0 Consider Community Get entry to (ZTNA) is a safe faraway get entry to carrier that verifies faraway customers and grants get entry to handiest to express assets at particular instances in accordance with identification and context insurance policies. This is a part 2 in our ZTNA weblog collection for operational environments. Learn the primary weblog right here.

At this time, someplace on the planet a robotic arm wishes a firmware improve, a wind turbine is stalled, and a freeway message signal is exhibiting gibberish. If your enterprise is determined by operational generation (OT) or commercial regulate methods (ICS), you wish to have to permit system developers, repairs contractors, or your personal mavens and technicians to remotely get entry to apparatus for configuration, troubleshooting, and updates.

Shrink the danger with ZTNA

In our closing weblog we gave a ten,000-foot view of Cisco Protected Apparatus Get entry to (SEA) and the way it can lend a hand to safe faraway get entry to in your commercial community. Cisco SEA is a 0 Consider Community Get entry to (ZTNA) resolution controlling who can attach, which OT belongings they are able to get entry to, and when. It begins with a default deny posture and provides least-privilege get entry to handiest as soon as it trusts the person identification.

Clientless and agent-based ZTNA

Along with proscribing get entry to to express belongings and schedules, Cisco SEA too can prohibit the get entry to way faraway technicians can use to log into an OT asset. If they’re the usage of RDP, VNC, SSH, Telnet, or HTTP(S), they just want a internet browser—no shopper instrument is wanted. Cisco SEA proxies all faraway get entry to site visitors, which means that customers by no means have direct IP get entry to to the asset or the community. Utterly keeping apart essential assets offers you unrivaled safety.

In some eventualities, you could want a complete IP verbal exchange trail between the faraway person and an OT asset. Examples are if technicians are the usage of a vendor-specific control instrument, enhancing a PLC program the usage of a local desktop utility, or moving information to and from an asset. To deal with those complicated use circumstances, Cisco SEA gives an agent-based ZTNA get entry to way referred to as SEA Plus.

SEA Plus installs a light-weight utility at the faraway person’s pc to create a safe end-to-end IP reference to the OT asset, enabling any TCP, UDP, and ICMP communications. Alternatively, in contrast to the community extension presented through a VPN resolution, site visitors at all times is going in the course of the SEA accept as true with dealer, which enforces safety insurance policies reminiscent of which belongings will also be accessed, when, and which protocols and ports can be utilized.

Total, SEA Plus supplies local IP get entry to to operational generation from faraway computer systems, however with out the wish to design, deploy, and handle a VPN infrastructure. It additionally strengthens and simplifies safety with extremely granular controls tightly proscribing get entry to to OT belongings as required through the ZTNA least-privilege concept.

Take ZTNA to the following degree with automatic security-posture assessments

Regulate over the who, what, how, and when of faraway get entry to is a big step towards tough coverage of your commercial community and significant infrastructure. But if the usage of SEA Plus, you’re granting complete IP get entry to to an asset. How are you able to ensure the person’s pc won’t reveal the asset to malware or malicious site visitors? To realize complete accept as true with, you wish to have to ensure the software the technician is the usage of to log in.

Just right information: Cisco SEA and Cisco Duo paintings in combination to routinely test software well being sooner than granting get entry to to an asset. When a faraway person tries to determine a consultation the usage of the SEA Plus get entry to way, Duo verifies that the person’s pc complies together with your safety insurance policies—for instance, working gadget model and patch degree, firewall standing, use of antivirus instrument, and extra. If a tool does now not meet your necessities, the technician can not achieve get entry to.

More potent safety with much less effort

Summing up: As a hybrid-cloud resolution, Cisco SEA avoids the prices and complexity to handle safe faraway get entry to functions at scale throughout your commercial community and significant infrastructure. As a ZTNA resolution, it allows you to take regulate again through imposing least-privilege safety insurance policies in accordance with identification and context. And with the combination between SEA and Duo, you’ll additionally test the protection posture of faraway computer systems—any other key facet of 0 accept as true with.

Test again quickly for our subsequent ZTNA weblog, to be told how Cisco Protected Apparatus Get entry to help you observe faraway get entry to periods for regulatory compliance, investigating incidents, or coaching functions.

Within the interim, you should definitely subscribe to our OT Safety publication, be told extra about Cisco Protected Apparatus Get entry to (SEA), and take a look at our Cisco Validated Design Information for help on easy methods to put in force ZTNA for your operational surroundings.

Proportion: