implementing-conduit-security-for-ot-remote-access
Teaches your AI agent to protect apps against attacks and ship projects and manage infrastructure.
What it does
This tool helps create a secure path for outsiders (like technicians or vendors) to remotely access industrial control systems (like those in factories). It uses a security model called 'conduit' to ensure access is controlled, recorded, and approved.
When to use it
- ✓When you want to replace direct VPN access to industrial systems.
- ✓To control external vendor access to SCADA equipment.
- ✓To fix security flaws in uncontrolled remote access.
Example of what to ask your AI
“Set up secure remote access for the factory's SCADA system using the conduit model, with prior approval and session recording.”
Want more? Open the sections below.
How to use
The easiest way: copy the message below and paste it into Claude, ChatGPT, Cursor or any AI. It reads the skill and follows the instructions.
Skill link
Ready-to-paste message
How it works
It defines a secure access path that starts outside the industrial network, goes through a secure intermediate server (jump server) in the security zone (DMZ), and only then reaches the target system. All access is multi-factor authenticated, approved, and recorded.
Installation
Easiest way: copy the skill link and paste it into Claude, ChatGPT or Cursor asking it to follow the instructions.
In the terminal (Claude Code, Codex, Cursor), in your project folder:
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-conduit-security-for-ot-remote-accessOr download just the file:
curl -L https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/main/skills/implementing-conduit-security-for-ot-remote-access/SKILL.md -o SKILL.mdTechnical content (original SKILL.md)
Original text by the author, straight from GitHub.
Implementing Conduit Security for OT Remote Access
When to Use
- When replacing direct VPN connections from IT or vendors into OT control networks
- When implementing IEC 62443-compliant conduit architecture for remote access paths
- When deploying secure remote access for third-party vendor maintenance of ICS equipment
- When building approval-based access workflows for privileged OT system access
- When remediating audit findings about uncontrolled remote access to SCADA systems
Do not use for designing the overall Purdue Model segmentation (see implementing-purdue-model-network-segmentation), for deploying IT-only remote access solutions, or for configuring local console access to PLCs.
Prerequisites
- IT/OT DMZ (Level 3.5) deployed with dual-firewall architecture
- Jump server or privileged access management (PAM) platform (CyberArk, BeyondTrust)
- Multi-factor authentication (MFA) infrastructure for OT remote access users
- Session recording capability for compliance and forensic purposes
- Approval workflow system (ServiceNow, ticketing) for access requests
Workflow
Step 1: Design Conduit Architecture for Remote Access
# IEC 62443 Conduit Security Architecture for OT Remote Access
# All remote access terminates in DMZ - never passes through to OT directly
conduit_architecture:
remote_access_conduit:
conduit_id: "RA-001"
source_zone: "Enterprise IT (Level 4)"
destination_zone: "OT DMZ (Level 3.5)"
security_level_target: "SL3"
components:
external_gateway:
type: "VPN Concentrator"
location: "Enterprise DMZ"
ip: "10.200.1.10"
protocols: ["IPsec", "SSL-VPN"]
authentication: "MFA required (certificate + OTP)"
dmz_jump_server:
type: "Privileged Access Workstation"
location: "OT DMZ (Level 3.5)"
ip: "10.10.150.20"
os: "Windows Server 2022 (hardened)"
controls:
- "Local admin accounts disabled"
- "USB ports disabled"
- "Clipboard transfer disabled by default"
- "Session recording enabled (all keystrokes and screen)"
- "Maximum session duration: 4 hours"
- "Automatic logoff after 15 minutes idle"
- "Application whitelisting enforced"
ot_access_gateway:
type: "Industrial Remote Access Gateway"
location: "OT DMZ / Level 3 boundary"
ip: "10.10.150.25"
controls:
- "Only pre-approved destination IPs reachable"
- "Protocol-level filtering (RDP, SSH, VNC only)"
- "Time-limited sessions with automatic expiry"
- "Approval-based access (plant manager must authorize)"
data_flow:
- step: 1
description: "User authenticates via enterprise VPN with MFA"
source: "Remote user"
destination: "VPN concentrator"
protocol: "IPsec/SSL-VPN"
- step: 2
description: "User connects to jump server in OT DMZ"
source: "VPN tunnel"
destination: "DMZ jump server"
protocol: "RDP with NLA"
- step: 3
description: "From jump server, user accesses specific OT system"
source: "DMZ jump server"
destination: "Approved OT target"
protocol: "RDP/SSH/VNC"
condition: "Only after manager approval and within time window"
prohibited_flows:
- "Direct VPN tunnel from external to Level 1/2 OT devices"
- "Split tunneling allowing internet access during OT session"
- "File transfer from jump server to OT without scanning"
- "Persistent VPN connections (auto-reconnect disabled)"
vendor_access_conduit:
conduit_id: "VA-001"
source_zone: "Vendor External Network"
destination_zone: "OT DMZ (Level 3.5)"
security_level_target: "SL3"
workflow:
request:
- "Vendor submits access request via portal (24h advance)"
- "Request includes: purpose, target systems, duration, personnel"
- "Plant operations manager reviews and approves/rejects"
- "Time-limited credentials generated upon approval"
session:
- "Vendor connects via dedicated vendor VPN gateway"
- "MFA authentication (vendor receives OTP via SMS/app)"
- "Session lands on vendor-specific jump server (isolated from internal jump)"
- "All actions recorded (video + keystroke logging)"
- "OT engineer monitors vendor session in real-time"
termination:
…
FAQ
What is the 'conduit' model?
It's a way to organize industrial network security, defining secure communication paths (conduits) between different security zones, like protected tunnels.
What is a 'jump server'?
It's an intermediate, secure computer that serves as an entry point to access other systems. It acts like a gatekeeper, controlling who enters and where they go.
Why record sessions?
Recording sessions provides a log of everything done during remote access. This is important for audits, security, and investigating any incidents that might occur.
Details
Original description by the author
Implements secure conduit architecture for OT remote access under the IEC 62443 zones-and-conduits model, deploying jump servers, MFA gateways, session recording, and approval-based workflows for vendor and engineer access to ICS. Use when replacing direct VPN access into OT networks, securing third-party vendor access to SCADA equipment, or remediating audit findings on uncontrolled OT remote acc
Popularity
- GitHub stars
- 35k
- Ranking position
- #5855
- License
- Apache-2.0
- Updated
- 8/31/2026
Comments
- …
More skills from this repository
abusing-dpapi-for-credential-access
Gives your AI agent ready-made instructions for a specific task, so it does it better and faster.
mukul975/Anthropic-Cybersecurity-Skills
abusing-shadow-credentials-for-privesc
Teaches your AI agent to write clear, well-structured text.
mukul975/Anthropic-Cybersecurity-Skills
achieving-cmmc-level-2-compliance
Helps your agent prepare an environment for CMMC Level 2 compliance. It implements security requirements and manages necessary documentation.
mukul975/Anthropic-Cybersecurity-Skills
acquiring-disk-image-with-dd-and-dcfldd
Helps your agent create exact copies of hard drives. This is useful for ensuring no information is lost or altered during investigations.
mukul975/Anthropic-Cybersecurity-Skills
Similar skills
django-security
Helps your agent implement security practices in Django applications. It focuses on authentication, authorization, and prevention against common attacks, ensuring more secure code.
affaan-m/ECC
laravel-security
Helps your agent secure Laravel applications against threats. Implements security practices for authentication, authorization, and common attack prevention.
affaan-m/ECC
module-regression
Helps your agent manage changes in large projects. Ensures code changes in one part don't break other parts.
affaan-m/ECC