By Ian Gracias | Omni Quantum AI Ltd
15 November 2026 | Cybersecurity Engineering / OT Security
Remote access is essential to modern industrial operations, but it can also introduce significant cybersecurity exposure.
Manufacturers, equipment suppliers, engineers and maintenance contractors frequently require remote connectivity to diagnose faults, maintain systems and provide specialist support.
The engineering challenge is not simply to identify remote access software and disable it. It is to understand which access paths exist, why they are required, how they are protected and what would happen if they were removed.
During development of the Sierra Einstein security assessment toolchain, I examined this challenge through a dedicated Secure Remote Access Auditor.
Why Remote Access Requires a Risk-Based Approach
In conventional IT environments, a security engineer might recommend closing an unnecessary network port or disabling an unused service.
In OT environments, the same decision can have wider operational consequences.
A remote access service might support a manufacturer's maintenance contract, an engineering workstation or an essential diagnostic function.
Removing it without consulting operational personnel could interrupt maintenance or delay fault recovery.
The correct approach is therefore to assess both cybersecurity exposure and operational dependency.
A Practical Sierra Einstein Assessment
Sierra Einstein Tool 7 evaluates remote administration exposure and produces a structured report describing observed conditions, potential risks, operational consequences and recommended actions.
A local assessment conducted on 25 July 2026 identified four reportable conditions:
Condition
Exposure points
AnyDesk remote access
15
SMB file-sharing surface
10
Account lockout protection
8
OpenSSH administration
8
The resulting exposure score was 41/100, classified as MEDIUM by the tool's scoring model.
The report did not identify evidence of active compromise.
Importantly, this does not prove the system was uncompromised. It means the assessment did not detect evidence of compromise within its defined scope and available data.
Understanding the Findings
AnyDesk
Remote desktop products provide useful technical support capabilities, but they can also create remote-control paths into a system.
An appropriate assessment should establish whether the installation is authorised, whether unattended access is necessary, and whether authentication, access restrictions and logging are sufficient.
SMB
Server Message Block supports Windows file sharing and related services.
Its presence does not automatically mean a vulnerability exists. However, unnecessary exposure, permissive shares and weak authentication controls can increase risk.
A sensible recommendation is to review network reachability, access permissions and signing requirements before disabling functionality.
Account lockout protection
Authentication controls help reduce exposure to repeated password-guessing attempts.
An effective policy must balance resistance to automated attacks against the possibility of locking out legitimate engineering personnel.
OpenSSH
SSH can provide secure remote administration when correctly configured.
Its security depends on appropriate authentication, restricted access, account management, logging and maintenance.
A detected SSH service should therefore trigger a configuration review, not an automatic assumption of compromise.
From Findings to Engineering Decisions
One important feature of the Sierra Einstein report is that it considers the operational impact of changing a service.
For example, disabling SSH might reduce a remote administration path, but it could also prevent authorised command-line maintenance and file transfers.
This is why security remediation should follow a controlled process:
Confirm the observed condition.
Establish the business or engineering purpose.
Assess the associated cybersecurity exposure.
Determine the operational impact of remediation.
Obtain appropriate authorisation.
Implement changes within approved maintenance procedures.
Verify the resulting security state.
This approach is particularly relevant where availability and safety are critical.
Evidence Integrity and Reporting
Technical findings must be supported by trustworthy evidence.
A professional assessment should retain the source of each observation, the assessment date, the affected host or system, the methodology and the resulting recommendations.
Sierra Einstein's reporting architecture is designed to consolidate assessment outputs and preserve references to originating evidence.
However, consolidated reporting must also communicate its limitations. A report generated from incomplete source data cannot support conclusions about systems that were never assessed.
The distinction between observed evidence, inferred risk and verified compromise is fundamental to credible cybersecurity engineering.
Lessons Learned
The Sierra Einstein development work reinforced three important principles.
First, the presence of a remote access service is not equivalent to proof of malicious activity.
Second, security recommendations must consider operational dependencies, particularly in industrial environments.
Third, an assessment is only as trustworthy as its collection methods, evidence and clearly stated scope.
These principles apply beyond OT. They are relevant to enterprise security architecture, privileged access management, third-party access and advanced cybersecurity risk management.
Conclusion
Secure remote access assessment is not simply a matter of finding open ports or installed software.
It is an exercise in security engineering, risk evaluation and operational decision-making.
By combining technical observations with evidence, remediation guidance and operational impact, cybersecurity teams can make better-informed decisions without introducing unnecessary disruption.
References: NIST SP 800-82 Rev. 3; NIST Cybersecurity Framework 2.0; ISA/IEC 62443; Sierra Einstein Tool 7 assessment report, 25 July 2026.
Copyright © 2026 Ian Gracias / Omni Quantum AI Ltd.
