OT Remote Access and Historian Compromise Playbook

When the remote access gateway or the data historian in an industrial network is compromised, the attacker sits on the two paths that join operational technology to the outside world, and every response action has to be weighed against safety and production. This playbook covers suspected or confirmed compromise of OT secure remote access platforms (jump hosts, remote access gateways, vendor access portals) and of plant data historians, including their DMZ replicas. It is vendor-neutral and draws on the joint secure connectivity principles for OT led by the UK NCSC, the CISA, FBI, EPA and DOE primary mitigations for OT, NIST SP 800-82 Rev. 3 and MITRE ATT&CK for ICS. It is written for OT security leads, control engineers, site managers and incident responders. Hardening before an incident is covered in Securing the OT remote access platform itself.

Key takeaways

Safety and operations decide first. Every containment step in OT needs the site's operations authority to confirm the process can run safely without the connection you are about to cut.
Isolation should follow a plan you wrote earlier. The NCSC led secure connectivity principles call for an isolation plan, tested and tied to business continuity, with critical one-way flows identified in advance.
Vendor and service identities are the core of the problem. Remote access platforms hold vendor accounts, shared engineering logins and stored credentials for controllers and HMIs; historians hold service accounts that read from control systems.
The historian is both a pivot and a data integrity question. It can be a route back into the control network, and tampered historical data can mislead operators, engineers and regulators.
Rebuild, do not clean. Recovery means new remote access infrastructure, new credentials and a historian restored from verified backups, reopened one vendor at a time.

What is at stake

NIST SP 800-82 Rev. 3 lists the data historian among control centre components linked to HMIs and engineering workstations, and lists multi-factor authentication for remote access among its defence-in-depth measures. In many plants a historian collects from the control network and replicates to a DMZ copy that business systems read. Remote access platforms sit in the same DMZ and broker sessions from engineers and vendors to assets in the control zones.

Component	Typical trust	What an attacker gains	ATT&CK for ICS
Remote access gateway or portal	Internet-facing or partner-facing, authenticates engineers and vendors	A legitimate-looking entry point into OT	T0822 External Remote Services, T0883 Internet Accessible Device
Jump host or session broker	Inside the OT DMZ, reaches HMIs, engineering workstations and controllers	Interactive sessions on control assets	T0886 Remote Services
Credential store in the platform	Holds passwords for HMIs, controllers, switches and vendor tools	Valid accounts that look like normal maintenance	T0859 Valid Accounts
Control-zone historian	Collects from controllers and SCADA servers using service accounts and industrial protocols	Process data, tag lists, network map, a foothold near controllers	T0811 Data from Information Repositories, T0802 Automated Collection
DMZ historian replica	Receives replication from the control zone, read by business users	Reverse path into the control zone if replication is two-way; data for business reports	T0866 Exploitation of Remote Services

How the compromise shows up

Signal	Where to look	Likely meaning
Remote session outside an approved maintenance window, or with no matching work order	Remote access platform session log, change and permit-to-work records	Stolen vendor or engineer credentials
Use of a break-glass or emergency account	Platform and directory logs	The NCSC principles treat any break-glass use as a highest-criticality SOC alarm
New connection targets, protocols or file transfers from the jump host	OT network monitoring, firewall logs between zones	Discovery and lateral movement into control zones
Historian service account logging on interactively, or from a new host	Domain controller or local security logs on historian servers	Credential reuse for pivoting
Connections initiated from the DMZ replica towards the control zone	Boundary firewall logs	Replication path abused in reverse
Gaps, flat lines or edits in historical data, or bulk tag exports	Historian audit trail, data quality checks	Tampering or collection
Vendor notifies you of a breach of their own remote support environment	Supplier communications	Third-party path compromise (ATT&CK Enterprise T1199 Trusted Relationship)

Triage questions

Is the physical process safe right now? Ask operations whether any setpoint, mode or alarm changed without a known reason. If so, the process safety and emergency procedures come before cyber response.
Which side of the boundary is affected? Internet-facing gateway only, the DMZ jump hosts and replica, or assets in the control zones.
Which identities were usable? List vendor accounts, shared engineering accounts, stored device credentials and historian service accounts the platform could reach.
Is the historian replication one-way? Hardware-enforced one-way flows (data diodes) limit the reverse path; software rules do not give the same assurance.
Which vendors depend on remote access this week? Planned outages, warranty support and safety system maintenance may need a physical visit instead.
Can the site run in manual or islanded mode, and for how long? This sets how hard you can isolate.

