The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Keep control-system devices off the public internet. When remote work is necessary, allow it only through a controlled, monitored route to explicitly authorized systems. A VPN can help create that route, but it does not secure the devices or access beyond it.
What counts as remote access in an ICS?
Remote access is broader than a VPN connection. It includes external access to data, systems, or services inside networks that are physically or logically protected. Users may include operators, maintainers, vendors, contractors, and support providers. CISA’s remote-access recommended practice uses this broad framing.
As an Amazon Associate I earn from qualifying purchases.
That means an access review should follow the route into the control environment, not just check whether a VPN is installed. Build an inventory of people, devices, services, and connections that can reach control-system assets, including:
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11- VPN gateways and remote desktop services.
- Engineering workstations, jump hosts, and links between business and control networks.
- Vendor or cloud support portals.
- Cellular connections, modems, and other remote links.
- Internet-facing systems, including those exposed only for specific approved work.
This inventory is a practical implementation step, not a claim that CISA prescribes this exact checklist. Record which routes are enabled, who owns them, what targets they reach, and the operational reason each route is needed.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
How should the access path be designed?
Use a layered route rather than a direct connection from the internet or an ordinary enterprise workstation to a control-system component. One illustrative pattern is:
Approved remote user on a managed origin device → maintained remote-access gateway or VPN, as appropriate → firewall boundary → monitored jump host in a control-systems DMZ → explicitly authorized target.
CISA recommends reducing internet exposure, using a monitored jump host when an asset must remain reachable, monitoring inbound and outbound traffic, and applying MFA where possible. Its Internet Exposure Reduction Guidance was published June 4, 2025. A CISA FY2014 assessment report describes a jump box in a dedicated control-systems DMZ and controls such as authentication logging and limiting authorized originating systems.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #2
- INTEGRATED FIREWALL APPLIANCE AND SECURITY SERVICES: Comes with FortiGate-40F Firewall Appliance, 1 year of FortiCare Premium, and FortiGuard Unified Threat Protection.
- UTP SECURITY FEATURES: Offers protection from advanced threats with DNS filtering, URL filtering, video filtering, and controls against botnets.
- IDEAL FOR SMALLER SETTINGS: Best suited for small to mid-sized businesses needing reliable security without the complexity of larger systems.
- CONTINUOUS SUPPORT AND MAINTENANCE: FortiCare Premium ensures that technical help is readily available to manage and troubleshoot issues.
- COMPACT AND EFFECTIVE: Provides a powerful, yet compact security solution that effectively protects against a wide range of cyber threats.
This is an example architecture, not a universal reference design. The zones, firewall rules, targets, and any failover route must fit the site’s process and engineering constraints. Keep control-system networks behind firewalls and isolated from business networks where feasible. A VPN may be part of a secure method, but CISA’s joint advisory cautions that VPNs can have vulnerabilities, require updates, and are only as secure as the devices connected through them.
How can exposure and access be reduced?
Remove unnecessary public reachability
Start by identifying systems reachable from the internet and removing access that is not operationally required. For reachable assets, document the reason they must remain accessible and put compensating controls around them. CISA’s exposure guidance recommends changing default passwords, patching supported systems, replacing devices or software without security support, using a jump host for necessary exposed assets, monitoring ingress and egress, and applying MFA where possible.
Make identity and authorization specific
- Use individual identities rather than shared remote accounts so activity can be attributed to a person.
- Limit access to the role, systems, and period needed for the approved task; avoid broad standing access.
- Require approval before access is enabled, especially for vendors, and define who can authorize it.
- Use MFA where supported. If the target itself cannot support MFA, CISA recommends considering it at the jump-host level.
- Document and test emergency and vendor-access procedures with the operator responsible for the process.
These controls should be implemented with the systems available at the site; the cited guidance does not endorse a particular MFA product or authentication protocol.
Rank #3
- 【NEWER MODEL AVAILABLE - Protectli Vault V1210】THE VAULT (FW2B): Secure your network with a compact, fanless & silent firewall. Comes with US-based Support & 30-day money back guarantee!
- CPU: Intel Celeron J3060 Dual Core at 1.6 GHz (Turbo 2.48 GHz), AES-NI hardware support
- PORTS: 2x Intel Gigabit Ethernet NIC ports, 4x USB 2.0, 2x USB 3.0, 1x RJ-45 COM, 2x HDMI
- COMPONENTS: Needs RAM & Storage to work! This is a Barebones unit for maximum customizability (no RAM or mSATA). Not all memory is compatible with the Vault! Please research "Vault Hardware Compatibility" before purchasing. coreboot BIOS optional, must be installed by user.
