Remote and Vendor Access (RA)

Remote and Vendor Access (RA), The Estate deck, Critical Infrastructure Threat Taxonomy: control-panel artwork showing a vendor's tunnel through the site fence.

Taxonomies › Critical Infrastructure › RA · Remote and Vendor Access

Every way in from outside: VPNs, remote desktop tools, vendor tunnels, modems and exposed interfaces. Part of The Estate deck, ranked Ace to 2 by severity in the game. This page is part of the Critical Infrastructure (Cyberwarfare) Threat Taxonomy, the reference for the Black Start card game.

RA Remote and Vendor Access taxonomy table, 13 entries: BKS-RA-A Control panels on the internet; BKS-RA-K Edge appliances are the front door; BKS-RA-Q Vendor tunnels are always open; BKS-RA-J Remote sessions land on the controls; BKS-RA-10 Remote access is all or nothing; BKS-RA-9 Cellular modems bypass the perimeter; BKS-RA-8 Single-factor remote access; BKS-RA-7 Ad hoc desktop-sharing tools; BKS-RA-6 Sessions nobody approves or records; BKS-RA-5 Leavers and subcontractors keep access; BKS-RA-4 Break-glass weaker than the front door; BKS-RA-3 OT can call out to anywhere; BKS-RA-2 Access granted once, kept forever. Each row gives the threat, any public case, the mitigation principle and the design measures.

Mappings at a glance

STRIDE, CAPEC 3.9, CWE 5.0, ATT&CK for ICS v20.0, the Cyber-Informed Engineering principles (main one first) and standards, entry by entry. The same mappings are in each entry below and in the Excel, SKOS and STIX downloads.

RA Remote and Vendor Access mapping table, 13 entries: BKS-RA-A Control panels on the internet; BKS-RA-K Edge appliances are the front door; BKS-RA-Q Vendor tunnels are always open; BKS-RA-J Remote sessions land on the controls; BKS-RA-10 Remote access is all or nothing; BKS-RA-9 Cellular modems bypass the perimeter; BKS-RA-8 Single-factor remote access; BKS-RA-7 Ad hoc desktop-sharing tools; BKS-RA-6 Sessions nobody approves or records; BKS-RA-5 Leavers and subcontractors keep access; BKS-RA-4 Break-glass weaker than the front door; BKS-RA-3 OT can call out to anywhere; BKS-RA-2 Access granted once, kept forever. Each row gives the STRIDE categories, CAPEC patterns, CWE weaknesses, ATT&CK for ICS techniques, Cyber-Informed Engineering principles and standards for the entry.

Entries

BKS-RA-A · Control panels on the internet †

Controller web panels, site managers and HMIs are reachable directly from the internet so engineers and vendors can reach them from anywhere. Anyone who finds the address meets only a login page, or nothing, between them and the physical process.

Case: Bremanger dam, Norway, 2025; Unitronics PLCs at water utilities, 2023; Supermarket refrigeration attacks, 2026.

Principle. No control interface is directly reachable from the internet.

Design measures.

  1. Place every control interface behind brokered remote access, and verify from outside that none answers.
  2. Scan your own address ranges continuously, and use exposure-search services to find what others can see.
  3. Make suppliers declare and justify any internet path into a site before installation.

Mappings: STRIDE S, E · CAPEC-115 · CWE-306 · ATT&CK for ICS T0883, T0819 · CIE 3, 4, 8

BKS-RA-K · Edge appliances are the front door

The VPN concentrators, firewalls and remote access gateways that guard control networks are themselves internet-facing devices, often unpatched and unmonitored. They are the first thing a patient adversary compromises, and access through them looks like normal remote working.

Case: Volt Typhoon pre-positioning, 2024 advisory; Danish energy sector, 2023.

Principle. The devices that guard remote access are maintained and watched as closely as the systems they protect.

Design measures.