Containment by priority

The NCSC led principles describe three isolation strategies: full site isolation, application or service specific isolation (for example temporarily revoking one compromised third party's remote access), and site isolation that keeps hardware-enforced trusted flows such as telemetry or logs over data diodes. Choose before the incident; confirm with operations during it.

Agree the isolation level with the site. Record who authorised it and at what time. Operations must confirm safe running for each step.
Preserve evidence quickly. Capture memory and disk images of gateway and jump host servers where possible, export session recordings and logs, and copy historian audit trails before changes. Do not run active scans against controllers; use passive network capture.
Suspend remote access at the boundary. Disable the external listener or block it at the firewall, end active sessions, and suspend all vendor accounts. Where the platform supports just-in-time access, revoke standing grants.
Cut the historian reverse path. Block connections initiated from the DMZ replica towards the control zone. If one-way flows exist, keep them running for visibility, with extra checks that incoming values stay within expected ranges.
Restrict historian service accounts. Limit them to their known source and destination hosts, rather than disabling outright, if operators depend on live trends. Plan their rotation for the eradication window.
Move vendor support to site visits. The NCSC principles note that isolation plans may need to switch from remote support to a physical visit; supervise those visits and use clean, organisation-owned media.
Coordinate out of band. The Five Eyes joint advisory warns against communicating over the affected network and against preemptive credential resets before scoping.

The decision to isolate more widely is a business and safety decision. The Colonial Pipeline attack is the best-known case of OT operations being halted as a precaution after an IT-side intrusion that began with an unused VPN account.

Credential rotation order

Order	Credential	Action	OT-specific caution
1	Remote access platform administrators and break-glass accounts	Reset, re-enrol phishing-resistant MFA, remove unknown admins	Keep a sealed, tested break-glass path so the site is never locked out
2	Vendor and contractor accounts	Disable all; re-issue individually as each vendor is revalidated	Shared vendor accounts must become named accounts on return
3	Credentials stored in the platform for HMIs, engineering workstations, network devices	Change on the target device, then update the vault	Schedule changes on running assets with operations; some devices need an outage or a vendor to change
4	Historian service accounts and interface credentials	Create new accounts, update collectors and replication, then disable old ones	Collection gaps are acceptable if the process is safe; plan for backfill
5	Default or shared controller and device passwords exposed through the platform	Change to unique values; CISA's OT primary mitigations name default passwords as a common weakness	Test on a spare or in a maintenance window first
6	Platform certificates, SSH host keys and VPN pre-shared keys	Reissue and revoke	Field sites with cellular or VPN links may need a visit to update

See the OT and ICS Identity and Access Guide for how these identities should be governed after recovery.

Eradication and rebuild

Remote access platform: Build new gateways and jump hosts from verified media at current patch level. Re-create only the access rules that have a named owner and a current need. Do not restore a full platform backup that may carry the attacker's accounts or rules.
Jump hosts and engineering workstations reached through the platform: Reimage from known-good images. Check engineering workstations for altered project files before they connect to controllers again. See the Engineering Workstation Security Guide.
Controllers and HMIs: Compare running logic and configuration against offline known-good copies. Look for program downloads (ATT&CK for ICS T0843) and parameter changes (T0836) during the incident period. Involve the asset vendor for safety systems.
Historian: Rebuild servers, restore configuration from a verified backup, and decide how to treat data from the incident period: mark it as suspect, reconcile against controller or field records where possible, and document the decision for reporting and quality systems.
Replication design: If the incident used the replication path, move to strictly one-way replication from control zone to DMZ before reconnection.

The OT Backup, Recovery and Golden Image Guide covers keeping offline copies that make this rebuild possible.

Recovery and staged reconnection

Prove the site runs safely without remote access. CISA, FBI, EPA and DOE advise practising manual operation so a site can keep running while connectivity is restored.
Restore historian collection first, inside the control zone, then one-way replication to the DMZ, with data quality checks.
Reconnect internal engineers through the rebuilt platform with phishing-resistant MFA, session recording and least privilege per asset.
Reconnect vendors one at a time. Each must confirm their own environment is clean (ask for written confirmation where the incident came through them), receive named accounts, and use time-bound, approved sessions.
Rollback: If anomalies return, revert to the previous isolation level, not to the old platform. Keep site visits as the fallback support path.

