# Wastewater Zero Trust Remote Operations and Asset Management - Link: https://www.agilicus.com/case-study/zero-trust-remote-operations-and-asset-management/ - Published: 2023-12-18T23:28:27+00:00 - Author: Don Bowman Wastewater Operations Case Study # Zero Trust Remote Operations and Asset Management Water and Wastewater plants are commonly remotely operated. In this case study, learn how an industrial control systems integration and engineering company expanded their service offerings to provide real-time operations, monitoring, and asset management using Agilicus AnyX. Increased profit, better predictability. [CONTACT ✉](https://www.agilicus.com/contact-us/) [BOOK A MEETING 📅](https://www.agilicus.com/book-calendar-meeting) The Summary --- ## Add Remote Operations Service, Profit NOTE: Water Control Automation initially had some doubt as to whether to provide the Industrial Remote Access bundled, or, accept the existing methods of their customer. See the [Case Study](https://www.agilicus.com/case-studies/managed-industrial-remote-access/) on this decision process. Water Control Automation, a system integrator, added a new wastewater remote operations service. This service proved more profitable than their existing time & materials support. – charging based on value rather than cost-plus– predictable long-term contracts lowered staffing challenges and costs Water Control Automation discovered that by effectively resolving the issue of remote access for their customers, they were able to position themselves as the go-to solution for connectivity needs. They offered authentication and access services, which set them apart from competitors and enabled them to command higher prices while reducing concerns about competition. Water Control Automation’s customers were pleased with the increased security, as well as the improved mean-time-to-repair. Making Agilicus AnyX part of Water Control Automation’s new remote operations service unlocked high value in a short time, without increased security risk. Zero Trust Remote Operations and Asset Management was a win. The Company --- ## Water Control Automation Background Water Control Automation (not their real name) is a full-service system integrator and engineering company. They have an in-house panel shop and expertise in [Schneider Electric](https://www.se.com/), Rockwell Automation’s [Allen-Bradley](https://www.rockwellautomation.com/en-us/products/hardware/allen-bradley.html) Programmable Logic Controllers. A large part of their business is creating and supporting Human Machine Interfaces, using either [VTScada](https://www.vtscada.com/) or [Ignition](https://inductiveautomation.com/ignition/). Historically Water Control’s business has grown in a project-based fashion. They would bid on projects, build, commission, and warranty their work, with ad-hoc support handled after the first year on a time and materials basis. This growth pattern, while ultimately successful for Water Control, has created a feast-or-famine problem. During some time periods there has been insufficient work, and, in others, they have had to defer new business being unable to fulfill it. Water Control sought to create an ongoing, subscription revenue stream that would allow them to create a more predictable business, scaling their team and capacity more linearly, with higher utilisation and efficiency yielding more billable hours per person. Water Control Automation set out to create a new service offering that would include Remote Operations and Asset Management (ROAM). This Remote monitoring package would leverage [Twilio](https://www.twilio.com/), cloud-based monitoring and reporting, as well as on-call remote maintenance. In this case study we discuss some of the challenges found, and how Agilicus AnyX was used to overcome them, and some of the unexpected benefits to Water Control Automations customers. The Challenges --- ## Remote Operations and Water Plants Water plants are notoriously complex for remote access. They typically use an air- gap style network architecture, blocking all inbound and outbound traffic. They do so since there is no internal security: all internal devices are wide open to each other with minimal or no authentication. In order to be simple to deploy, and, acceptable by the security staff of their customers, Water Control Automation will need to have a strong method of achieving remote access that works with all firewall types, ensuring that all traffic is both encrypted, and, simple to create firewall rules for. As a consequence of this remote access complexity, it is not common for the plant operator to have remote connectivity for their own staff. Once Water Control Automation has solved their own needs, this presents an additional upsell possibility as well as differentiation. Once Water Control Automation’s customers use the service for their own needs, with their own single-sign-on, the service becomes very sticky and differentiated, allowing Water Control Automation to charge more, and defend themself versus competitors. With Agilicus AnyX, Water Control Automation was able to achieve single-sign-on for even local identity systems within the plant (see “ [Merging Local Identity With Online Identity](https://www.agilicus.com/white-papers/merging-local-identity-with-online-identity/)“) The plant operator’s security policy typically requires non-shared accounts and multi-factor authentication. This rules out back-door type solutions using TeamViewer and Ewon. VPNs are not an acceptable solution. From a Water Control Automation standpoint, they cannot install multiple VPN’s on each staff laptop. They need concurrent access to each customer, even though those customers have overlapping IP space (making routing impossible). From a customer standpoint, they do not allow a VPN since it would