Every OT security conversation eventually wanders toward the exotic stuff. Nation-state tradecraft, custom ICS malware, the zero-day with a catchy name and its own logo. Meanwhile, the actual attacker logged in through a cellular modem a vendor bolted onto a panel in 2019 because it was faster than filing a change ticket.

That isn’t a hypothetical. In July 2026, CISA observed malicious activity against internet-exposed systems at more than 100 water and wastewater entities, commonly through PLCs connected directly to a cellular modem. Attackers changed passwords on exposed PLCs to lock operators out and altered IP addresses to knock equipment off the network. Nobody needed a zero-day. Somebody left the door open, and it had been open long enough that everyone forgot it was a door.

Two documents are worth your time right now. The first is CISA’s updated Internet Exposure Reduction Guidance. The second is “Secure Connectivity Principles for Operational Technology”, published earlier this year by the UK NCSC together with CISA, the FBI, and partners in Australia, Canada, Germany, the Netherlands, and New Zealand.

CISA’s own guidance points readers to the joint principles for the details on securing remote access to OT. Read them together and a simple division of labor emerges: CISA tells you to find and close the doors you don’t need, and the principles tell you how to build the ones you keep.

The most important sentence in the CISA guidance is also the most practical: Reducing internet exposure does not mean turning off necessary remote access; it means removing it where it isn’t needed and securing it where it is.

Your vendors aren’t going away. Your OEMs will still need to patch that HMI. The question is whether they do it through something you designed or something that just sort of happened.

Complying with CISA Guidance for SRA: Start With What You Can’t See

Principle 1 asks you to make risk-informed decisions about every connection, backed by a business case and, crucially, a definitive view of your OT architecture. Principle 2 asks you to manage exposure, including the network edges that never made it onto a diagram. The NCSC even calls out the unsecured radio link that nobody drew. CISA’s version is blunter: find out which of your assets are reachable from the internet, including anything hiding under vendor, contractor or legacy infrastructure.

This is the least glamorous and most important part of the job, and it’s where the Forescout Vistaro™ platform earns its keep. It uses more than 30 agentless discovery methods to build device identity, behavior and risk context, so your “definitive view” is based on what is actually on the wire rather than what the spreadsheet from the last audit says. That matters for the business case too. You can’t honestly assess introduced dependencies or potential impacts (both required elements under Principle 1) if you don’t know what the connection touches.

On the secure remote access side specifically, Forescout SRA helps surface hidden and unmanaged connections, so shadow access stops living outside governance. Our own research team has been poking at this problem for a while, and the numbers are not reassuring. Vedere Labs found nearly 60,000 VNC servers with authentication disabled, more than 670 of them wired straight to OT and ICS control panels. Somewhere, somebody is very proud of their uptime.

Build One Good Door Instead of 20 Bad Ones

This is the heart of both documents, and it’s where they get unusually specific.

Principle 2 says all connections into OT should be initiated from within, with no inbound ports exposed, and that external parties like vendors should come through a brokered connection in a DMZ so the OT asset is never directly reachable. It also says to use just-in-time access so connections exist only when they’re needed. Principle 3 practically writes the product requirement for you: instead of separate VPN endpoints for each third party, centralize remote access through a single hardened path in the DMZ with consistent access control and session monitoring. CISA says the same thing from the other direction, urging organizations to route all necessary remote access through a secure gateway or centrally managed access solution rather than connecting directly to a PLC, HMI or RTU.

Forescout SRA was built around exactly that model. It provides brokered access that keeps user endpoints away from critical systems, zero-footprint browser-based access with no VPN or endpoint client, and credential vaulting that keeps privileged credentials hidden from users. Request, approval, duration and audit all live in a single governed workflow, which is just-in-time access with a paper trail attached. Your integrator gets the four hours they asked for on the three assets they need, and then the door closes on its own.

Vaulted credentials also quietly solve a Principle 5 headache. The guidance wants human-to-machine access to be user-aware, with an individual audit trail, and tied to joiners, movers and leavers processes. When the vendor never sees the shared admin password, “the contractor who left in March still knows it” stops being a sentence you have to say out loud in an audit. Principle 5 also calls for phishing-resistant MFA and context-aware decisions based on device, location and user pattern of life. SRA pairs identity-based access with controlled, isolated sessions, and inside the Vistaro platform, access decisions can draw on the live posture of the asset and the environment instead of a static allow list.

