Remote monitoring and diagnostics require security

Imagine this happening in Y2K: You’re sitting in a coffee shop, and the system goes down 1,000 miles away. It is your responsibility to get it back up and running. What do you do?

In 2025 the solution is easy. You spark up your VPN software on your trusted laptop, and you connect to the system and diagnose the issue. Then you fix it, all within the time it takes to drink a cup of joe.

Get your subscription to Control Design’s daily newsletter.

The Internet and factory networks have broadened the scope of remote system access for monitoring, control and diagnostics. Remote access can be “easy,” which is arguably less secure, or “involved,” which is arguably more secure.

I have given presentations at various ISA conferences on remote access, which basically focused on security of the implementation.

Most ideas of “remoting” into a network involve a virtual private network (VPN) application that creates a secure tunnel from the remote device—laptop—to the system network at the plant. The laptop becomes a node on the network and has access to all things connected that the identified user has access to, which could include supervisory control and data acquisition (SCADA) computers, programmable logic controllers (PLCs) and the like.

This brings with it many issues, which are varied, but suffice it to say that, in the wrong hands, the network and associated data can be compromised. Transport layer security (TLS) is a common encryption method, which can be susceptible to security breaches in a public environment such as a “man-in-the-middle” attack vector.

A requirement for a laptop as an end point is to be sure it has adequate security, so that it can’t be compromised itself. Imagine someone installing a key logger to get your credentials without your knowledge.

An important component to this methodology is the fact that all the software you need to interact with the remote network devices has to reside on that laptop. This includes PLC programming software, unless you are implementing a remote access software such as virtual network computing (VNC). In that scenario, once the VPN has been initialized, the VNC instance can be run to access a remote computer on the remote network.

TeamViewer remote connectivity software has become common in the IT world. While the software has to be installed and listening on the Internet-enabled remote computer, it can provide an easy solution to have quick and easy access to the systems you need.

Remoting into a computer over the Internet provides many benefits. Remoting needs to be the next best thing to being there. If you remote into an existing computer on the network, all access and security measures that have been put into place for that user and device are still in place. It should provide the same experience as if the user were sitting in the office or on the plant floor. So, whichever method you choose to access remote assets, privacy and security are paramount.

I was the main industrial technology support person for a large Canadian retailer with the responsibility of monitoring systems and operations involving HMI/SCADA and PLC equipment and networks. Remember pcAnywhere over modems? That was implemented in the early 1990s with support from the IT group to get the maintenance server on the network and a phone line. We migrated to Internet support in the late 1990s using VNC to start and then TeamViewer. I had to log into the firewall first with a company-supplied VPN.

The benefits of being able to go online with the maintenance network gets reduced to a 5-minute response time to issues. Production is money, and, any time you can reduce unscheduled downtime, it is a plus.

The cloud is allowing various data points to be uploaded for operational monitoring. Machine builders can create a new revenue stream by Internet-enabling their control systems to report diagnostic data, as well operational data to the cloud for review by the machine builder.

This service can indicate to the user that maintenance service may need to be done to support the warranty. It could monitor cycle time, and, if it is trending upward, measures could be taken to bring it back into spec.

Predictive-maintenance data points could be used to schedule site visits if required. Users can have this information pushed to them to alert them to perform an action. The cloud benefit allows the user to have access to the same data, so they can be an involved participant in the operation of their process.

Remote monitoring and diagnostics is a thing, but be sure you do it securely. There are many options out there these days, so choose wisely.

Mobility is essential in our modern industrial world. Remote access allows that to happen. Go forth and diagnose.