securing-remote-access-to-ot-environment

name	securing-remote-access-to-ot-environment
description	Use when this skill covers implementing secure remote access to OT/ICS environments for operators, engineers, and vendors while preventing unauthorized access that could compromise industrial operations. It addresses jump server architecture, multi-factor authentication, session recording, privileged access management, vendor remote access controls, and compliance with IEC 62443 and NERC CIP-005 remote access requirements.
domain	cybersecurity
tags	["ot-security","ics","scada","industrial-control","iec62443","remote-access","jump-server","mfa"]
subdomain	ot-ics-security
version	1.0.0
author	oyi77
license	Apache-2.0
nist_csf	["PR.IR-01","DE.CM-01","ID.AM-05","GV.OC-02"]

Securing Remote Access To Ot Environment

Overview

Cybersecurity skill for securing remote access to ot environment. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "securing remote access to ot environment"

• "This skill covers implementing secure remote access to OT/ICS environments for o"

• When implementing or upgrading remote access architecture for OT environments

• When onboarding vendors who require remote access to OT systems for support and maintenance

• When implementing CIP-005-7 R2 requirements for remote access management including MFA

• When replacing legacy direct VPN access to OT networks with a secure jump server architecture

• When responding to an incident involving unauthorized remote access to industrial control systems

Do not use for securing IT-only remote access without OT components, for configuring VPN for corporate workers (see general VPN guides), or for physical access control to OT facilities.

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• DMZ infrastructure (Level 3.5) between corporate IT and OT networks
• Jump server/bastion host platform (CyberArk, BeyondTrust, or hardened Windows/Linux server)
• Multi-factor authentication solution (Duo, RSA SecurID, YubiKey, smart cards)
• Session recording capability for audit trail compliance
• Firewall rules permitting remote access only through the DMZ intermediate system

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: ) -> :
     {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}