Secure Remote Access to Industrial Sites: Beyond VPN with Zero-Trust Network Access

Industrial sites already operate as part of a larger digital system. Dispatchers, service teams, integrators, and contractors need stable remote access to control systems and telemetry. This speeds up repairs and reduces downtime, but it makes remote access a critical security point.

City growth increases the cost of mistakes in infrastructure. The more systems depend on power grids, water, transport, oil and gas, and manufacturing, the more important it is to protect OT and ICS because they directly affect physical processes.

That is why remote access should exist only where needed and without bypassing security or reliability requirements. This is where a classic VPN often becomes a weak point, ZTNA offers a more controlled and safer approach for industrial environments.

Problem and challenge

OT systems used to run in isolation, today they depend more and more on standard IT technologies, corporate networks, and remote access. This reduces natural isolation and brings part of IT risk into environments that control physical processes.

Industrial cyber intelligence shows that weak remote access remains a common problem. Typical issues include default passwords, unpatched VPNs, exposed RDP sessions, weak contractor access control, and incomplete visibility into all connections to OT networks.

At the same time, the scale of attacks on industry keeps growing. Reports show high ransomware activity, long attacker dwell time, and active use of remote services, credentials, and vulnerabilities as initial access vectors.

This is especially critical for energy and manufacturing because remote access is necessary for operations, but it is also a recurring entry point for attacks. That is why remote access security can no longer be treated as a secondary technical issue.

Below is a compact visualization of how these factors overlap on industrial sites.

Why VPN no longer fits industrial conditions

A VPN encrypts traffic and provides a tunnel into the network, but the classic model often relies on broad trust after login. A user gets access to many resources at once, this increases the risk of lateral movement after a compromise.

In industrial environments, this is especially dangerous because remote access must be tightly limited and should not bypass technology barriers. In practice, VPN gateways often become risk concentration points that open a path to a large part of the network.

Another problem is vulnerabilities in remote access gateways themselves. Public catalogs of exploited vulnerabilities regularly include VPN and gateway products, this confirms the risk is systemic at the perimeter.

For OT, channel encryption is not enough. You also need control over what happens after connection. Without proper access control, patching, and vulnerability management, remote access becomes a convenient entry point for an attack.

Below is a simplified diagram that shows why VPN creates an overly broad trust perimeter.

ZTNA in the Zero Trust model

Zero Trust is an approach where trust is never granted automatically and is checked continuously. This matters a lot in industrial environments where remote sites, contractors, and service teams are a normal part of operations.

ZTNA is a practical way to apply this approach to remote access. Unlike VPN, which often connects the user to the network first, ZTNA blocks access by default and opens only the specific resource allowed by policy.

The key advantage of ZTNA is context-based access decisions. The system can use user role, device state, time, location, and risk signals. Access can be allowed, denied, or revoked during the session.

In Zero Trust architecture terms, this matches a model with separate policy decisions and policy enforcement. For industrial sites, this gives what teams need in practice. Least privilege access, controlled entry points, and managed sessions instead of broad network access.

The table below shows how these principles translate into practical actions for an OT remote support scenario.

Architecture and technical block

Starting principles for OT

Remote access design for industrial environments should be based on core OT security rules.

Remote access must be justified, limited, and must not bypass technology or security controls.

Interaction between the corporate level and the process control level should pass through services in the DMZ. These services must be protected and monitored so unnoticed movement into OT is prevented.

Segmentation must be real. In practice, hidden links between IT and OT and flat networks still exist, this makes attacker movement easier.

Even well-configured remote access needs regular vulnerability management and updates, otherwise it becomes a separate risk channel.

Target remote access architecture based on ZTNA

Below is a recommended reference structure. It reflects the idea that a user does not enter the OT network as a space. The user requests a specific resource through controlled points, access policies make a decision each time a session is created.

The recommended model is built so the user does not get access to the whole OT network. The user reaches only a specific resource through controlled points, the access decision is made for each session.

In practice, the flow looks like this. An engineer or contractor works from a managed device. The request then passes through a ZTNA controller, an identity service, device posture checks, and security signals. After that, access is provided through a ZTNA connector or proxy in the industrial DMZ, then through a jump server with session recording and access logs, and only then to specific OT resources such as engineering workstations, operator workstations, or data services.

The key principle is that the connector and jump server are placed in the DMZ, not in the OT zone. This reduces the risk of direct entry into the process environment and gives a control point for logging and fast access shutdown.

Real experience from companies moving from VPN to Zero Trust access

The move from classic VPN to Zero Trust Network Access in real companies is usually not a simple tool replacement. It is part of a broader transformation where user identity, network segmentation, contractor access, device control, and OT operating rules change at the same time. This follows the Zero Trust model where protection is built around specific resources, users, and sessions, not around a static perimeter.

Below are a few strong examples that show the practical value of this approach for industrial sites.

Siemens

Siemens is one of the most visible examples of large-scale Zero Trust adoption across offices and factories. Public case materials describe a company scale of 320,000 users in 190 countries and 120 factories, along with a shift from a firewall and VPN model to Zero Trust for users, applications, and machines.

Reported outcomes include fast rollout of secure remote access for a very large user base, lower environment and management costs, faster M and A integration, and simpler segmentation across office and production environments.

For OT, this matters because access starts being built around resources and policies, not around broad network tunnels.

Coats Group

Coats Group describes its move to Zero Trust as part of a broader manufacturing digital transformation. The scope includes both IT and OT systems, production sites, R and D locations, contractors, and a global access model for 17,000 employees.

The practical value of this example is that the company treats remote access as part of one production and digital operating model, not as a separate office tool. This reflects the current reality in industrial companies where OT access is already tightly connected to digital transformation.

Implementation outcomes

The move from VPN to ZTNA in industrial environments should be judged by practical results, not by promises.

• Smaller trust zone. Instead of broad network access, the user goes through controlled points, proxies, and policies. Even if a contractor account is compromised, it does not automatically grant access to the whole network.

• Better third-party access control. In industrial environments, contractors are often the weak point. ZTNA brings these connections into one managed system with policies, logs, and session control.

• Faster incident response. When access is centralized, the security team can terminate specific sessions or limit specific access types without shutting down the whole network.

• A more controlled perimeter. The need for updates and patching does not disappear, but the architecture becomes more resilient because one vulnerability at an access point does not open a path to the entire internal network.

Conclusions

The move to secure remote access beyond VPN should start with simple steps that produce measurable results.

First, map all remote access channels and record the owner, purpose, and allowed usage time for each one. Then choose one scenario and implement it through ZTNA with a DMZ connector, a jump server, and session recording.

Next, define access policies for specific resources, not entire network segments. Add rules based on user role and device posture. Separately define procedures for quickly restricting or terminating sessions during an incident.

When remote access is implemented as a managed service with least privilege, logging, time limits, and zone isolation, the organization gets more stable operations and a smaller attack surface.