provide over-broad access into their customers netwok, increasing the risk. In addition, some of the wastewater plants do not have public IP or inbound access possible: due to their remote nature, they use satellite or cellular connectivity. Water Control Automation thus became aware that they had 6 primary challenges slowing their desire to launch a turnkey remote operations service. ![01](https://www.agilicus.com/www/40c531ca-01.svg) ### Firewall Traversal Firewall configuration is complex. Avoid requiring inbound access. Avoid requiring unknown or unfixed IP outbound. All traffic must be HTTPS to go through firewall inspection systems. ![Managed Industrial Remote Access Solution by Agilicus: Securely connect to your industrial assets remotely. Learn how Agilicus helped [Customer Name - if available from case study] improve uptime and reduce costs with secure remote access to PLCs, HMIs, and other industrial equipment. Explore our managed remote access solutions for OT environments.](https://www.agilicus.com/www/d2bcda55-02.svg) ### Authentication Shared accounts are a security risk. All users, customer, partner, must have unique, single-sign-on identities with strong authentication. No new passwords: they get written down, breached, shared. See “[Eliminating the Business Risk of Shared Credentials](https://www.agilicus.com/webinars/2022-03-31-the-business-risk-of-shared-credentials/)” for more details. ![Agilicus Managed Industrial Remote Access: Securely connect and manage remote industrial equipment with Agilicus. Visualize your network architecture with this diagram illustrating secure access points and data flow within your managed industrial environment.](https://www.agilicus.com/www/b6041fda-03.svg) ### Multi-Factor All users must use multi-factor authentication. This cannot be shared. It would be impractical for Water Control Automation to have a separate multi-factor setup for each customer: the users would not be able to operate efficiently. See “[Multi-Factor Authentication On The Internal Network](https://www.agilicus.com/white-papers/multi-factor-authentication-on-the-internal-network/)” for more detail. ![Managed Industrial Remote Access: Securely connect and manage remote industrial equipment with Agilicus. Visualize your network architecture with this diagram illustrating secure access points and data flow.](https://www.agilicus.com/www/65eba380-04.svg) ### VPN A VPN is an all-or-nothing access. The wastewater plant operator has many resources internally, not all of them are required, or suitable, for Water Control to remotely operate. Some of the RTU are sensitive and yet not segmented. See “[VPN Alternative](https://www.agilicus.com/what-we-do/vpn-alternative/)” for more detail. ![Secure and Managed Industrial Remote Access Solution by Agilicus: Visualize your industrial network architecture with secure remote access for OT devices, enhancing productivity and reducing downtime through centralized management and granular access control.](https://www.agilicus.com/www/2ad266ce-05.svg) ### Overlapping IP All wastewater plants use private IP (RFC 1918) address internally. A VPN would require routing rules, and, would pervent Water Control from managing multiple customers concurrently. It would be impractical to change the subnets on Water Control’s laptops for each customer they connect to. ![Agilicus Managed Industrial Remote Access: Securely connect and manage remote industrial equipment with Agilicus. Visualize network architecture with remote access points.](https://www.agilicus.com/www/b3e38117-06.svg) ### SSL Certificate Twilio Water Control has chosen to partner with Twilio owing to their tight integration to VTScada. Twilio requires inbound public hostname access via SSL, and, that the name match the properly issued certificate. See “[VTScada Twilio Alerts](https://www.agilicus.com/infosheet/zero-trust-vtscada-twilio-alerts/)” for more detail. The Solution --- ## Agilicus AnyX: Zero Trust Enables Remote Operations and Asset Management Agilicus AnyX introduces a Zero Trust framework tailor-made for industrial control systems in public water utilities Zero Trust is the [best current practice](https://www.epa.gov/system/files/documents/2023-01/information_security_identification_and_authentication_procedure.pdf) for Cybersecurity in Industrial Control Systems for Public Water Infrastructure. It integrates effortlessly with existing networks and offers an affordable and low- risk method to enhance both efficiency and security. Whether you already have deployed an [IEC-62443 Zone and Conduit](https://www.agilicus.com/white-papers/zero-trust-microsegmentation/) model, or are driven more by the [Purdue Model](https://www.agilicus.com/white-papers/piercing-the-purdue-model-zero-trust-in-operational-technology/), Agilicus provides a low-risk method to enhance both efficiency and security, providing an ideal platform for Zero Trust Remote Operations and Asset Management. [⌊multi-factor-authentication⌉⌊multi-factor-authentication⌉[ Better User Experience. Better Security --- ## Authentication Trust starts with identity. Instead of relying on shared passwords, Agilicus AnyX uses federated authentication, from existing identity providers (Microsoft Entra, Okta, Google Workplace, on-site Microsoft Active Directory, etc). This allows users like “jane@manufacturer.domain” to securely access the system without compromising security. [SEE VIDEO](https://www.youtube.com/watch?v=K8yC4a0uyOQ) [⌊authorisation⌉⌊authorisation⌉[ Full Access Control and Visibility --- ## Authorisation With Agilicus AnyX, system access isn’t binary. You can specify user roles at granular levels, ensuring that users only access what they are supposed to. Moreover, every action is logged for meticulous audit trails. Fine-grained authorisation is necessary