<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: auditing-ics-remote-access
description: >-
  Audit and secure remote access pathways into ICS/SCADA environments including
  VPN configurations, jump servers, vendor remote sessions, and serial-to-IP
  gateways to prevent unauthorized OT network entry.
domain: cybersecurity
subdomain: ot-ics-security
tags:
  - remote-access
  - ics
  - vpn
  - jump-server
  - scada
  - audit
  - ot-security
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T0886", "T0822", "T0812"]
  nist-csf: ["PR.AC-3", "PR.AC-5"]
  iec-62443: ["SR 1.13", "SR 2.6"]
  uuid: a1b2c3d4-1001-4000-a001-000000000005
---

# Auditing ICS Remote Access

## Overview

Remote access is the most exploited entry point into ICS environments. Vendor
maintenance connections, poorly segmented VPNs, exposed RDP/VNC to HMI stations,
and legacy serial-to-IP converters create pathways that bypass segmentation.
Auditing requires mapping all remote access methods and validating controls.

Mode: `[MODE: BLUE]` for audit; `[MODE: RED]` for access pathway testing.

## Prerequisites

| Requirement | Details |
|---|---|
| Network architecture diagrams with remote access points identified | Required |
| Firewall rule exports from IT/OT boundary firewalls | Required |
| VPN concentrator configurations and user lists | Required |
| Jump server / bastion host access logs | Required |
| Vendor remote access agreements and approved methods | Required |
| Port scan results for VNC, RDP, SSH, Telnet on OT segments | Required |

## Key Concepts

### Remote Access Discovery

```bash
nmap -Pn -sT -p 22,23,3389,5900,4840,8080,8443 --max-rate 10 -oA ot_remote 10.10.0.0/16
nmap -Pn -sT -p 5900-5910 --script vnc-info 10.10.0.0/24
nmap -Pn -sT -p 4001,4002,9100 10.10.0.0/24  # serial-to-IP gateways
nmap -Pn -sT -p 5938,7070 10.10.0.0/24  # TeamViewer/AnyDesk
```

### VPN Configuration Audit

```bash
ssh admin@fw-ot 'show vpn-sessiondb anyconnect' > vpn_sessions.txt
ssh admin@fw-ot 'show running-config tunnel-group' | grep -A5 "split-tunnel"
ssh admin@fw-ot 'show aaa-server' | grep -i "radius\|ldap\|duo"
```

### Jump Server Audit

```bash
grep -E "Accepted|Failed" /var/log/auth.log | awk '{print $1,$2,$3,$9,$11}' | sort | uniq -c | sort -rn
journalctl -u teleport --since "7 days ago" | grep "session.start" | wc -l
```

### Vendor Access Controls

```bash
grep -i "vendor\|contractor" vpn_users.txt
curl -s -k "https://secomea-gw.local/api/agents" -H "Authorization: Bearer $TOKEN" | \
  jq '.[] | {name, status, last_connected}'
```

## Workflow

### Step 1: Scope and Discovery

```bash
python3 auditing_ics_remote_access_scope.py --inventory ics_assets.json --output scope.yaml
```

### Step 2: Execute Assessment

```bash
python3 auditing_ics_remote_access_execute.py --scope scope.yaml --output results/
```

### Step 3: Analyze and Report

```bash
python3 auditing_ics_remote_access_report.py --results results/ --output report.json
```

## Verification

- [ ] All remote access pathways documented
- [ ] VPN split-tunnel disabled for OT
- [ ] MFA enforced on all remote access
- [ ] Jump server required for OT sessions
- [ ] Session recording enabled
- [ ] Vendor access time-limited
- [ ] No unauthorized remote tools on OT
- [ ] Firewall prevents direct OT access

## Detection Opportunities

- VPN from unusual geolocations → compromised creds
- Direct RDP/VNC bypassing bastion → backdoor
- Vendor VPN outside windows → unauthorized
- TeamViewer/AnyDesk on OT → shadow IT
- Serial gateway from unexpected sources → abuse

```yaml
title: Auditing Ics Remote Access Detection
id: 0b6bf21a-7aa2-4b9c-930d-1a93e853fff6
status: experimental
description: Detects suspicious activity related to auditing ics remote access techniques in ot ics security context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*auditing*ics*"
  condition: selection
level: medium
tags:
  - attack.t0886
  - attack.t0822
  - attack.t0812
  - attack.lateral_movement
falsepositives:
  - Industrial control system maintenance by authorized engineering staff
```

## References

- NIST SP 800-82 Rev 3 — Section 5.4
- IEC 62443-3-3 SR 1.13: Remote Access
- CISA Remote Access Guidance for OT
- TSA SD-Pipeline-2021-02