  1. Patch internet-facing edge devices on an emergency timetable, and replace any the vendor no longer supports.
  2. Send edge device logs to monitoring that is independent of the device itself.
  3. Plan for edge compromise: remote access lands in a broker zone, never directly on the control network.

Mappings: STRIDE S, E · CAPEC-555 · CWE-1104, CWE-1329 · ATT&CK for ICS T0819, T0866 · CIE 5, 6, 8

BKS-RA-Q · Vendor tunnels are always open †

Vendors keep a permanent VPN or tunnel into the site, live day and night whether or not any work is scheduled. A compromise of the vendor, or of one of its engineers, becomes standing entry to every customer site that tunnel reaches.

Case: Ukraine grid attack, 2015.

Principle. Remote access exists only for approved work, for as long as the work lasts.

Design measures.

  1. Keep vendor access disabled by default and enable it per job, with the site operator’s approval.
  2. Expire every remote session automatically after a set time.
  3. Terminate vendor connections in a broker you control, not on equipment the vendor manages.

Mappings: STRIDE S, E · CAPEC-555 · CWE-923 · ATT&CK for ICS T0822, T0886 · CIE 3, 9

BKS-RA-J · Remote sessions land on the controls †

A remote user lands on an HMI or engineering workstation with full operating authority, able to open breakers, change dosing or rewrite logic, when the job only needed to read a log. Whoever holds the session can drive the process as if sitting in the control room.

Case: Ukraine grid attack, 2015.

Principle. Remote access is scoped to the task, and operating authority from outside is the exception.

Design measures.

  1. Broker remote sessions through a jump host that grants read-only access unless operating rights are approved.
  2. Require a local operator to watch, and be able to end, any remote session with operating rights.
  3. Block remote use of the most hazardous operations entirely; they need someone on site.

Mappings: STRIDE E, T · CAPEC-122 · CWE-250, CWE-1220 · ATT&CK for ICS T0886, T0823 · CIE 3, 2, 1

BKS-RA-10 · Remote access is all or nothing

Once a remote user is connected, they can reach every device on the site with full rights, whatever the job. A technician sent to read a fault log could rewrite logic or change setpoints, and so can anyone who takes over their session or account.

Principle. Remote access is scoped to the task: the devices, the functions and the time the job needs, and no more.

Design measures.

  1. Grant remote sessions per job, limited to named devices and a time window, through a broker that enforces it.
  2. Offer a read-only mode for diagnostics, and require a second approval to move to write access.
  3. Block engineering protocols and download functions in remote sessions unless the job requires them.

Mappings: STRIDE E · CWE-250 · ATT&CK for ICS T0822, T0859 · CIE 3, 2

BKS-RA-9 · Cellular modems bypass the perimeter

A vendor fits a 4G router in the cabinet so it can reach its equipment without the operator’s network team. The site now has a path into the control network that the firewall, monitoring and remote access policy never see.

Principle. Every path into a control network is known, approved and monitored.

Design measures.

  1. Prohibit independent connectivity in supply contracts, and survey cabinets for cellular and radio modems.
  2. Route any approved cellular link through the same brokered access and monitoring as wired links.
  3. Watch for unexpected wireless devices and new routes from control networks.

Mappings: STRIDE S, E · CAPEC-616 · CWE-420 · ATT&CK for ICS T0883, T0822 · CIE 8, 3

BKS-RA-8 · Single-factor remote access

Remote access to control networks relies on a password alone, or on a second factor that can be phished, pushed until accepted, or reset by a help desk on request. Stolen or guessed credentials are all an adversary needs.

Case: Marks & Spencer and Co-op, 2025.

Principle. Remote access to control systems requires strong, phishing-resistant authentication.

Design measures.

  1. Require phishing-resistant multi-factor authentication for every remote route into control networks.
  2. Make resets of remote access credentials need verification through an independent channel.
  3. Alert on remote logins from new locations, devices or hours.

