Secure Remote Access for OT Vendors and Integrators
The Vulnerability of Direct PLC Connections
Vendors and integrators often reach controllers through a cellular modem or port-forward set up for one job and never removed.
CISA's 2026-07-30 alert says cellular modems installed by operators, vendors or integrators may be undocumented and are being targeted.
The same alert reports attackers changing PLC passwords and IP addresses at water systems, with boil-water notices and extended manual operation as results.
Furthermore, CISA advisory AA26-097A reports actors installing Dropbear SSH on victim modems for access over port 22.
Federal Guidelines for OT Connectivity
NCSC-UK, CISA, the FBI and partners published 'Secure Connectivity Principles for OT' on 2026-01-14, including centralising remote access.
'Secure remote access to OT networks' is one of CISA's five primary OT mitigations released on 2025-05-06, requiring a VPN, phishing-resistant MFA, least privilege and disabled dormant accounts.
CISA asks owners to route operational remote access through a VPN or gateway device, not directly to the PLC, and to allow-list remote IPs to known engineering laptops.
The Coast Guard rule also requires MTSA facilities to monitor and document all third-party remote connections and to use MFA on remotely accessible OT.
Gateway Deployment and Cellular Hardware
CloudCentric is a managed IT provider in Mount Pleasant, South Carolina, serving businesses across Charleston and the Lowcountry.
Before a modem is disconnected, a clean backup of the PLC program is kept, as CISA recommends.
CloudCentric removes modems and port-forwards on controllers and replaces them with VPN access through the firewall.
The UCG-Industrial gateway supports site-to-site VPN options like IPsec, OpenVPN, and Site Magic, as well as VPN server options including WireGuard, OpenVPN, L2TP and Teleport.
Where a remote site needs cellular, the UMR-Industrial router (LTE Cat 4, 9 to 30 V DC, IP66, -40 to 70 °C, DIN or pole mount) sits behind the firewall as a managed link, not a modem on a controller.
For cellular links that must stay, AA26-097A suggests a private APN, ZTNA or a site-to-site VPN.
Managing Vendor Access and Logging
Firewall rules allow each vendor to reach only the controllers they support, and only from listed sources.
Vendor accounts can be disabled between jobs and removed when the contract ends.
VPN connections and traffic through the gateway are logged, giving a record of who connected and when.
UniFi's firewall does not inspect industrial protocols; it allows or blocks by address and port.
No UniFi page describes session recording, per-session vendor approval or jump-host brokering; larger sites that need those use a dedicated OT remote-access product.
To secure operational access for your terminal or utility, contact CloudCentric at (844) 422-7000.