Secure Connectivity for Multi-Site Manufacturing

Site-To-Site Network Connectivity

When manufacturing organizations have multiple locations that need to be connected to one another, such as corporate headquarters connecting to production plants, a VPN is a common solution. VPNs were once the go-to remote access solution but prove to be an insufficient foundation for secure remote access in today’s landscape.

In some circumstances, the network may not allow for a VPN to be used. In order to use a VPN, a publicly accessible IP address must be in place, and that is not always available. Use of satellite/cellular internet is a limiting factor as a VPN requires both inbound and outbound traffic to encrypt data packets bi-directionally, meaning they cannot support a VPN. insurance, industry, or stakeholders may also require inbound traffic to the organization to be disabled for additional security. And in some regions of the world, the use of VPNs are inhibited. For example, In China, the use of VPNs are banned without government approval, which creates remote access issues for manufacturers with a site located in regions of the world where a VPN connection is banned.

With productivity being tied to network connectivity, any downtime in your network impacts your production floor output. Dual WAN redundant connectivity keeps your manufacturing floor operating, and keeps Mean-Time-To-Repair low in the event of network outage. With dual WAN redundancy, separate challenges arise. Learn more below:

• High Availability Dual WAN Remote Industrial Connectivity
• Multiple Connections Inbound Access Challenge
• We Have Two Internets… and That’s a Problem?
• https://www.youtube.com/watch?v=IN-8YSc6Lnw
• Dual/Backup Internet/WAN

Perimiter Level Security

A VPN is designed to create an encrypted connection between two networks for site-to-site connectivity, giving bilateral access to all resources on the shared network creating mutual risk between the two sites. This bilateral access was the root cause of the Colonial Pipeline breach. An inherent flaw with VPN technology is that it does not allow for granular access to resources or permission level access, creating an all-or-nothing environment. Once a user has provided their credentials and the VPN is turned on, they are authorized to access the network in its entirety with no segmentation, access levels or concept of who can access what. Granular access embodies the principle of least privilege – precisely defining and limiting what each user can access – down to specific resources and actions. In 2023, The “CyberAv3ngers” group engaged in targeting Unitronics PLC controllers which were often found in the water and wastewater industries. With no resource segmentation in place, the attackers were able to access the PLC/HMI, which still used the default password of ‘1111’. The attacks caused organizations to halt operations due to loss of availability of the HMI/PLC. Resource segmentation could have directly prevented these attackers from accessing resources. 

While VPNs provide encryption at the tunnel level, their inherent architectural limitations leave organizations vulnerable to modern threats that are mitigated by essential security features including multi-factor authentication, single sign-on, password stuffing, and granular access control, reinforcing the need for a comprehensive security strategy for remote access.

Multiple Identities / Corporations

Multi-site manufacturing locations often use different identity providers across multiple sites.For example, a user at site 1 would have credentials user@site1.com and a user at site 2 would have user@site2.com. Another example is when corporate employees may have a user@corp.site1.com account to separate divisions, or job functions. Not only are the domains different across sites, but they could also be using different identity providers altogether (Microsoft, Google, Azure, etc). Managing multiple domains and identity providers becomes increasing complex over time as an organization grows, especially when access is required to shared resources.

Who has multiple identities?

When accessing shared resources across sites, users are not able to utilize their existing identity provider for single sign-on, even on systems where it is natively supported as the login credentials are spread over multiple domains / identity providers. A common workaround for this is to create new identities for all users. This creates:

• Increased support tickets: Multiple accounts per user creates complexity resulting in unnecessary support tickets for password resets, account authorization, or using the incorrect account for login.
• Additional cost: Creating new users results in additional licensing costs, and depending on your organization, provisioning a new user may require a complete user license. 
• User management: Creating new user accounts results in additional management of credentials. Provisioning, and deactivating users now needs to be done in multiple locations. 

In some cases, organizations will opt to create shared team accounts to access resources, such as marketing@site1.com or Tier2support@site1.com. Creating shared accounts to log in to resources that need to be accessed remotely by other sites creates risk for cyber breaches through:

• Leaked passwords: Shared accounts often have the user credentials shared in a way that is easily accessible by users (post-it notes, shared docs, shared via messaging app).
• Lack of granular access: All users who have access to the login credentials can access at the highest level of authorization that needs to be granted
• No Multi-Factor Authentication: Utilizing shared credentials often results in disabling MFA or using refractor services to send codes to multiple devices, defeating the purpose of utilizing MFA as a security measure

Single Sign-on enables organizations to provision users, vendors, contractors, third-party support, etc  with their existing credentials, regardless of their identity provider (Microsoft, Google, Azure, etc), eliminating the need to create new users on the active directory and burdening the cost of additional licenses. When creating user credentials on the active directory for third-party access, organizations often create a single account for a vendor to use. The credentials for this account are then shared with the team to have remote access to the resources they need. However, there is a lack of control for how passwords are stored (printed out, shared sheets, post-it notes, etc), no insight into when certain employees should no longer have access – resulting in the password staying the same, and not having insight to who is actually accessing critical systems. Single Sign-On is a security feature that eliminates the use of shared passwords while reducing licensing costs on the active directory, a key security feature missing from VPNs

Cross-Site Support

The manufacturing industry is changing. Industrial control systems which were once made up of switches and buttons, are now network connected, requiring a specialized workforce to program, operate, maintain, and repair. Organizations often turn to contract based third party employees, or a specialized user that manages multiple sites. Having specialized users as a part of a workforce with remote access to all sites, allows organizations to handle these tasks efficiently. Accessing multiple sites with a VPN comes with inherent limitations:

Solution – Agilicus AnyX

Utilizing a Zero Trust Architecture enables your organization to establish secure remote access to remotely support shared resources across multiple manufacturing locations. With AnyX, your users located across multiple locations can log in to resources with Single Sign-On and Multi-Factor Authentication using their existing identity, even when not natively supported. Where a VPN allows full access to a network, AnyX enables organizations to implement a least-privilege access approach to shared resources. Least-privilege access ensures that shared resources and industrial control systems can only be accessed by the users that need it, with read write access, and for what required time frame.

Agilicus AnyX is an identity aware proxy, ensuring only authorized users (by validating with identity provider and multi-factor authentication) have access to the resources they should and at what permission level. The Agilicus connector is hosted on-site with no additional footprint, enabling a seamless connection to the shared resource, regardless of network configuration.

Conclusion

As manufacturing companies grow and expand their operations across multiple facilities, the need to access shared resources increases. Industrial control systems that were once manually operated with switches, buttons, and levers are now operated through HMI, PLC, SCADA interfaces which are network connected. With the growing requirements of remote access for industrial control systems, and the increasing risks of today’s threat landscape, Agilicus AnyX, a Zero Trust platform is no longer just an option for remote access; it is the only effective solution to keep your shared resources protected for multi-site connectivity, across multiple corporate identities and cross-user support within sites. 

When multiple manufacturing sites differ in identity provider, teams, and/or geographical location VPNs and other traditional access methods are no longer able to provide simple and secure remote access to your internal teams and third-party contractors. Lateral traversal, shared accounts, connecting/disconnecting between sites, and client installs create security and operational efficiency gaps that are remedied by adopting a Zero Trust platform.

AnyX solves these gaps by segmenting resources with least-privilege access, enabling multi-factor authentication and every resource – even if not natively supported,  facilitating access directly through a web browser, requiring zero hardware or network configurations, and being the only platform to allow single sign-on across unlike identities.