implementing-conduit-security-for-ot-remote-access

Secure OT remote access by terminating all connections in a Level 3.5 DMZ through a hardened jump server with MFA, session recording, and protocol filtering. Never allow direct VPN tunnels to Level 1/2 devices, and require manager approval before credentials are activated.

An IEC 62443 conduit is a controlled communication path between security zones with defined security policies. For remote access, it channels traffic from enterprise IT through a DMZ jump server to approved OT targets using only allowed protocols like RDP, SSH, or VNC.

Use an approval-based workflow where vendors submit requests 24 hours in advance, receive time-limited credentials after plant manager approval, and connect through an isolated vendor jump server. All sessions are recorded, auto-terminated at the approved end time, and logged to a SIEM.

A jump server with one NIC in the DMZ and another in the OT zone collapses the boundary the conduit is meant to enforce. Verify single-homed placement and confirm the OT-side gateway reaches only pre-approved destination IPs and protocols.

Do not use this approach for designing overall Purdue Model segmentation, deploying IT-only remote access, or configuring local console access to PLCs. It specifically addresses remote access paths into OT networks, not general network segmentation.