11 reasons why CIOs should not allow VPN access into OT network
By: Vikas Arya
Tags: Smart Buildings, Digital Transformation, Iot Security, IoT, VPN

I just came back from conference where I got the opportunity to speak to many CIOs and Cyber Security leaders from REIT (Real Estate Investment Trust) space. Everyone agreed that managing vendor access into BMS network is a pain point and security is a big issue. CIOs want visibility and tighter control on who accesses their BMS network. We all have heard horror stories such as how hackers broke-in via HVAC company at Target.

VPN is one of the most widely used tool underneath remote access applications such as GoToMyPC, LogMeIn, VNC Server etc for providing access into the building network but there was a debate whether VPN provides enough visibility and control required for securing OT network. Vendor access into BMS/IIoT network is key for maintaining, updating firmware and software, troubleshooting and fixing issues, accessing data for analytics, tracking and optimizing usage of BMS/IIoT network.

Out of all the methods of provide access to vendors and contractors, VPN has been considered to be the safest method by many IT/OT teams. VPNs were great a decade ago but not anymore. Many public hacks have shown VPNs to be source of compromising the network. Here are 11 reasons why VPN are not as safe as they sound:

External Security Threats:

1Inviting external users into VPNs makes host network vulnerable to credential theft and lateral movement. How would you protect your VPN network from lost or stolen password, compromised accounts, reused passwords on hacked websites?

2Poorly configured VPNs credentials are known to invite malicious users and compromising the network. In the famous “Ashley Madison” hack, when interviewer asked hacker group known as The Impact Team about the security, the hackers told interviewer “Bad. Nobody was watching. No security. Only thing was segmented network. You could use Pass1234 from the internet to VPN to root on all servers.”

Malicious Insider Threat

3 VPNs alone do not prevent malicious insiders who might try snoop around once they are inside the network. They further require additional expensive security systems to control the access of the users.

4 VPNs provide secure connectivity over the public network, but they do not provide visibility into what activities vendors and third-party contractors are doing in the network.

5 VPNs do not limit vendors to their own BMS or IIoT device unless separate access control is implemented. Additional software and hardware investment is required to limit the access. Considering Building teams don’t have expertise, they have to depend on IT teams for configuring and managing on a continuous basis.

Management challenges

6 Enforcing your organization IT security policies on vendor’s computer is almost impossible and rarely implemented, this makes your OT and IT network susceptible to all the vulnerabilities that your vendor’s machine has. You cannot enforce security measures such as phishing link detection, anti-virus and other security measures on vendor’s and third-party contractor’s workstation. Connecting them into your network via VPN is risky and malwares can easily spread to OT/IT network from infected machines.

7 Dependency on IT teams for all OT remote access: Building Management teams usually don’t have IT/Security expert to maintain VPNs along with other safeguards and avoid any misconfiguration. They usually depend on IT and Security teams to configure VPNs as new vendors are invited/disinvited.

8 VPNs are management nightmare for IT teams as BMS network scales to multiple buildings and large number of IIoT devices. It is quite common scenario where vendor’s VPN access aren’t removed even after BMS/IIoT devices were decommissioned (eg. building was sold). In such scenarios, though VPN access is no longer required for those BMS vendors, but the configuration is stays active. Over the time, VPN configurations become a mess and it becomes really hard to figure out who has the access in the network and who isn’t.

9 Extending Two factor authentication for VPN access to vendors and contractors is expensive and usually not done.

10 When vendors are provided with VPN credentials, these credentials usually remain active for long time, this allows vendors to come and go in the building network without any tracking or control, thus exposing building network to credential compromise and lateral movement.

11 Vendors need to install VPN client on their machine, which is not always possible or convenient. Version control and running supported versions across vendors becomes painful over the time.

So, even though inviting vendors to access BMS through VPN seems like a safest bet, it is actually risky and may put OT and IT network at risk.