access points in place.

Particularly for remote maintenance components that are integrated into package units, all disabled access points MUST also be documented.

All facilities MUST be audited regularly to ensure that all their remote maintenance access points comply with the target status (i.e. the current remote maintenance concept for the OT).

An approval process SHOULD be established within the OT for necessary deviations from the established concept.

Appropriately restrictive regulations for OT remote maintenance must be contractually agreed with all external users (i.e. manufacturers, integrators and maintenance service providers). These contractual arrangements MUST ensure at all times that external users only use OT remote maintenance access in a controlled and coordinated manner.

The activities certain external users are permitted to carry out and the remote maintenance access points they are to use MUST be defined internally. The internal employees who authorise, observe and, if necessary, support the remote maintenance access and activities of external users MUST also be defined.

Especially for safety machines, the internal OT employee in question MUST have both organisational and technical sovereignty over the times at which remote maintenance is carried out. The possibility of establishing an outward VPN tunnel MUST be forbidden by contract.

OT, office and building IT, and all other organisational units involved MUST establish appropriately restrictive regulations for all components and interfaces that directly or indirectly enable remote OT maintenance at their organisation. These internal regulations MUST ensure controlled and coordinated use of the respective OT remote maintenance access points at all times. The following aspects MUST be regulated:

• Processes
• Responsibilities
• Authorisations

In industry, OT MUST be able to control any access to an IT system that provides a remote maintenance service to the OT. For this purpose, access MUST be secured by at least one security component under the responsibility of the OT.

All types of remote maintenance access SHOULD be standardised. All access SHOULD be controlled and explicitly allowed using central authentication components.

If OT remote maintenance access points include decentralised infrastructures or components integrated in package units, the access points MUST be secured by an additional security component that is neither integrated nor part of the decentralised infrastructure.

All remote access to any components in an OT zone SHOULD be decoupled. At each remote access point to OT, an IT system SHOULD be in place that terminates the connection before the transition into the target OT zone and establishes a new, regulated connection to the remote maintenance service with a different protocol.

All tools and programs required for remote maintenance SHOULD support multi-user operation and be installed and able to function on this IT system. The IT system SHOULD be a jump server or an application layer gateway (ALG) positioned in a dedicated security segment, such as a demilitarised zone (DMZ).

The IT system for decoupling access SHOULD be the responsibility of OT (i.e. ideally located in an OT DMZ).

Each remote maintenance session SHOULD be pre-approved by an OT employee of the operator organisation responsible for the target system of the session. This responsible OT employee SHOULD only enable the remote maintenance access following this approval. Explicit approval SHOULD be required both for unscheduled cases of need and during coordinated maintenance windows. Approval SHOULD only be valid for a limited period of time so that the responsible OT employee retains sovereignty over the time of remote maintenance (see requirement IND.3.2.A3 Regular Checks and Exceptions for Existing OT Remote Maintenance Access).

Furthermore, external remote maintenance access SHOULD be established exclusively from the inside out (i.e. from the OT network). In particular, open ports for remote maintenance MUST NOT be accessible from the outside (i.e. from untrusted networks).

A secure procedure SHOULD be established for exchanging files involved in OT remote maintenance (e.g. configuration files, updates, or manuals). At minimum, this MUST include a check for malware.

Establishing a connection between a data exchange system and file source SHOULD not be automated; it should be initiated and authenticated by an organisation's OT prior to any file exchange. File exchanges SHOULD always be logged.

In industry, it MUST be ensured that persons working in plants or operating machines cannot be endangered directly or indirectly by active remote maintenance. Furthermore, it MUST be ensured that active remote maintenance does not interfere with the production process.

If personal injury or damage to property is possible, it MUST be ensured that an OT employee can follow the remote maintenance activities on site (dual control principle). The OT employee SHOULD be able to intervene and interrupt a remote maintenance session if necessary.

Only user accounts managed in a central OT or organisational directory service SHOULD be used for OT remote maintenance access.

For remote maintenance in industry, a dedicated OT remote maintenance solution SHOULD be used that is independent from office and building IT. All other functions on the IT systems for OT remote maintenance, particularly functions for the administration of IT systems and networks outside the OT, SHOULD be deactivated or prevented.

To ensure maximum independence, dedicated Internet access SHOULD also be used for OT remote maintenance.

For remote maintenance of OT applications or systems, logging SHOULD be extended so that all activities can be immediately traced in a seamless manner. For this purpose, in addition to logging events and session data, the subject matter involved in instances of remote maintenance access SHOULD also be logged.

Supplementary to IND.3.2.A10 Observation and Control of OT Remote Maintenance Sessions, OT remote maintenance sessions SHOULD be continuously regulated by a technical solution. In this context, command-level activities (i.e. manual and automated commands) SHOULD be technically monitored and automatically prevented where necessary.

In addition, sessions SHOULD be monitored across components. If technical monitoring is used, an alarm SHOULD be triggered for anomalies in user behaviour and for specific rule violations (e.g. as soon as a sudden increase in communication volume is detected).