Industrial Secure Remote Access for Critical Infrastructure

This white paper describes how Safous Industrial Secure Remote Access (I-SRA) provides VPN-less remote access to industrial control system (ICS) and OT environments in critical infrastructure. It is for OT, engineering and security teams that need to support distributed facilities without exposing the OT network. It covers the access problems, product capabilities and a Purdue Model-aligned reference architecture.

Download the PDF

Key Challenges in Critical Infrastructure Remote Access

• Technicians travel to distributed facilities, which raises costs and extends downtime.
• VPNs flatten the network architecture and expose OT networks, increasing the risk of lateral movement.
• Insider threats and vendor or supply chain access can compromise systems from within.
• Legacy ICS systems cannot easily be modified or re-architected.

How Safous Helps

• Identity-based, application-layer access: remote users authenticate through the identity provider (MFA, SSO) and reach only specific ICS applications, never the OT network itself.
• No inbound ports: all communication is initiated outbound over TLS on port 443.
• Air-gapped and on-premises deployment as a hardened container, with no Internet dependency.
• Works with legacy ICS systems without modification or network re-architecture.
• Session monitoring, real-time termination, session recording, audit trails and action-level controls.
• Controls designed not to interfere with deterministic or real-time industrial processes.
• Safous AppGateway restricts direct connectivity to Level 3/2 systems; an optional Safous Private PoP keeps infrastructure inside the customer environment.

Frequently Asked Questions

Does Safous Industrial Secure Remote Access require a VPN?

No. It provides identity-based access to specific ICS applications, so remote users never connect directly to the OT network.

Can it run in an air-gapped environment?

Yes. It can be deployed on-premises or air-gapped as a hardened container with no Internet dependency.

Which standards does the white paper reference?

It references NERC CIP, ISA/IEC 62443, the NIST Cybersecurity Framework, NIST SP 800-82 and regional regulatory frameworks.

Learn more: Safous Industrial Secure Remote Access and regulatory compliance.