- COMPATIBILITY: No OS pre-installed. All hardware tested with pfSense, untangle, OPNsense and other popular open-source software solutions.
Constrain the route and the session
Allow connections only from authorized originating systems to approved targets, through the designated boundary and jump host. Avoid routes that let a remote user move freely between business and control networks. Consider split tunneling in the design: the FY2014 CISA assessment says to disable it for the remote-session design it describes, but that older, specific recommendation is not a universal rule for every environment.
What should be monitored and logged?
Monitoring should help defenders distinguish expected maintenance from failed or suspicious access attempts. Log successful and failed authentication, record relevant session activity where safe and feasible, and monitor inbound and outbound traffic along the access path. Alert on unusual connection patterns and investigate attempts that do not match an approved user, origin device, time, or target.
Decide what to record with the process owner and security team. Logging and session monitoring must not interfere with control functions or create unacceptable load on sensitive systems. The FY2014 CISA assessment offers examples of authentication logging and authorized-origin controls; treat it as architectural context rather than a current product baseline.
Rank #4
- 【◆Powerful Celeron N2840 Processor: N2840 Processor, 2 Cores 2 Threads, 1M Cache, Max Turbo Frequency 2.58 GHz, TDP 7.5 W. Compatible with OPNsense, Linux, Windows,ESXI, OpenWrt and other systems. Press "Delete" key to enter BIOS setup, supports Auto Power On, Wake On Lake, GPIO, PXE
- 【◆1GbE LAN: Mini Router PC with 2*Realtek RTL8111H network card chip full UDE 1000M with filter connector.Soft Router can monitor network data, improve network security, powerful and widely used.
- ◆DDR3L Memory & Large Storage Capacity: Firewall box computer with 1 x DDR3L SO-DIMM memory 1333/1600MHz, 1xMSATA3.0 SSD+1x2.5''SATA3.0 SSD/HDD.
- ◆UHD Graphics & Dual Display: N2840 processor integrated UHD Graphics, HD and VGA dual display interfaces support 4K@60Hz.
- ◆Rich interfaces: 2 x1000M Realtek RTL8111H-LAN,2 xUSB3.0, 4 xUSB2.0, HDMI,VGA,AUDIO supports data storage and system boot.
How do the main access approaches compare?
| Access approach | Security posture | Operational consideration |
|---|---|---|
| Direct internet exposure of a control-system device | Leaves the device reachable without the controlled access path described above. | Remove the exposure unless a documented operational need requires it. |
| Unmanaged origin device or unrestricted route | Makes it harder to limit access to authorized systems, users, and targets. | Use authorized origin systems and explicitly scoped access. |
| Access through a gateway, firewall boundary, and monitored jump host | Provides a place to enforce authorization and observe the session; MFA can be applied at the jump host where possible. | Site-specific design and testing are needed to ensure the route supports the control process. |
| VPN without controls on connected devices or sessions | Does not, by itself, secure the devices reached through it or prevent excessive access. | Maintain the VPN and apply controls to the rest of the path. |
How should changes be maintained safely?
Keep the whole route in scope: gateway or VPN software, jump host, connected devices, firewall rules, and internet-facing assets. Patch supported systems and remove unsupported components, but do so through the organization’s operational change process. CISA’s joint advisory recommends impact analysis and risk assessment before deploying defensive measures. Validate changes in a way appropriate to the site before introducing them into production; security changes must not create an unacceptable process or availability risk.
Review who still needs access and whether each enabled route remains necessary. Update the inventory, authorizations, and monitoring rules when systems, vendors, responsibilities, or operating needs change. No single control guarantees that attacks will be prevented.
How should exceptions and suspected compromise be handled?
Document who can approve vendor access, how accounts are enabled and disabled, how access is reported and reviewed, and what operators should do if remote access may be compromised. Test the emergency process with the people responsible for both operations and security so that an access decision can be made without improvising during an incident.
For more detailed response planning, CISA’s remote-access recommended practice links the subject to broader recommended practices, including incident response and forensics. Follow the site’s established safety and incident procedures when a suspected access event could affect the control process.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