for cybersecurity in Industrial Control Systems for Public Water Infrastructure. [CASE STUDY](https://www.agilicus.com/case-studies/critical-infrastructure-municipal-water-treatment/) [⌊access⌉⌊access⌉[ Invisible to the World --- ## Access Agilicus AnyX is designed for the modern world, offering seamless integration with existing firewalls. It uses an outbound-only connection, compatible with NAT systems and non-public IPs, ensuring any user can access any application without the need for a VPN, without inbound ports. [DATA FLOW](https://www.agilicus.com/anyx-guide/zero-trust-ssh-access/) The How --- ## Simple User, Simple Admin, Secure Data Flow One of the core learnings for Control Water Automation was that their customers also wanted remote access, an unexpected benefit of the new remote operations service. And, the customers required single-sign-on using existing credentials coupled with multi-factor authentication for their security compliance. In some cases, existing credentials meant Azure Active Directory or Google Workplace, but in others, it was an on-premise Active Directory: behind the firewall. Agilicus AnyX solves this seamlessly, allowing both types to act as modern OpenID Connect Single-Sign-On ( see [Merging Local Identity With Online Identity](https://www.agilicus.com/white-papers/merging-local-identity-with-online-identity/)) Using Group-Based and Role-Based authorisation means simple config for Control Water Automation: 1 step to add the user, and all rules flow automatically. Control Water Automation’s customers demanded that there be no inbound port-forward, no DMZ. The Agilicus AnyX Connector, with its outbound-only data flow, all on port 443 to a fixed IP, and inspectible by a next-generation firewall gave the customers the comfort they needed to deploy. ![wastewater-remote-operations-and-asset-management](https://www.agilicus.com/www/ 4047a159-wastewater-remote-operations-and-asset-management.svg) From an end-user perspective (whether Control Water Automation’s team, or, each of their customer’s teams), the system proved very simple to use. All devices, regardless of operating-system or form-factor, support a browser, the only tool they need for the HMI access (VNC, Ignition, VTScada). For Control Water Automation’s team, they use their familiar PLC programming software. No VPN, no worry about overlapping IP, they can work on two customers simultaneously from the same laptop. For the single-sign-on, each user uses their existing, native, corporate credentials. Typically this means no sign in is needed, even for the users with the on-premise Active Directory: it behaves similarly to signing into Office 365. Use Cases: Zero Trust Remote Operations and Asset Management ## Real-World Applications of Agilicus AnyX For Public Water Systems [⌊Green Check⌉⌊Green Check⌉[ ### Remote HMI Access Technicians can access HMI remotely, leading to quicker repairs and lesser downtimes. [⌊Green Check⌉⌊Green Check⌉[ ### Shared Diagnostics Share the SCADA workstation between vendor and customer, in real time. No client to install, open the browser and see the shared session. [⌊Green Check⌉⌊Green Check⌉[ ### Unified Authentication Single-sign-on, no shared passwords, for manufacturer, integrator, and operator, each with their natural credentials. [⌊Green Check⌉⌊Green Check⌉[ ### Remote PLC Program Technicians can remotely use e.g. [Rockwell studio 5000](https://www.agilicus.com/example/sample-rockwell-studio-5000/) to diagnose tags, update firmware. [⌊Green Check⌉⌊Green Check⌉[ ### Real-time Log Files Performance metrics, diagnostic logs, asset inventory. Reach a Share deep inside the plant in a safe fashion, from anywhere. [⌊Green Check⌉⌊Green Check⌉[ ### Remote Alarms Twilio SMS alarms, SMTP email alarms, both with no inbound port-forward through firewall The Conclusion --- ## Profitable, Differentiated Service By integrating Agilicus AnyX into their remote operations service, Control Water Automation achieved these objectives: 1. Increased profit. Subscription based high-margin service with value-based pricing 2. Stronger business scaling due to predictable staffing, lower cost due to higher utilisation 3. Increased differentiation. Adding end-customer authentication and access proved both popular and unique as well as complex for competitors to replicate 4. Lower staff complexity. No overlapping IP to reconfigure. no multiple VPN to install. Simple web-based, no client allowed on-the-go via tablet or phone access as needed 5. Pre-packaged service provided easier to train sales staff on, and be simpler to market and sell Control Water Automation’s customer’s achieved their objectives: 1. Decreased mean-time-to-repair. No truck and scheduling time. 2. Increasd security and compliance. Single-sign-on, multi-factor, no shared passwords, no concern over previous staff remaining with access 3. Aligned interest with Control Water Automation: rather than time & materials pricing, both parties are now incented to maximum uptime, minimum interactions Zero Trust Remote Operations and Asset Management proved to be non zero-sum: all parties win, all parties profit. BOOK A MEETING Ready To Learn More? Agilicus AnyX Zero Trust enables any user, on any device, secure connectivity to any resource they need—without a client or VPN. Whether that resource is a web application, a programmable logic controller, or a building management system, Agilicus can secure it with multi-factor authentication while keeping the user experience simple with single sign-on. [BOOK A MEETING](https://www.agilicus.com/book-calendar-meeting/) ![Agilicus AnyX platform logo, horizontal orientation.](https://www.agilicus.com/ www/9f758437-agilicus-logo-horizonta.svg) info@agilicus.com, +1 ‪519 953-4332‬ 300-87 King St W, Kitchener, ON, Canada. N2G 1A7 [⌊partner⌉⌊partner⌉[