iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Secure remote access to a renewable-energy control system is a controlled, site-specific connection—not simply a VPN subscription or an open remote-desktop port. Keep control-system equipment off the public internet, place OT and remote-access components behind firewalls, isolate OT from business networks, authorize only necessary connections, use strong authentication with MFA where the equipment and identity workflow support it, and maintain and monitor every connected device.
The design must match the plant’s safety, reliability, and operational constraints. The steps below turn that principle into an implementation sequence that plant owners, operators, OT engineers, and security teams can review together.
What “secure remote access” means in an energy plant
Remote connectivity can be useful for alarm review, performance analysis, troubleshooting, firmware work, and vendor support. It also creates a path toward systems that can affect generation, protection, switching, or physical equipment. A secure design therefore controls four things at once:
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →- Exposure: control-system devices and communications equipment are not directly reachable from the public internet.
- Path: traffic crosses an approved, managed access path through defined network boundaries.
- Identity and authorization: the person, device, session, and permitted action are known before access is granted.
- Lifecycle: gateways, endpoints, accounts, radios, controllers, and software are patched, monitored, and reviewed.
CISA’s industrial-control guidance recommends minimizing exposure and putting control-system networks and remote devices behind firewalls, isolated from business networks. NIST describes VPN, TLS, and SSH as possible remote-access technologies, while warning that poorly managed remote technologies can become an exploitation channel. Those sources provide design principles, not a universally safe topology for every photovoltaic plant, wind farm, battery site, hydro facility, or hybrid site.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
“When remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available.” — CISA mitigation guidance in ICSA-22-090-06
Step 1: Map the access need before choosing technology
Start with the work that must be done remotely. Selecting a gateway first often produces excessive privileges, undocumented vendor paths, and exceptions that are difficult to remove.
Inventory the systems and communication paths
Build an inventory with the system owner and the people who operate the site. Include supervisory control and data acquisition servers, human-machine interfaces, engineering workstations, programmable or remote terminal controllers, protection and safety-related components, historians, gateways, cellular or radio links, serial-to-IP devices, and the remote-access infrastructure itself. Record which systems exchange data, which systems can issue commands, and which devices are reachable through each path.
List every category of remote user: plant operators, corporate operations staff, integrators, equipment vendors, maintenance contractors, and emergency responders. For each category, document the task, expected frequency, working hours, source location, and approval authority. A vendor who needs to inspect diagnostic data should not automatically receive the same reach as an engineer who must change a controller configuration.
Separate visibility from control and configuration
Classify remote actions before granting access:
- Read-only visibility: viewing alarms, trends, status, or reports.
- Operational control: starting, stopping, switching, curtailing, or changing set points.
- Engineering and configuration: downloading logic, changing parameters, updating firmware, or modifying network settings.
Use the narrowest class that completes the task. If a task can be completed by exporting data or reviewing a historian, do not expose a control workstation. If a change is necessary, require an explicit work order, named approver, time window, and rollback plan rather than leaving a standing account enabled.
Record safety, reliability, and vendor constraints
NIST’s OT guidance emphasizes that OT has distinctive performance, reliability, and safety requirements. Ask equipment vendors which authentication methods, operating systems, protocols, and maintenance modes are supported. Identify functions that must continue if the remote-access service fails, if a firewall reboots, or if an identity service is unavailable. Confirm whether a proposed control could delay a protection action, interrupt plant communications, or prevent a local operator from taking control.
Capture these constraints in the access design and change procedure. They are engineering requirements, not reasons to bypass segmentation or authentication.
Step 2: Remove direct exposure and separate networks
Keep control devices off the public internet
Do not publish PLCs, RTUs, HMIs, engineering stations, inverter controllers, protection devices, or radio-management interfaces with public addresses or internet-facing port forwards. Internet exposure makes discovery and exploitation possible before a legitimate user has been authenticated. CISA’s recommended practice is to minimize exposure and place control-system networks and remote devices behind firewalls.
Remove legacy inbound rules that were created for convenience. Replace “any source to any destination” access with explicitly documented flows. If a device is currently exposed, treat removal of exposure as a priority change: coordinate with operations, verify local control, back up configurations, and test the replacement path before disabling the old rule.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Define security zones and boundaries
Use the site’s actual equipment and operational relationships to define boundaries. A common design discussion separates an enterprise network, a service or intermediary zone, and one or more OT control zones, but the exact number and placement of zones depends on the facility. The important properties are:
- Business systems cannot freely initiate connections into control networks.