Principle 1 has a harder edge worth mentioning. It says obsolete products should be treated as untrusted and never used to implement security controls, and Principle 2 recommends compensating controls like segmentation, access restrictions and monitored access for vendor support until those assets are replaced. In plain English: that Windows XP engineering workstation should not be your jump box. A brokered, monitored session to the legacy asset is a compensating control. The legacy asset acting as the gateway is the problem.

Go deeper: Need help? Watch our webinar “Connected and Protected: Securing Remote Access in Cyber Physical Systems” on demand.

 

SRA: Watch the Door While It’s Open

Principle 7 is refreshingly honest about why this matters: even with every precaution in place, you might still get compromised, and monitoring is your last line of defense. It also says logging shouldn’t just be log collection for its own sake. You should know how attackers would abuse your connectivity and design monitoring around that.

Here’s where most remote access tools stop at “we record the session.” Recordings are great for the post-incident review. They’re less great at 2:14 a.m. while someone is writing to a controller. Forescout SRA brings CPS protocol understanding and real-time session awareness, so teams can see what’s happening while there’s still time to respond rather than reviewing video afterward. Tie that to the Vistaro platform’s continuous monitoring of data flows between segments, which Principle 7 specifically calls out for validating segmentation policy, and you get something closer to what the guidance describes: a baseline of normal, and alerts when a session or a flow drifts from it.

Two other Principle 7 items deserve a mention. Maintenance windows that suppress alerts need business processes to verify the work is legitimate, because attackers love hiding in planned downtime. An approval workflow that ties each session to a specific request gives your SOC something concrete to check against. And break-glass access should never be a routine method and should light up the SOC like a Christmas tree. Route those accounts through the same governed path and send the event to your SIEM with the highest severity you’ve got.

Assume the SRA Door Eventually Fails

Principles 6 and 8 are about containing the damage. Principle 6 uses an example that anyone who has walked a plant floor will recognize: a flat OT network with VPN access for vendors, where a contractor connecting to their own equipment can reach everything else too. The answer is segmentation, down to micro-segmentation where a sensor can only talk to its controller.

The Vistaro platform models device communication patterns in a matrix view before enforcing controls, which is the part OT teams actually care about, because nobody wants to find out the hard way that a “harmless” rule broke a historian feed. It also works across your existing enforcement technologies to accelerate dynamic segmentation without disruption, so you’re not ripping out switches to get there.

Principle 8 asks for an isolation plan and describes an application or service-specific model where, if a third party with remote access is compromised, a well-built just-in-time system lets you revoke their access while everyone else keeps working. That scenario is basically the SRA demo. Kill one vendor’s access policy, leave the other eleven alone, and restore it when the risk is dealt with. Compare that with the alternative the guidance lists for flat networks: pull every external connection and hope the plant can run on clipboards.

Where We Don’t Fit (And That’s Fine)

Some of what the principles recommend isn’t Forescout’s job. Data diodes and hardware-enforced cross-domain solutions are physical controls, and Principle 4’s push toward secure protocol variants like DNP3-SAv5 and OPC UA is a migration you’ll do with your automation vendors. What we can do is tell you where insecure industrial protocols are running today and which assets are talking across boundaries they shouldn’t be, which is the inventory you need to build that migration roadmap in the first place. And no tool writes your business case for you. It can, however, make the approvals, the scope and the audit trail behind each connection a lot less painful to produce.

The Short Version

CISA says find the doors and close the ones you don’t need. The joint principles say build the ones you keep as a single, brokered, time-bound, monitored path you can shut quickly. Forescout SRA is that path. The Vistaro platform is how you find the doors, understand what’s behind them, and keep whatever gets through one from wandering into the rest of the building.

SRA is available standalone or as part of the Vistaro platform, so you can start with the most exposed sites and grow from there. If you’re not sure where you stand, Forescout offers a secure remote access maturity assessment that benchmarks your program and flags control gaps. You can also try a self-guided SRA demo instance to see how brokered, time-bound remote access works in practice.

Take the assessment before the next audit. Or try-out the demo before the next cellular modem finds you.

Sources