Special Note: In a well-designed system, identity should not be confused

with authorization or access control as they are different functions. They are
three different functions. For example, when accessing a VPN concentrator,
determining the individual’s authorization should not be the concentrator’s
job. It should be referencing a separate identity and access management (IAM)
system using a protocol like security assertion markup language (SAML) to
validate the identity and not have the credentials stored locally. Once the
identity is confirmed, it should access an authorization service to determine the
person’s access rights. Only then should it allow or deny access to the assets
behind the VPN. Wikipedia has a good example: https://en.wikipedia.org/wiki/
Identity_management.

Individuals should be required to fill out the information on

the proposed action or reason before being allowed entry.
Individuals requesting entry should be required to provide information that
can be used to validate the individual and track activities. Whether this
activity is manual or automated, the need for an initial step prior to gaining
access is essential.

One must weigh all aspects with regard to the initial screening of individuals
with any delays this may cause. For this reason, the ability to link known
attributes or contracts with individuals will streamline access while
providing an initial barrier for others. The need to initially acquire data or
link the individual to a known contract will also provide greater assurance of
proper activity and avoid liability issues.

Getting connected to the proper devices after being verified

Once an individual is verified, the next step is the method to reach the
targeted devices. The challenges here are that every manufacturing site
typically does not have a uniform environment when it comes to networks
and equipment. Most of the differences are not well documented, making it
even more difficult. The good news is that the newer systems are better

2021 I Practical Guide for Remote Access to Plant Equipment 66