PAM: controlled remote access for IT and OT, beyond the VPN

A supplier needs to update the software on a production line. A consultant has to work on a server. An administrator is travelling and needs to restart a service. Remote access is now an everyday need, in the office and on the factory floor. How it is granted, however, makes the difference between a routine operation and an attacker getting into the network.

The limits of the VPN as a remote access tool

The VPN was designed to extend the corporate network to people outside the premises. It does that well, and that is exactly the problem: once connected, the user is “inside the network” and, unless segmentation is very carefully designed, can reach far more than they need.

• Network-level access, not per resource: if an account or an external computer is compromised, the attacker inherits the same access.
• Shared or permanent credentials: generic vendor accounts, passwords known to many people and never changed.
• No visibility into what happens after connecting: you know someone logged in, not what they did.
• Unmanaged devices: an external technician’s computer may meet no security standard at all.
• Always-open access: the connection set up for maintenance a year ago is often still active.

The same applies to remote assistance tools installed independently by suppliers and maintenance staff. They are convenient, but they escape the control of IT and of the engineering department.

What PAM is

PAM (Privileged Access Management) is the set of technologies that governs privileged access, meaning access that allows changes to configurations, data and critical systems. Instead of opening a tunnel into the network, PAM places a control point between the person and the resource they need to reach.

Its main functions are:

• Credential vault: system passwords are kept in a digital safe and rotated automatically.
• Transparent credential injection: the user connects to the system without ever knowing the password.
• Strong authentication (MFA) for every person, including external ones, with individual identities instead of shared accounts.
• Just-in-time access: granted only for the time and the resource required, often with prior approval.
• Session recording, which can be replayed like a video and searched for commands and activity.
• Real-time control: a supervisor can watch the session and terminate it, or block dangerous commands.
• Controlled file transfer, with content inspection.

VPN and PAM compared

Aspect	VPN	PAM
Level of access	To the network	To the single resource and protocol
Credentials	Often known to the user	Held in the vault, never exposed
Duration	Permanent or broad	Time-limited, on request
Tracking	Connection logs	Full session recording
Control during the session	None	Real-time monitoring and termination
External vendors	Accounts to manage and protect	Dedicated identities and approvals

The benefits for the business

• Smaller attack surface: no broad network access, so far less room for lateral movement.
• Least privilege actually applied, per person, per system, per time window.
• Traceability and accountability: every action can be tied to a person, useful for audits, investigations and disputes with suppliers.
• Credential protection: a password nobody knows cannot be stolen, shared or left in a file.
• Orderly management of third parties: onboarding and offboarding consultants and maintenance staff become processes, not exceptions.
• Easier compliance: the evidence required by NIS2, ISO 27001 and IEC 62443 on access control and the supply chain comes from the system itself.

Applications in IT

• System and domain administrators: access to servers, network devices and directories with rotating credentials.
• Database administrators: access to sensitive data with recorded sessions.
• Cloud consoles and service accounts: management of keys and secrets used by applications and automation.
• Consultants and managed service providers: temporary, individual and verifiable access.
• Emergency access (“break-glass”): special credentials, used only when necessary and always tracked.

Applications in OT

In industrial plants the issue is even more delicate: a mistake or malicious access can stop production or have physical consequences. PAM is particularly well suited here, because it works with traditional remote access protocols (RDP, SSH, VNC and similar) without requiring changes to industrial systems, which are often old and cannot be updated.

• Remote maintenance by manufacturers and integrators: access to a single machine, for an agreed window, authorised by the plant manager.
• Engineering, SCADA and HMI workstations: reachable only through an intermediate server placed in a dedicated zone (industrial DMZ), never with a direct connection from outside.
• Alignment with IEC 62443: remote access crosses a controlled conduit and respects the separation between zones.
• Real-time oversight: plant staff can follow the supplier’s intervention and stop it if something looks wrong.
• Activity log: every change to a PLC or control system is documented, with date, person and commands.
• Secure file exchange: updates and projects go through a controlled area, not through USB sticks or direct copy.

How to introduce it without disrupting habits

1. Inventory privileged and remote access: who connects, to what, with which tool, including unauthorised remote assistance software.
2. Start with the highest risk: critical suppliers, domain administrators and plant systems.
3. Provide a single access point, in a DMZ for OT, and gradually close alternative paths.
4. Move credentials into the vault and enable rotation.
5. Define the authorisation process: who approves, for how long, in which hours.
6. Enable recording and alerts and connect the events to the SOC, to spot anomalous behaviour.
7. Involve your suppliers: explaining why the way of connecting is changing reduces resistance.

In short

The VPN remains useful for many purposes, but it is not the right tool for granting privileged access to non-employees or to critical systems. PAM moves control from the network to the person and the individual resource: temporary, tracked and supervised access, in IT and in OT, without slowing down the people who need to intervene.

If you want to understand how remote access is handled today in your company or plant, get in touch: we can start by mapping your existing access paths.