Mappings: STRIDE S · CAPEC-560, CAPEC-600 · CWE-308, CWE-654 · ATT&CK for ICS T0859, T0822 · CIE 3, 12

BKS-RA-7 · Ad hoc desktop-sharing tools †

Staff and vendors install desktop-sharing tools on HMIs and workstations to get help quickly, set for unattended access. Nobody manages them centrally, they reach out through the firewall, and their credentials live in personal accounts.

Principle. Only approved, centrally managed remote access tools run on control systems.

Design measures.

  1. Allow-list remote access software on control workstations and remove everything else.
  2. Block outbound connections from control networks to remote-access services you have not approved.
  3. Check control workstations regularly for remote-access tools and unattended-access settings.

Mappings: STRIDE S, E · CAPEC-555 · CWE-420, CWE-1188 · ATT&CK for ICS T0822, T0886 · CIE 8, 12

BKS-RA-6 · Sessions nobody approves or records

Remote sessions start without the site operator knowing and leave no recording of what was done. During an incident, nobody can tell a vendor’s routine maintenance from an adversary, and afterwards nobody can prove what changed.

Principle. Every remote session is approved, visible while it runs and recorded.

Design measures.

  1. Require approval from the site operator before a remote session starts.
  2. Show active remote sessions on the operator’s screen, with a way to end them.
  3. Record sessions with operating rights and keep the recordings outside the vendor’s reach.

Mappings: STRIDE R · CAPEC-268 · CWE-778 · ATT&CK for ICS T0886 · CIE 6, 12

BKS-RA-5 · Leavers and subcontractors keep access

Vendor staff turn over and work is subcontracted again and again, but remote accounts are not tied to named people or reviewed. Former engineers, and the firms they move to, still hold working access years later.

Principle. Remote access belongs to named, current people, and is removed when they leave or the contract ends.

Design measures.

  1. Require vendors to tell you about leavers, and suspend accounts not used for a set period.
  2. Review every remote account against a named, current person at least quarterly.
  3. Put subcontractor access in the contract chain, with the same rules as the prime supplier.

Mappings: STRIDE S, E · CAPEC-560 · ATT&CK for ICS T0859 · CIE 9, 12

BKS-RA-4 · Break-glass weaker than the front door

An emergency path exists for when normal remote access fails: a shared local administrator, an old dial-up modem, a spare account in an envelope. It bypasses the controls on the main path, so an adversary uses it, or in a real crisis it does not work.

Principle. Emergency access is as strong as normal access, and is tested and monitored.

Design measures.

  1. Inventory every emergency access path and remove the ones that are not needed.
  2. Protect break-glass accounts with strong credentials, alerting on every use, and review after each use.
  3. Test emergency access in exercises so it works when the main path is down.

Mappings: STRIDE S, E · CAPEC-115 · CWE-288 · ATT&CK for ICS T0859 · CIE 10, 3

BKS-RA-3 · OT can call out to anywhere

Control networks allow outbound connections to the internet for updates, telemetry and remote tools. Implants and ad hoc remote tools reach their operators through ordinary web traffic, and data leaves without anyone noticing, because nobody defined where OT is allowed to talk.

Principle. Outbound traffic from control networks is denied by default and allowed only to named destinations for named purposes.

Design measures.

  1. Deny outbound internet access from control networks and allow only listed destinations through a proxy.
  2. Alert on any new outbound destination, protocol or volume from OT hosts.
  3. Bring vendor updates and telemetry through a controlled relay in a DMZ rather than direct connections.

Mappings: STRIDE I, E · CWE-923 · ATT&CK for ICS T0885, T0869 · CIE 3, 6

BKS-RA-2 · Access granted once, kept forever

Firewall rules and accounts opened for one commissioning job or emergency are never closed. Over the years remote access grows broader than any current task needs, and nobody can say why each path exists.

Principle. Every remote access rule has an owner, a purpose and an end date.

Design measures.

  1. Give every firewall rule and remote account an owner, a reason and an expiry date.
  2. Remove rules and accounts automatically at expiry unless the owner renews them.
  3. Review remote access paths against current maintenance needs every year.