Evidence to preserve

Remote access platform: Session logs and recordings, authentication logs, admin audit trail, access rule history, vault access history.
Jump hosts and workstations: Disk and memory images, logon events, files transferred, engineering project files with timestamps.
Historian: Audit trail, configuration, replication logs, a copy of data for the incident period before any correction.
Network: Passive packet captures and flow records from the OT DMZ and control zone boundaries.
Operational records: Operator logs, alarm journals, permits to work and maintenance tickets, which establish what was legitimate.

Record chain of custody for all images, as described in the Evidence Handling and Chain of Custody Guide.

Notification triggers

OT operators are often in regulated sectors. Under the EU NIS2 Directive, essential and important entities must send an early warning to their CSIRT or competent authority within 24 hours of becoming aware of a significant incident, followed by an incident notification within 72 hours. National rules in other jurisdictions and sector regulators (energy, water, transport) set their own deadlines, and safety regulators may need to know if process safety was affected. Customer and supply contracts may also require notice. Record the time you became aware, and involve legal and regulatory affairs from the first hour.

Detection and measurement

Time to suspend all remote access: from decision to every external session ended and vendor account disabled.
Isolation plan test date: months since each site's isolation plan was last exercised; target at least yearly.
Named account coverage: share of vendor and engineer remote access through named, MFA-protected accounts, target 100%.
Sessions with a work order: percentage of remote sessions matched to an approved change or permit.
Stored credential rotation: percentage of device credentials held by the platform rotated since the incident.
One-way replication: number of historian paths that allow connections initiated from the DMZ, target zero.

Framework mapping

Activity	NIST CSF 2.0	NIST SP 800-53 Rev. 5	ATT&CK for ICS
Triage with operations	RS.MA-02, RS.AN-03	IR-4, IR-5	T0822, T0886
Isolation and containment	RS.MI-01, RS.MA-01	IR-4, SC-7, AC-17	T0883, T0866
Credential rotation	PR.AA-01, PR.AA-03	IA-5, AC-2	T0859
Logic and data integrity checks	RS.MI-02	CM-2, CM-3	T0843, T0836, T0811
Recovery from verified backups	RC.RP-01, RC.RP-03	CP-9, CP-10	n/a
Monitoring and reporting	DE.CM-01	SI-4, AU-6, IR-6	n/a

For the OT programme view, map the same activities to IEC 62443 zone and conduit requirements; see the OT Network Segmentation, Purdue Model and IEC 62443 Zones and Conduits Guide.

Common failure patterns

Cutting connectivity without operations. A well-meant firewall change stops a historian feed that operators depend on, or blocks a safety vendor during a fault.
Dormant accounts left enabled. CISA, FBI, EPA and DOE ask operators to disable dormant accounts; the Colonial Pipeline intrusion began with an account that was no longer in use.
Trusting a vendor's tool after the vendor was breached. When a remote support supplier is compromised, as in a 2024 remote support vendor breach that forced a code signing certificate revocation, you need new client software, certificates and credentials, not only a password change.
Restoring the old platform backup. It brings back the attacker's accounts, rules and stored credentials.
Two-way historian replication. The DMZ copy becomes a bridge back into the control zone.
No written isolation plan. Decisions are improvised under pressure, and nobody knows which flows must stay up.

Practitioner checklist

Write and test a site isolation plan that names critical one-way flows and who can authorise each isolation level.
Inventory every remote access account, stored device credential and historian service account, with owners.
Replace shared vendor accounts with named, MFA-protected, time-bound access.
Keep offline copies of controller logic, HMI projects and historian configuration.
Make historian replication one-way from control zone to DMZ.
Alert on break-glass use, out-of-window sessions and DMZ-initiated connections into control zones.
Agree with each critical vendor how support works during an isolation, including site visits.
Exercise this playbook with operations, engineering and the SOC at least once a year.

If your OT remote access and historian is compromised: safe isolation, credential rotation and rebuild