Privileged remote access for operational technology (OT)/internet of things (IOT)/industrial IOT (IIOT)/industrial control system (ICS) infrastructure
Systems and methods for privileged remote access to Operational Technology (OT)/Internet of Things (IOT)/Industrial IOT (IIOT)/Industrial Control System (ICS) infrastructure, implemented in a cloud-based system. The method includes steps of, responsive to determining a user can access an application associated with the OT/IOT/IIOT/ICS infrastructure, determining the users security and access policies and creating a session for the user; establishing a secure connection to the application via a lightweight connector connected to the application; and brokering a connection between the users device and the application through the lightweight connector, enabling the user to interact with the application for the OT/IOT/IIOT/ICS infrastructure, based on the user's security and access policies.
1 . A method of privileged remote access to Operational Technology (OT)Internet of Things (IOT)/Industrial IOT (IIOT)Industrial Control System (ICS) infrastructure, implemented in a cloud-based system, the method comprising steps of:
responsive to determining a user can access a specific application associated with the OT/IOT/IIOT/ICS infrastructure, determining a user's security and access policies and creating a session for the user;
establishing a secure connection to the application via a lightweight connector associated with the specific application; and
brokering a connection between a user's device and the application through the lightweight connector, enabling the user to interact with the application for the OT/IOT/IIOT/ICS infrastructure, based on the user's security and access policies, wherein the connection only provides access to the specific application allowed by a central authority and does not place the user's device on a network associated with the application, wherein the central authority maintains, independent of any user session, mutually authenticated persistent control-plane connections with each of a plurality of cloud-based enforcement nodes distributed across a cloud service wherein the persistent control-plane connections are used to distribute tenant-specific access policies and certificate-based tokens to the enforcement nodes in real time, and wherein each enforcement node distinct from the user's device and distinct from the lightweight connector, brokers and enforces secure access control for individual user sessions to the specific application by terminating a first secure session from the user's device at the enforcement node and establishing, based on at least one of the tenant-specific access policies or the certificate-based tokens, a second secure session from the enforcement node toward the lightweight connector.
2 . The method of claim 1 , wherein the steps further include
providing a privileged remote access portal for the user to enter credentials, the access portal is configured to control user traffic.
3 . The method of claim 2 , wherein the user's device accesses the access portal via one of a web browser and an application on the user's device, and wherein the access portal forwards user traffic to a closest edge, the closest edge comprising one of the enforcement nodes and acting as a broker to terminate the user session and enforce the user's security and access policies for the specific application.
4 . The method of claim 1 , wherein the session is one of Remote Desktop Protocol (RDP), Secure Shell (SSH), and Virtual Network Computing (VNC).
5 . The method of claim 1 , wherein the steps further include
utilizing browser isolation to provide physical separation between the user and the application through the cloud-based system.
6 . The method of claim 1 , wherein the lightweight connector is one of a virtual machine and a docker container hosted in the OT/IOT/IIOT/ICS infrastructure.
7 . The method of claim 1 , wherein the lightweight connector only accepts connections to the cloud-based system.
8 . The method of claim 1 , wherein the steps further include
performing browser isolation to the user's device to prevent physical access such that only pixels, keystrokes, and mouse commands are transmitted between the user's device and the cloud-based system.
9 . A non-transitory computer-readable medium comprising instructions for privileged remote access to Operational Technology (OT)/Internet of Things (IOT)/Industrial IOT (IIOT)Industrial Control System (ICS) infrastructure, the instructions are executable by a cloud-based system to perform steps of:
responsive to determining a user can access a specific application associated with the OT/IOT/IIOT/ICS infrastructure, determining a user's security and access policies and creating a session for the user;
establishing a secure connection to the application via a lightweight connector associated with the specific application; and
brokering a connection between a user's device and the application through the lightweight connector, enabling the user to interact with the application for the OT/IOT/IIOT/ICS infrastructure, based on the user's security and access policies, wherein the connection only provides access to the specific application allowed by a central authority and does not place the user's device on a network associated with the application, wherein the central authority maintains-independent of any user session, mutually authenticated persistent control-plane connections with each of a plurality of cloud-based enforcement nodes distributed across a cloud service, wherein the persistent control-plane connections are used to distribute tenant-specific access policies and certificate-based tokens to the enforcement nodes in real time, and wherein each enforcement node, distinct from the user's device and distinct from the lightweight connector, brokers and enforces secure access control for user sessions to the specific application by terminating a first secure session from the user's device at the enforcement node and establishing, based on at least one of the tenant-specific access policies or the certificate-based tokens, a second secure session from the enforcement node toward the lightweight connector.
10 . The non-transitory computer-readable medium of claim 9 , wherein the steps further include
providing an access portal for the user to enter credentials.
11 . The non-transitory computer-readable medium of claim 10 , wherein the session is one of Remote Desktop Protocol (RDP) and Secure Shell (SSH).
12 . The non-transitory computer-readable medium of claim 10 , wherein the session is terminated at the lightweight connector and converted to HyperText Markup Language to the cloud-based system and the user's device.
13 . The non-transitory computer-readable medium of claim 9 , wherein the steps further include
performing browser isolation to the user's device such that only pixels, keystrokes, and mouse commands are transmitted between the user's device and the cloud-based system.
14 . The method of claim 1 , further comprising selecting, by the cloud-based system, one of the plurality of cloud-based enforcement nodes as a closest enforcement node to the user's device based on a location of the user's device, wherein the first secure session is established between the user's device and the closest enforcement node.
15 . The method of claim 1 , further comprising operating a privileged remote access portal that receives user credentials via a web browser and, responsive to authentication, displays only consoles corresponding to applications authorized for the user by the tenant-specific access policies.
16 . The method of claim 1 , wherein the lightweight connector is deployed in the OT/IOT/IIOT/ICS infrastructure as a virtual machine or as a Docker container and is configured to initiate an outbound-only connection to the cloud-based system without accepting inbound connections.
17 . The method of claim 1 , further comprising, responsive to the central authority determining the user is authorized for the specific application, providing connection information including at least one certificate-based token to the selected enforcement node and to the lightweight connector to stitch the first secure session and the second secure session for the user session.
18 . The method of claim 1 , wherein the second secure session between the enforcement node and the lightweight connector is established using end-to-end encryption based on a combination of a client-side certificate associated with the user's device and a server-side certificate associated with the lightweight connector.
19 . The method of claim 1 , wherein the cloud-based enforcement nodes broker the connection without participating in a key exchange for the end-to-end encryption and without having visibility into application data payloads transmitted between the user's device and the lightweight connector.
20 . The method of claim 1 , further comprising performing clientless remote access by proxying, through the enforcement node, an HTML5-capable browser session over a WebSocket over Transport Layer Security (TLS), wherein the user's device exchanges only pixels, keystrokes, and mouse commands with the cloud-based system for the user session.