Securing OT Remote Access

Introduction: Security Challenges for OT Remote Access​

Remote access to OT (Operational Technology) networks is essential for industrial maintenance and monitoring, but it is also the primary vector for cyberattacks against industrial infrastructure. According to ANSSI, 40% of cyber incidents on French industrial systems involve compromised remote access.

The stakes are high: a compromise of an OT network can lead to production shutdowns, risks to personal safety, physical damage to equipment, and violations of NIS2 or IEC 62443 regulations.

This guide describes Eziwan's security architecture and best practices for a compliant deployment.

Eziwan's Zero Trust Architecture​

Eziwan implements a Zero Trust model (never trust, always verify) for all remote access to OT networks. The architecture is based on three fundamental principles:

  1. Zero implicit trust: Every connection is verified, even from a "trusted" network
  2. Least privilege: Each user has access only to the resources strictly necessary for their tasks
  3. Continuous monitoring: All sessions are recorded and can be analyzed

Zero Inbound Port: How It Works​

The Eziwan gateway requires no incoming port openings on the industrial site's perimeter firewall. This principle is fundamental to security.

Technical Operation​

The Eziwan gateway initiates an outbound connection to the Eziwan cloud at startup:

1. Gateway is starting ──> OUTBOUND UDP connection on port 1194 to cloud.eziwan.com
2. OpenVPN tunnel is being established (X.509 certificate + AES-256-GCM encryption)
3. Heartbeat keepalive every 25 seconds
4. When a technician logs in, the cloud routes their session through the already established tunnel

Operational Benefits​

Traditional method (port forwarding)Eziwan Zero Inbound
Port 3389 (RDP) must be opened on the firewallNo incoming ports need to be opened
Fixed public IP address requiredDynamic IP addresses supported
Visible on Shodan/CensysInvisible on the Internet
Complex firewall configurationZero network configuration
Risk if firewall is misconfiguredZero attack surface on the site side

2FA Authentication: TOTP Setup​

Enabling 2FA for a User​

Two-factor authentication (2FA) is enabled by default on all Eziwan accounts. The enrollment process:

  1. Go to Eziwan Portal → Users → [Username] → Security
  2. Click "Set up two-factor authentication"
  3. Scan the QR code with a compatible TOTP app:
    • Google Authenticator (iOS / Android)
    • Authy (iOS / Android / Desktop)
    • Microsoft Authenticator (iOS / Android)
  4. Enter the 6-digit verification code to confirm enrollment
  5. Keep your recovery codes in a secure location (not on your smartphone)

Secure Login Process​

Advanced 2FA Configuration​

SettingDefault ValueRecommendation
TOTP AlgorithmSHA-1 (RFC 6238)Standard (do not change)
Validity Period30 secondsStandard
Tolerance Window±30 secondsAccount for time zone differences
Recovery codes8 one-time codesStore outside the smartphone
Attempts before lockout5Configurable 3–10
Lockout duration15 minutesConfigurable

Access Rights: by technician, by equipment, by time slot​

RBAC Permissions Model​

Eziwan uses a three-dimensional RBAC (Role-Based Access Control) model:

Permission = User × Equipment × Schedule × Access Level

Available Access Levels​

LevelReadWriteReboot deviceModify configuration
MonitoringYesNoNoNo
MaintenanceYesYesNoNo
ExpertYesYesYesNo
AdministratorYesYesYesYes

Example of Permissions Configuration​

{
  "user_email": "technicien.externe@prestataire.com",
  "display_name": "Jean Martin - ABC Maintenance",
  "access_level": "maintenance",
  "allowed_devices": [
    "PLC_Ligne_Embouteillage_1",
    "IHM_Ligne_Embouteillage_1"
  ],
  "schedule": {
    "allowed_days": ["monday", "tuesday", "wednesday", "thursday", "friday"],
    "allowed_hours_start": "08:00",
    "allowed_hours_end": "18:00",
    "timezone": "Europe/Paris",
    "allow_exceptions": false
  },
  "session_limits": {
    "max_duration_minutes": 120,
    "max_concurrent_sessions": 1,
    "idle_timeout_minutes": 30
  },
  "valid_from": "2026-01-01",
  "valid_until": "2026-12-31",
  "notes": "Contrat maintenance préventive annuelle"
}

Audit trail: session logs​

Log Location​

Audit logs are available in the Eziwan Portal under Administration → Audit Trail.

