The vendor’s remote-access box nobody inventoried

Every machine that arrives on a plant floor arrives with a way for its builder to reach it. A press, a moulding machine, a printer, a palletiser: each is a complete product, and the company that built it expects to support it from a distance. So a small box goes into the cabinet. It might be a cellular modem with the antenna taped inside the door, a VPN appliance on the DIN rail, or an agent on the HMI that calls out to the builder’s cloud. It is there for the first weeks of commissioning, when faults are frequent and the builder’s engineer is a phone call and a remote session away.

Then the project closes. The commissioning engineer goes home, the punch list is signed off, and the box stays, because nobody was asked to remove it and removing it would mean losing support. On most sites of this kind that remote-support link is still live years later, still reachable from outside, and still absent from any list the plant holds of what is on its network.

Why it is not on the drawing

The network drawing, where one exists, was produced by the plant or its integrator and shows the plant’s own equipment: the switches, the servers, the controllers the plant specified. The machine builder’s remote link is not the plant’s equipment. It is part of the machine, delivered inside the machine’s cabinet, powered from the machine’s supply and documented, if at all, in the machine’s own manual. The plant bought a press, not a modem.

The contract tends to reinforce this. Remote support is written into the service agreement as a service the builder provides, not as a device the plant hosts. The procurement file says “remote diagnostics included”; it does not say that a device with its own address, its own credentials and its own route to the internet now lives on the plant network. Nobody on the plant side is wrong about this. The boundary between the builder’s product and the plant’s network was never drawn, so it was never drawn on anything.

There is a second effect once several builders have delivered several machines. Each brings its own box, and on a flat network each box reaches all of the machines, not only the one it came with. In plastics and packaging, where the floor is a federation of vendor networks, the usual pattern is one such link per machine builder. In general manufacturing the same thing happens line by line, with the integrator’s link beside the builders’.

The plant bought a press. The modem came with it, and nobody wrote the modem down.

Finding it without touching production

The box cannot be found by asking the network to identify itself. An active scan sends packets to every address and waits for replies, and some controllers answer an unexpected packet by stopping, which is not a risk worth taking on a running line. There is a second difficulty: a scan only reaches what the scanner can route to, and a cellular modem in a cabinet has a route out that the plant network cannot see from the inside.

What works is three things done together, none of which changes anything. The first is a passive capture at the plant’s switches. A remote-access appliance has to talk to be useful: it keeps a tunnel open to the builder’s service, it checks in on a schedule, it carries sessions when an engineer connects. That traffic has a shape. An address on the machine network that holds a long-lived encrypted connection to somewhere outside the plant, or that looks up a hostname belonging to a machine builder, is a strong signal even when the device itself has no label.

The second is a walk-down of the cabinets with the doors open and a torch. A modem has an antenna. A VPN appliance has a logo and a status light. A cloud agent on an HMI appears in the installed software, or as a tray icon the operator has learnt to ignore. Walking the cabinets takes an afternoon on a mid-sized floor, and it finds the devices that stayed silent during the capture because nobody happened to connect that week.

The third is paper. The service contracts and the commissioning handover pack for each machine say what remote support was agreed, and sometimes name the device. Reading them beside the capture and the walk-down closes the gap in both directions: a link in the contract with no device found is a question for the builder, and a device found with no contract behind it is a question for the plant.

Put together, the three give a list the plant can hold: each remote link, the machine it belongs to, the builder who uses it, the path it takes out, and whether it was talking during the capture. That list is the beginning of an asset inventory, not the end of one, but it is the part most plants are missing.

Sample

What good looks like afterwards

The answer is rarely to remove the link. The builder’s remote support is worth having, and a plant that cuts it off will find the engineer on a plane instead of on a session, at the plant’s expense. The answer is to keep the support and change its shape, in three ways.

Brokered: the builder connects to a point the plant controls, not to the machine directly. That point sits in the industrial DMZ, Level 3.5 in the Purdue model, and from there a session is opened inward to the one machine that needs it. The modem in the cabinet goes, or is disabled, because the route out now belongs to the plant. ISA/IEC 62443-3-2 treats this as a conduit between zones, with the remote path placed deliberately rather than wherever the builder’s box happened to land.

Time-boxed: the session exists when someone on site opens it, for the duration of the work, and closes afterwards. A standing tunnel that is live at three in the morning in case the builder needs it is the thing that made the box a way in. A request, an approval and an end time replace it, and the plant’s maintenance team becomes the people who say yes.

Logged: the plant can say, for any day, which builder connected to which machine, when, and for how long. This is the part that matters most to a plant manager, because it turns the remote link from something that happens to the plant into something the plant did. NIST SP 800-82 Rev. 3 takes the same view of remote access in its architecture section: one controlled path, a decision for each use and a record of it.

ISA/IEC 62443-3-2 · zones, conduits and risk assessment

NIST SP 800-82 Rev. 3 · section 5, OT security architecture

A standing tunnel that is live at three in the morning in case the builder needs it is the thing that made the box a way in.

None of this requires new software in the network between the builder and the machine, and none of it is done in the first week. In the Range method, the passive capture, the walk-down and the contract review come first, the list goes to the plant in writing, and nothing in a cabinet is changed until the plant has authorised it and a named person is standing beside the work. The order matters. You cannot broker a link you do not know you have, which is why the method starts by listening.

Sources · ISA/IEC 62443-3-2 (zones and conduits); ISA/IEC 62443-2-4 (requirements for service providers); NIST SP 800-82 Rev. 3, section 5.