# VPNs in Industrial Environments: Old Yeller

- Link: https://www.agilicus.com/vpns-in-industrial-environments-old-yeller/
- Published: 2024-02-03T02:21:12+00:00
- Author: Don Bowman

[⌊Agilicus VPN: Secure Remote Access to Industrial Control Systems. Old Yeller VPN
architecture provides robust security for OT environments, enabling remote monitoring,
maintenance, and control while minimizing cybersecurity risks. Learn about VPNs 
in industrial environments.⌉⌊Agilicus VPN: Secure Remote Access to Industrial Control
Systems. Old Yeller VPN architecture provides robust security for OT environments,
enabling remote monitoring, maintenance, and control while minimizing cybersecurity
risks. Learn about VPNs in industrial environments.⌉[

Industrial environments, with their complex machinery and interconnected systems,
rely heavily on remote support for troubleshooting and maintenance. VPNs, often 
touted for their secure tunnel access, seem like a natural fit. But before diving
in, consider the potential risks: **VPNs, while convenient, are never the safest
option for industrial remote support.** VPNs in Industrial Environments: Old Yeller.
It was a faithful friend for years, and now its time to shoot it before it bites
you.

Its a harsh metaphor, but this old friend has bitten the hand that feeds it more
than once. See [VPN Alternative](https://www.agilicus.com/what-we-do/vpn-alternative/)
and step on the right path today.

[⌊4a5c9ef2-image⌉⌊4a5c9ef2-image⌉[

## The Colonial Pipeline Fiasco: A Stark Reminder

Remember the 2021 Colonial Pipeline shutdown, crippling fuel supply across the Eastern
US? The culprit? A **compromised VPN account**. Hackers exploited a vulnerability
in the VPN software, gaining access to critical systems and wreaking havoc. This
incident serves as a stark reminder of the vulnerabilities inherent in using VPNs
for industrial control systems (ICS).

### Beyond The Colonial Pipeline: Common VPN Risks in Industrial Settings

The Colonial Pipeline attack wasn’t an isolated event. Here’s why relying solely
on VPNs for industrial remote support can be risky:

 * **Increased Attack Surface:** VPNs create a **single point of entry** into your
   network, making it a prime target for hackers. Exploiting a vulnerability in 
   the VPN server grants access to everything within the tunnel.
 * **Unsecured Protocols:** Many industrial protocols lack built-in security, making
   them vulnerable within a VPN tunnel. Hackers can leverage these weaknesses to
   manipulate systems or steal data.
 * **Limited Visibility:** VPNs often provide poor visibility into user activity,
   making it difficult to detect suspicious behavior or unauthorised access.
 * **Human Error:** Accidental misconfigurations or weak user credentials can easily
   compromise VPN security, leaving your systems exposed.

## The Ivanti VPN Flaw: A Case for Secure Alternatives

The recent disclosure of a critical vulnerability in the Ivanti Pulse Connect Secure
VPN software further highlights the risks. This flaw could allow attackers to bypass
authentication and gain unauthorised access to networks. While patched versions 
are available, it underscores the need for **alternative solutions** for industrial
remote support.

### **Exploring Safer Options for Industrial Remote Support**

Several secure alternatives offer better protection for industrial environments:

 * Single Sign On, strong authentication. Use the same web-based authentication 
   you use for your other business systems like email. This helps reduce the risk
   of phishing due to the familiar experience. It also facilitates modern multi-
   factor such as WebAuthN and Passkey
 * Zero Trust. Don’t create a ‘remote road to the world’, create a narrow pipe to
   the one resource the user needs, with fine-grained authorisation and audit. Principle
   of least privilege.
 * Outbound only. Don’t show up on [Shodan.io](https://www.shodan.io/)

### The Verdict: The VPN’s Time Is Like Old Yeller

VPNs remain valuable tools for secure remote access in many contexts. However, for
industrial environments where security is paramount, they should be not be used.
Use Zero Trust coupled with Defense In Depth segmentation. Remember, **secure remote
support is not a one-size-fits-all solution**. Evaluate your specific needs and 
risks to choose the best approach for your industrial environment.

Stay vigilant, stay informed, and stay secure!