You can filter by:

  • User
  • Device accessed
  • Date range
  • Status (success / failure / alert)
  • Source IP address

Structure of a log entry​

{
  "event_id": "evt_20260604_143200_00001",
  "event_type": "session_started",
  "timestamp": "2026-06-04T14:32:00.000Z",
  "user": {
    "id": "usr_00847",
    "email": "jean.martin@prestataire.com",
    "display_name": "Jean Martin"
  },
  "authentication": {
    "password_verified": true,
    "totp_verified": true,
    "ip_address": "82.64.xxx.xxx",
    "country": "FR",
    "user_agent": "Mozilla/5.0..."
  },
  "session": {
    "id": "sess_20260604_143200",
    "device": "PLC_Ligne_Embouteillage_1",
    "protocol": "modbus_tcp_proxy",
    "tunnel": "openvpn"
  }
}

Exporting Logs for Compliance​

Logs can be exported as JSON or CSV via the REST API or the web interface.

# Export via API Eziwan (exemple curl)
curl -H "Authorization: Bearer VOTRE_API_TOKEN" \
     "https://api.eziwan.com/v1/audit-logs?from=2026-01-01&to=2026-06-04&format=csv" \
     -o audit_logs_2026.csv

Best Practices: 10 Safety Rules​

  1. One account per person: Never share login credentials among technicians or service providers. Each access must be individually traceable.

  2. 2FA is mandatory without exception: 2FA is non-negotiable, even for emergency access. Prepare recovery codes in case your smartphone malfunctions.

  3. Limited duration of provider rights: automatic expiration date (maximum 12 months), quarterly review of active accesses.

  4. Immediate Revocation: A documented procedure for revoking access in less than 5 minutes. A designated person responsible for carrying out revocations.

  5. Least-privilege principle: A service provider on Line 1 does not have access to Line 2. A monitoring technician has only "monitoring" access, not "maintenance" access.

  6. Access During Business Hours: Unless otherwise documented, service provider access is limited to business hours. Nighttime connections from abroad must trigger an alert.

  7. No access outside of scheduled maintenance windows: For service providers, enable access only during maintenance windows. Disable it between maintenance windows.

  8. Audit trail reviewed regularly: weekly by the IT manager, monthly by management. Do not wait for an incident to occur before checking the logs.

  9. Emergency Access Testing: Simulate an emergency maintenance scenario once every quarter to verify that the procedure works (contacting the on-call staff, logging in, resolving the issue, logging out).

  10. Gateway firmware update: Enable automatic updates on the Eziwan gateway. Never ignore security bulletins.

NIS2 and IEC 62443 Compliance​

NIS2 (European Directive, to be transposed in France in October 2024)​

NIS2 requirements applicable to OT remote access for critical and important entities:

NIS2 RequirementEziwan Implementation
Third-Party Access ManagementNamed accounts, granular permissions, expiration
Strong AuthenticationMandatory 2FA (TOTP)
LoggingComplete, exportable audit trail retained for 24 months
Incident NotificationExport logs for ANSSI reporting within 24 hours
Vulnerability ManagementAutomatic OTA updates with signed firmware
Business Continuity4G failover in case of primary connection failure

IEC 62443 (Industrial Cybersecurity Standard)​

Eziwan supports compliance with IEC 62443:

IEC 62443 ZoneSecurity LevelEziwan Measures
Corporate Zone (L4)SL-1TLS VPN, basic authentication
Operations Zone (L3)SL-22FA, RBAC, audit trail
Control Zone (L2)SL-2Access via dedicated tunnel, device-specific permissions
Field Zone (L1)SL-1Modbus/OPC-UA access via Eziwan proxy

To obtain the complete compliance documentation (security questionnaire, reference architecture), please contact the Eziwan team.

Frequently Asked Questions​

Why ban all incoming traffic to an industrial site?​

Every exposed port (RDP, VNC, inbound VPN) is continuously scanned and serves as the primary entry point for ransomware targeting the industry. The Eziwan architecture does not open any ports: the gateway alone initiates an encrypted outbound connection.

Is two-factor authentication really necessary for the OT?​

Yes: a password alone can be stolen or shared. MFA requires a second factor for access to production equipment, and this is an explicit requirement of NIS2 and IEC 62443 audits.

How do you determine who did what during an audit?​

Each remote session is logged: user ID, timestamp, target device, duration, and source address. These immutable logs can be exported for compliance audits and post-incident analyses.

Does this architecture comply with IEC 62443?​

It implements the key measures for levels SL-1 through SL-2: segmentation into zones and channels, single sign-on per user, least privilege, and auditability. The mapping table above details each requirement.