- Remote-access components are placed at a controlled boundary, not inside the most trusted control segment.
- Only documented protocols, addresses, and directions cross each firewall.
- Operations can continue safely when a boundary device or remote service is unavailable.
Have the OT and network teams document both allowed and denied flows. Include management traffic, time synchronization, logging, software updates, vendor support, and emergency procedures—not only the application traffic that first motivated remote access.
Protect remote devices and communications equipment
Laptops, vendor workstations, cellular gateways, microwave links, and industrial radios are part of the attack surface. A remote-access gateway does not make an unmaintained endpoint trustworthy. Place remote devices behind appropriate firewalls, restrict their management interfaces, remove unused services, and keep their software and firmware within the supported lifecycle.
Where a communications device bridges networks, treat its configuration and credentials as control-system security information. Do not assume that a device is harmless because it carries telemetry rather than command traffic; a compromised bridge can provide a route toward systems that do.
Step 3: Build a managed access path
Remote access should be an approved service with an owner, configuration standard, logging, and a removal process. It should not be an undocumented exception on a firewall or a personal tool installed by a contractor.
Understand the available protocol choices
NIST describes several technologies that may be used, provided they fit the equipment and site architecture. The following comparison is a decision aid, not a product recommendation:
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →| Technology identified in NIST guidance | Role described by the guidance | Design questions for the plant |
|---|---|---|
| VPN using IPsec or TLS technologies | Technologies and protocols intended to support secure remote access to network environments | Can the termination point be placed at the correct boundary? Can users be limited to required hosts and services? Can the service support the site’s authentication, logging, patching, and failure requirements? |
| TLS-based remote access | A VPN technology category identified by NIST | Which applications and OT devices can use it, and how will authorization prevent access to unrelated control segments? |
| SSH | A protocol NIST identifies for remote-computer access | Which hosts may accept it, which commands or administrative functions are permitted, how are keys or other credentials managed, and how are sessions recorded and revoked? |
NIST defines a VPN as “a set of technologies and protocols designed to support secure remote access to network environments” in SP 800-82 Rev. 3, Appendix E.3.6. That definition describes the function of a VPN; it does not say that a VPN alone is a complete OT security architecture.
Authorize connections before they are used
Establish a request and approval workflow. A request should identify the person or vendor, source device, target system, purpose, required privilege, start and end time, and responsible plant owner. Emergency access can use a faster approval path, but it still needs a named approver, a defined scope, and an after-action review.
Configure the access service so an authenticated user reaches only the approved resources. Network reachability, application authorization, and operating-system privileges are separate controls; passing one should not silently grant the others. Use separate paths or permissions for read-only monitoring, operations, and engineering changes when the equipment supports that distinction.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Control session duration and termination
Prefer time-bounded access for maintenance and vendor work. Require reauthentication after an appropriate idle period, terminate sessions when the approved window ends, and provide a way for the plant operator or security team to revoke access immediately. Log successful and failed authentication, connection start and end, source identity, destination, privilege changes, and administrative actions to a location that remains available for review.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Do not let convenience tools bypass the architecture
A remote desktop utility, ad-hoc port forward, or vendor tunnel is not acceptable merely because it works. If such a tool is required by the equipment, place it within the same approved boundary, identity, authorization, monitoring, and maintenance controls. A tool that creates a second route around the firewall or ignores the access approval process defeats the design.
Step 4: Authenticate people and manage their devices
Use MFA where the OT environment supports it
NIST identifies multi-factor authentication as an accepted best practice for remote access to OT applications. Use more than one factor where the application, gateway, and surrounding identity workflow can support it. Factors described in the guidance include:
- Something the user knows, such as a password or PIN.
- Something the user has, such as a physical token, key, or smart card.
- Something the user is, such as a biometric.
MFA at the front door does not authorize every action inside the plant. Continue to enforce least privilege, session approval, network restrictions, and local application permissions.
