Bayer – Secure Remote Access from a Single Source

Manufacturers of chemicals, pharmaceuticals and food are no longer only ensuring the functional safety of their plants – now, they must also protect the integrity of their networks. Commissioning equipment without being on site, performing diagnoses remotely and carrying out monitoring functions from home have gradually become standard for suppliers and service providers. This is because quick external access increases plant availability – but it also leads to a whole host of different access methods and security concepts. The applications employed to enable the use of appropriate, cost-effective devices and methods from the IT world in process plants have become an almost impenetrable jungle, especially at large locations. For an industry that demands the highest standards when it comes to the integrity and security of plants, this is a growing problem.

The Search for a Standardized Solution

An excellent example of how complexity can be reduced while also maximizing security for plant operation is the company Bayer. “The then CISO had the idea of drawing up an OT security program. The aim was for this to create transparency within the overall company regarding how the individual Bayer sites address this topic,” says Jani Alexander Krämer, Information Technology Security Analyst at Bayer. The combination of being hugely beneficial to the company while also posing a high risk of damage made remote access top priority. Therefore, the most important objective of the OT security program implemented at the time was initially to come up with a standardized technical solution for remote access to machines and plants at the different Bayer locations.

The background to this is that many Bayer companies and important suppliers were already using their own security solutions. In cases where the technical implementation of the remote access focused on functionality more than security, people were very willing to switch to the new system. “In many cases, however, it took some work to convince them to accept genua as the mandatory standard solution in the company. Especially where suppliers with their own good solutions were forced to change to genua,” says Krämer.

One topic where assessments differed was the audit trail. “Many companies work in a GXP or GMP environment. In such cases, we have to meet high requirements regarding documentation. We must be able to prove, without a single omission, who was on which system when, and what changes were made,” adds Carsten Rocks, Global Program Lead “Manufacturing IT Security“. In Bayer‘s CISO organization, he develops special security controls for the OT world.

In contrast, the access solutions of mechanical engineers, for example, worked with a pooled back office of third-party companies. As a result, in some cases, it was not possible to tell which operator was behind an account – an unacceptable situation from an auditing perspective.

Access Always Registered and Recorded

Krämer, who performs a kind of service manager role at Bayer, worked with service provider Atos to implement and deploy the necessary programs, adaptations and employee training worldwide.

“genua were and continue to be on hand to help with their technical expertise. Their technical support steps in as level three if there are problems with the service that the provider cannot solve,” explains Krämer, who handles coordination and any classic issues that are escalated.

Now, the genua logging system used at Bayer ensures that users can track all connections – meaning it is always transparent who has logged in, when, what work was carried out and who oversaw it. The recording function that has also been integrated was even developed at the express request of Bayer‘s then management team.

For genua, it has become a unique selling point to record not only logs but also the actual maintenance process in detail. Once the work is complete, the session recording can be archived similarly to a video.

Secure Updates Performed Externally

An additional implementation that has also been carried out recently in close collaboration with the Bayer team concerns the secure file transfer part. Receiving files from outside the organization is one of the requirements that make heads of security break out in a cold sweat. Yet updating or repairing firmware, for example, is precisely what can get a reactor control system or a packaging machine going again in no time at all. In an independent project, this requirement was addressed and scanning for malicious software established. It is now possible to connect an ICAP server that is part of the genubox security solution and checks data connections and files for malicious software before they enter the network. “It is a fantastic expansion that we planned with genua based on the locations‘ feedback and then implemented with the help of our provider,” says Rocks, delightedly.

The implementation of features such as this, which have been requested by end users, is another reason for the high level of acceptance at Bayer: “We regularly receive positive feedback from our users. The productive nature of the collaboration is also clear from the fact that the solution is no longer used only for remote maintenance but now also for internal administration. In addition, we often receive constructive suggestions as to how the service can be expanded further and which additional features would be helpful,” says Krämer.

Seamless Integration

“The main benefit of a remote maintenance solution is the cost saving due to on-site visits by suppliers now rarely being necessary. This saves time and money and helps us to respond quickly – which is particularly valuable in the event of a malfunction, because there‘s no need for someone to be on site,” says Krämer. “In relation to this, I‘d add the increased flexibility. At some locations, employees also intensively use the solution for access when they‘re working from home, for example,” says Rocks. The genua solution gives every Bayer location the choice as to whether the access is, for example, arranged via time-controlled remote maintenance, or whether the security approval is only granted from within the company. It depends on factors such as the division and whether a production line is subject to GMP or GXP rules, how the network has been segmented and whether special IT solutions are in use.

Existing systems can also be used. Connecting to a cloud identity provider such as Okta or Azure Active Directory enables the full integration of genua remote maintenance into a central user management system with commonly used multi-factor authentication. Companies benefit from scalable client, role and rights concepts and users can authenticate themselves via their usual method.