Mappings: STRIDE E · CAPEC-180 · CWE-272 · CIE 4, 8

Public cases cited in this suit

  • Bremanger dam, Norway, 2025. In April 2025 an attacker reached the control system of a dam at Bremanger, Norway, and set the outflow valve to open; it ran for about four hours before staff noticed and reversed it. Attribution: Attributed by Norway’s security service (PST) to pro-Russian hackers. Sources: BleepingComputer: pro-Russian hackers blamed for dam sabotage in Norway
  • Unitronics PLCs at water utilities, 2023. From November 2023 attackers defaced internet-exposed Unitronics PLCs at the Municipal Water Authority of Aliquippa and other US sites, getting in with the default password; the Aliquippa booster station was run by hand. Attribution: Attributed by CISA, FBI and partners to CyberAv3ngers, affiliated with Iran’s IRGC. Sources: Industrial Cyber: US, Israeli agencies warn of IRGC activity using OT devices; The Register: Iran-linked attacks on US water
  • Supermarket refrigeration attacks, 2026. Overnight on 11 to 12 October 2026 attackers forced the remote-managed refrigeration controllers of hundreds of French supermarkets into defrost, heating cabinets to as much as 50C; stock was destroyed and some equipment caught fire. CERT-FR told operators to disconnect the controllers or tightly filter access to them. A second wave on 2 November hit supermarkets and food businesses in Sweden, Belgium, Ireland, Luxembourg, Estonia and Italy, and five Danish companies, where the attacks were stopped quickly. Danfoss confirmed its products were involved, and France’s cyber agency judged the campaign probably still under way. Attribution: Unattributed at time of writing; Paris prosecutor’s investigation open. Sources: The Hacker News: attackers heat French supermarket fridges; BleepingComputer: cyberattack shuts down refrigerators at French supermarkets; DR: what we know about the attacks on European supermarkets; Today.it: attacks on refrigeration in Italy, ACN alert
  • Volt Typhoon pre-positioning, 2024 advisory. A February 2024 joint advisory found PRC state-sponsored actors inside the IT networks of US communications, energy, transport and water organisations, holding access, in some cases for at least five years, to disrupt operational technology in a crisis or conflict. Attribution: Attributed by CISA, NSA and FBI to PRC state-sponsored actors. Sources: CISA advisory AA24-038A
  • Danish energy sector, 2023. In May 2023 attackers compromised 22 Danish energy companies in coordinated waves through flaws in the firewalls that protected them, the largest such attack Denmark had seen. Attribution: Unattributed; SektorCERT saw indicators linked to Sandworm in at least one attack, which other researchers later questioned. Sources: SecurityWeek: 22 energy firms hacked in Denmark; SecurityWeek: Russian hackers likely not involved
  • Ukraine grid attack, 2015. On 23 December 2015 attackers used three Ukrainian distribution companies’ own control systems to open breakers, cutting power to about 225,000 customers. They also overwrote firmware on serial-to-Ethernet converters, wiped systems with KillDisk, tampered with backup power and flooded call centres with calls. Attribution: Attributed by the US Department of Justice (2020 indictment) to Russia’s GRU Unit 74455 (Sandworm). Sources: CISA ICS alert IR-ALERT-H-16-056-01; MITRE ATT&CK campaign C0028
  • Marks & Spencer and Co-op, 2025. In April 2025 attackers who had talked IT help desk staff into resetting passwords disrupted Marks & Spencer, which paused online orders for 46 days and had gaps on its food shelves; Co-op UK was hit at the same time. Attribution: No official attribution; reported as linked to Scattered Spider. Sources: Ground News: attackers duped IT help desks; Reuters via StreetInsider: after 46-day pause M&S resumes online orders

© 2026 Jonathan Brett Crawley. Licensed under CC BY-NC-ND 4.0 with additional permissions: see the licence on the overview. † marks a physical-safety consequence.