Handle equipment with limited authentication capability
Some legacy OT components support limited authentication or none at all. Do not place such a device directly on the internet or treat a missing login screen as an acceptable exception. Use compensating controls in the surrounding architecture: isolate the device, restrict which hosts can reach it, mediate access through a managed jump point or application path where appropriate, limit the time and purpose of sessions, and increase monitoring. Document the limitation and its planned remediation or retirement.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesVerify the endpoint, not only the account
CISA cautions that a VPN is only as secure as the devices connected to it. Require remote endpoints to be managed according to the site’s policy: supported operating-system versions, security updates, malware protection where compatible, disk protection for sensitive credentials, screen-lock controls, and removal of local administrator rights where operationally feasible. A contractor’s unmanaged laptop can undermine strong authentication if it is already compromised.
Keep privileged accounts separate from ordinary user accounts. Prohibit shared credentials, record individual accountability, and remove access promptly when a person changes role, leaves the organization, or finishes a contract. Store service credentials securely and rotate them when personnel, vendors, or architecture changes.
Step 5: Patch, monitor, and review the remote-access system
Maintain gateways and connected devices
Track versions and support status for VPN concentrators, firewalls, identity connectors, jump hosts, operating systems, radios, modems, and OT applications. Subscribe to security advisories relevant to the actual models and versions in use. Apply updates through a change process that includes configuration backup, maintenance-window planning, testing, and a recovery path. CISA specifically advises keeping VPN versions current, while also warning that endpoint security matters.
Do not assume that an isolated device never needs maintenance. Isolation reduces exposure; it does not remove vulnerabilities, insider risk, or the possibility that a trusted connection will be abused.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Monitor connections and investigate anomalies
Send remote-access logs to a protected monitoring or review system. Establish expected patterns for user, time, source location, destination, and duration. Investigate unusual activity such as repeated authentication failures, access outside an approved window, a vendor account reaching an unexpected host, privilege changes, or a large configuration transfer. Preserve enough context to determine what was accessed and what changed.
Monitoring should include the access infrastructure and the OT systems behind it. If the remote service reports a successful session but the controller records no corresponding action, that discrepancy deserves review; conversely, an unexplained local change may indicate a path that bypasses the managed service.
Review authorization regularly
At a defined interval, compare active accounts, groups, firewall rules, certificates, keys, and vendor connections with the current inventory and approved work. Remove stale access rather than extending it indefinitely. Revalidate access after a plant acquisition, network redesign, controller replacement, vendor change, or major software update.
Assess operational impact before changing controls
Security changes can affect availability and safety. Before enabling a new authentication dependency, blocking a protocol, updating a gateway, or changing a firewall rule, conduct an impact analysis and risk assessment with operations and qualified OT engineering personnel. Test failure modes: loss of the identity service, loss of the remote gateway, expired certificates, a failed update, and a communications outage. Confirm that local operators can place the plant in a safe state and continue essential operations.
Recommended Free Tools
A renewable-energy-specific warning: communications equipment is also OT exposure
Renewable sites often rely on radios, cellular links, microwave systems, and other communications equipment to connect dispersed turbines, inverters, substations, weather stations, and control centers. Those devices can carry configuration authority or provide a route into a control network, even when they are described operationally as “communications” rather than “control.”
CISA’s General Electric Renewable Energy MDS Radios advisory, revised May 27, 2022, is a historical, product-specific example. It described vulnerabilities affecting specified MDS radio products that could permit configuration control or unauthorized network access. The advisory assigned a CVSS v3 score of 10.0 to the vulnerabilities in that affected equipment context. That number is not a general risk score for renewable energy or for every radio.
Because the advisory is from 2022, do not use its listed versions or remediation details as current firmware advice without checking the manufacturer’s present information and the exact equipment installed at the site. The lasting lesson is to inventory communications devices, restrict their management access, monitor configuration changes, and include them in patch and replacement planning.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Implementation sequence for an operating site
The following sequence can be used as a joint OT, network, operations, and security work plan:
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall- Name the business and operational purpose. Write down the remote task, required systems, required privilege, users, vendors, schedule, and expected result.
- Inventory the path. Identify every controller, server, workstation, firewall, gateway, radio, modem, identity service, and endpoint involved, including dependencies and management interfaces.
- Remove public exposure. Eliminate direct internet access and unapproved port forwards. Confirm local operation and document the change.
- Draw and approve boundaries. Define OT zones, business-network boundaries, remote-access placement, allowed directions, protocols, and fallback behavior.
