OTAC Trusted Access Gateway

Challenges

Cyber threats to operational technology (OT) systems supporting critical infrastructure such as energy, water, and transport are increasing at an alarming rate. In 2024, the number of Common Vulnerabilities and Exposures (CVEs) reached an all-time high, underscoring the expanding attack surface for cybercriminals. These threats pose significant risks, ranging from operational disruptions to severe economic losses and even human casualties.

A key contributor to this growing issue is the weak authentication mechanisms of programmable logic controllers (PLCs), the backbone of OT networks. 80% of vulnerabilities reside deep within the ICS network and adversaries need initial access to OT networks to compromise vulnerabilities deep within the ICS network. Many PLC devices rely on default or easily guessable passwords, leaving them highly vulnerable to unauthorised access. Alarmingly, 81% of OT security breaches are linked to weak passwords or password theft. In some cases, passwords are shared or automatic access is allowed without any password being set, highlighting a critical lack of security awareness.

While some OT organisations are attempting to improve PLC security, progress remains slow. As OT systems incorporate advanced functionalities and connect more devices, implementing robust authentication systems becomes increasingly difficult without support from PLC manufacturers. Consequently, the current PLC security ecosystem largely relies on system patch updates from these manufacturers.

Moreover, user management in most OT environments is virtually non-existent. Many PLC devices share passwords or lack them entirely, making it nearly impossible to identify who is accessing them.

The Solution

The OTAC Trusted Access Gateway leverages one-time authentication code (OTAC)—an innovative, one-way dynamic authentication technology developed by swIDch. This technology addresses the vulnerabilities of fixed-value password authentication. Dynamic authentication codes are generated via smartphones, smart cards, or designated laptops. These codes are unique, non-reusable, and impossible to share, ensuring strong and reliable security.

The OTAC Trusted Access Gateway was specifically designed to upgrade PLCs to dynamic authentication without requiring any modification to the devices themselves. This revolutionary gateway connects to PLCs and protects them from OT system attackers by preventing unauthorised access entirely.

Additionally, the OTAC Trusted Access Gateway simplifies identity management. It logs user and device activity, making access management straightforward and unlike public key infrastructure (PKI), which faces challenges such as certificate management and insufficient resources, or biometric authentication, which requires bidirectional communication, the OTAC Trusted Access Gateway offers a one-way dynamic code solution that operates effectively even offline.

[ OT Authentication Flow with The OTAC Trusted Access Gateway Deployed ]

• Placement: The OTAC Trusted Access Gateway is deployed between the user device generating OTAC and the OT system requiring authentication.
  
• Authentication Request: When a target PLC/HMI/RTU/DCS engineering application is launched, the OTAC Trusted Access Gateway agent requests the registered user device to complete the multi-factor authentication (MFA) process.
  
• OTAC Generation: The user generates an OTAC on their registered personal device (e.g., smartphone or smart card) and enters it into the input field.
  
• Validation: The OTAC Trusted Access Gateway validates the entered code and grants access if the user is authorised.
  
  

Benefits

The OTAC Trusted Access Gateway provides a seamless upgrade to OT authentication environments without complex system modifications.

• No Need to Modify current PLCs: The PLC devices remain unaltered.
  
• Centralised Management: User authentication can be centrally managed for enhanced control.
  
• One-Way Dynamic Authentication Codes: Static passwords are replaced with dynamic codes that change for each session, ensuring secure user and device authentication.
  
• Comprehensive Access Logs: Unlike standard PLC access logs that lack user/device identification, OTAC Trusted Access Gateway’s logs provide meaningful, actionable records of access activity.