- Select a supported access method. Evaluate VPN, TLS-based, SSH, or equipment-required methods against isolation, MFA compatibility, authorization granularity, monitoring, patching, lifecycle support, reliability, and safety requirements.
- Configure least-privilege access. Create individual identities, separate read-only and control functions, restrict destinations, require approval, and make maintenance access time-bounded.
- Enable strong authentication. Use MFA where supported; for legacy components, document compensating controls and prevent direct exposure.
- Harden and maintain endpoints. Patch gateways and connected devices, manage endpoint security, protect keys and credentials, and remove unused services.
- Test normal and failure cases. Verify logging, revocation, expired credentials, gateway failure, identity-service loss, and the ability of local staff to operate safely.
- Operate the service as a controlled process. Review sessions, investigate anomalies, recertify accounts and rules, and reassess the design after equipment or organizational changes.
Common failure modes and corrective actions
“The VPN is installed, so the plant is secure.”
A VPN protects a connection under its configured conditions; it does not repair a compromised laptop, an exposed controller, excessive permissions, or an unpatched gateway. Corrective action is to assess the entire connected path, including endpoint security, segmentation, authorization, logging, and maintenance.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
A vendor account remains permanently enabled
Standing vendor access expands the window for misuse and makes review difficult. Replace it with named accounts, approval per work package, a defined end time, limited destinations, and a post-session review.
Remote access reaches an entire OT subnet
Broad network reachability turns one stolen credential into access to many devices. Replace subnet-wide rules with host- and service-specific permissions where equipment and firewalls permit. If a legacy application requires broad reach, isolate it, document the exception, restrict the user and time window, and plan remediation.
MFA cannot be added to a legacy controller
Do not expose the controller to compensate. Put MFA at the managed access boundary, restrict the controller to approved intermediary systems, use time-bounded authorization, and increase monitoring. Record the limitation so it is considered during replacement or modernization.
Free tools Windows power users keep installed
One-click scans. No signup required.
A security update is applied without an operational test
An update can change timing, drivers, certificates, or communications behavior. Use backups, a maintenance window, vendor compatibility information, staged testing where possible, and a rollback procedure. Have operations verify control, alarms, and safety functions afterward.
An emergency exception becomes permanent
Emergency access should have an owner, an expiration time, and an after-action review. Remove temporary rules and credentials when the incident ends, then address the underlying design gap through normal change control.
Site-specific validation and governance
Before production use, the operator and qualified OT security and engineering personnel should verify the design against the actual facility. Review:
- Equipment models, firmware, operating systems, protocols, and authentication limitations.
- Firewall locations, zone boundaries, permitted flows, and all alternate communications paths.
- Identity-provider integration, MFA behavior, account ownership, certificates, keys, and revocation.
- Vendor support obligations, maintenance windows, licensing or lifecycle constraints, and emergency procedures.
- Safe operation during loss of remote access, loss of communications, gateway failure, or identity-service outage.
- Log collection, alert ownership, incident response, backup integrity, and restoration testing.
NIST SP 800-82 Rev. 3, dated September 2023, is the published final OT security guide used for this guidance. As of October 16, 2026, NIST SP 800-82 Rev. 4 is an initial public draft published September 21, 2026, with comments due November 30, 2026; a draft should not be treated as a final requirement. The related NIST publication page is available at tsapps.nist.gov/publication/get_pdf.cfm?pub_id=956505.
Neither NIST nor CISA certifies one product or one architecture for every renewable-energy facility. The operator remains responsible for confirming that the selected controls preserve safety, reliability, and required local operation.
Quick Recap
Decision checklist
- No control-system device or management interface is directly exposed to the public internet.
- OT and business networks are separated by documented boundaries and rules.
- Every remote user, device, destination, privilege, and time window is known and approved.
- The selected VPN, TLS, SSH, or other supported method fits the equipment and does not bypass segmentation.
- MFA is enabled where supported, with compensating controls for components that cannot use it.
- Remote endpoints, gateways, radios, and connected devices are patched and within supported lifecycles.
- Sessions, administrative actions, configuration changes, and failures are logged and reviewed.
- Operations has tested revocation, outages, rollback, and safe local control.
- Accounts, firewall rules, keys, certificates, and vendor access are periodically recertified.
- Changes are reviewed by people who understand both OT security and plant operations.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
