[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6EV3A7R2EBWT6QFJR4D8G54":3,"skill-same:01M6EV3A7R2EBWT6QFJR4D8G54":110},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":71,"commitSha":72,"skillDirectory":73,"forksCount":14,"repositoryHtmlUrl":74,"repositoryHomepageUrl":75,"ownerHtmlUrl":76,"ownerBlogUrl":6,"ownerDescription":77,"updatedAt":78,"install":79,"resources":92},"01M6EV3A7R2EBWT6QFJR4D8G54","implementing-conduit-security-for-ot-remote-access",null,"Implement secure conduit architecture for OT remote access following IEC 62443 zones and conduits model, deploying jump servers, MFA-enabled gateways, session recording, and approval-based workflows to control vendor and engineer access to industrial control systems without exposing OT networks directly.","henriquescastilho\u002Fmy-claude","henriquescastilho","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F153296945?v=4","01M6ESH7EXPXTH9CVQ4K16SRG8","Henrique Scheer","01M6ESH7JHEK2PTNNH4HEH787Z",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-conduit-security-for-ot-remote-access\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"implementing conduit security for ot remote access","remote","access","security","conduit","gateways","server","zero-trust","t1078","secure","architecture","ICS-security","workflows","model","cm","engineer","control systems","iec 62443","de","cybersecurity","2026-11-10 10:12:30",false,"---\nname: implementing-conduit-security-for-ot-remote-access\ndescription: 'Implement secure conduit architecture for OT remote access following\n  IEC 62443 zones and conduits model, deploying jump servers, MFA-enabled gateways,\n  session recording, and approval-based workflows to control vendor and engineer access\n  to industrial control systems without exposing OT networks directly.\n\n  '\ndomain: cybersecurity\nsubdomain: ot-ics-security\ntags:\n- ot-security\n- ics\n- remote-access\n- iec62443\n- jump-server\n- zero-trust\n- conduit\n- mfa\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.IR-01\n- DE.CM-01\n- ID.AM-05\n- GV.OC-02\nmitre_attack:\n- T1078\n- T1190\n- T1059\n- T0816\n- T0836\n---\n\n# Implementing Conduit Security for OT Remote Access\n\n## When to Use\n\n- When replacing direct VPN connections from IT or vendors into OT control networks\n- When implementing IEC 62443-compliant conduit architecture for remote access paths\n- When deploying secure remote access for third-party vendor maintenance of ICS equipment\n- When building approval-based access workflows for privileged OT system access\n- When remediating audit findings about uncontrolled remote access to SCADA systems\n\n**Do not use** for designing the overall Purdue Model segmentation (see implementing-purdue-model-network-segmentation), for deploying IT-only remote access solutions, or for configuring local console access to PLCs.\n\n## Prerequisites\n\n- IT\u002FOT DMZ (Level 3.5) deployed with dual-firewall architecture\n- Jump server or privileged access management (PAM) platform (CyberArk, BeyondTrust)\n- Multi-factor authentication (MFA) infrastructure for OT remote access users\n- Session recording capability for compliance and forensic purposes\n- Approval workflow system (ServiceNow, ticketing) for access requests\n\n## Workflow\n\n### Step 1: Design Conduit Architecture for Remote Access\n\n```yaml\n# IEC 62443 Conduit Security Architecture for OT Remote Access\n# All remote access terminates in DMZ - never passes through to OT directly\n\nconduit_architecture:\n  remote_access_conduit:\n    conduit_id: \"RA-001\"\n    source_zone: \"Enterprise IT (Level 4)\"\n    destination_zone: \"OT DMZ (Level 3.5)\"\n    security_level_target: \"SL3\"\n\n    components:\n      external_gateway:\n        type: \"VPN Concentrator\"\n        location: \"Enterprise DMZ\"\n        ip: \"10.200.1.10\"\n        protocols: [\"IPsec\", \"SSL-VPN\"]\n        authentication: \"MFA required (certificate + OTP)\"\n\n      dmz_jump_server:\n        type: \"Privileged Access Workstation\"\n        location: \"OT DMZ (Level 3.5)\"\n        ip: \"10.10.150.20\"\n        os: \"Windows Server 2022 (hardened)\"\n        controls:\n          - \"Local admin accounts disabled\"\n          - \"USB ports disabled\"\n          - \"Clipboard transfer disabled by default\"\n          - \"Session recording enabled (all keystrokes and screen)\"\n          - \"Maximum session duration: 4 hours\"\n          - \"Automatic logoff after 15 minutes idle\"\n          - \"Application whitelisting enforced\"\n\n      ot_access_gateway:\n        type: \"Industrial Remote Access Gateway\"\n        location: \"OT DMZ \u002F Level 3 boundary\"\n        ip: \"10.10.150.25\"\n        controls:\n          - \"Only pre-approved destination IPs reachable\"\n          - \"Protocol-level filtering (RDP, SSH, VNC only)\"\n          - \"Time-limited sessions with automatic expiry\"\n          - \"Approval-based access (plant manager must authorize)\"\n\n    data_flow:\n      - step: 1\n        description: \"User authenticates via enterprise VPN with MFA\"\n        source: \"Remote user\"\n        destination: \"VPN concentrator\"\n        protocol: \"IPsec\u002FSSL-VPN\"\n      - step: 2\n        description: \"User connects to jump server in OT DMZ\"\n        source: \"VPN tunnel\"\n        destination: \"DMZ jump server\"\n        protocol: \"RDP with NLA\"\n      - step: 3\n        description: \"From jump server, user accesses specific OT system\"\n        source: \"DMZ jump server\"\n        destination: \"Approved OT target\"\n        protocol: \"RDP\u002FSSH\u002FVNC\"\n        condition: \"Only after manager approval and within time window\"\n\n    prohibited_flows:\n      - \"Direct VPN tunnel from external to Level 1\u002F2 OT devices\"\n      - \"Split tunneling allowing internet access during OT session\"\n      - \"File transfer from jump server to OT without scanning\"\n      - \"Persistent VPN connections (auto-reconnect disabled)\"\n\n  vendor_access_conduit:\n    conduit_id: \"VA-001\"\n    source_zone: \"Vendor External Network\"\n    destination_zone: \"OT DMZ (Level 3.5)\"\n    security_level_target: \"SL3\"\n\n    workflow:\n      request:\n        - \"Vendor submits access request via portal (24h advance)\"\n        - \"Request includes: purpose, target systems, duration, personnel\"\n        - \"Plant operations manager reviews and approves\u002Frejects\"\n        - \"Time-limited credentials generated upon approval\"\n      session:\n        - \"Vendor connects via dedicated vendor VPN gateway\"\n        - \"MFA authentication (vendor receives OTP via SMS\u002Fapp)\"\n        - \"Session lands on vendor-specific jump server (isolated from internal jump)\"\n        - \"All actions recorded (video + keystroke logging)\"\n        - \"OT engineer monitors vendor session in real-time\"\n      termination:\n        - \"Session auto-terminates at approved end time\"\n        - \"Credentials automatically revoked\"\n        - \"Session recording archived for 90 days\"\n        - \"Access log forwarded to SIEM\"\n```\n\n### Step 2: Implement Access Control and Monitoring\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"OT Remote Access Conduit Manager.\n\nManages approval-based remote access to OT systems through\nsecure conduit architecture with session recording, MFA\nenforcement, and time-limited access windows.\n\"\"\"\n\nimport json\nimport sys\nfrom datetime import datetime, timedelta\nfrom typing import Dict, List, Optional\nfrom enum import Enum\n\n\nclass AccessRequestStatus(Enum):\n    PENDING = \"pending\"\n    APPROVED = \"approved\"\n    REJECTED = \"rejected\"\n    ACTIVE = \"active\"\n    EXPIRED = \"expired\"\n    REVOKED = \"revoked\"\n\n\nclass RemoteAccessRequest:\n    \"\"\"Represents an OT remote access request.\"\"\"\n\n    def __init__(self, requestor: str, requestor_type: str, purpose: str,\n                 target_systems: List[str], duration_hours: int,\n                 requested_start: str):\n        self.id = f\"OT-RA-{datetime.now().strftime('%Y%m%d-%H%M%S')}\"\n        self.requestor = requestor\n        self.requestor_type = requestor_type  # \"internal_engineer\" or \"vendor\"\n        self.purpose = purpose\n        self.target_systems = target_systems\n        self.duration_hours = duration_hours\n        self.requested_start = requested_start\n        self.status = AccessRequestStatus.PENDING\n        self.created = datetime.now().isoformat()\n        self.approved_by = None\n        self.session_id = None\n        self.audit_trail = []\n\n    def approve(self, approver: str, conditions: str = \"\"):\n        \"\"\"Approve the access request.\"\"\"\n        self.status = AccessRequestStatus.APPROVED\n        self.approved_by = approver\n        self.audit_trail.append({\n            \"timestamp\": datetime.now().isoformat(),\n            \"action\": \"APPROVED\",\n            \"actor\": approver,\n            \"conditions\": conditions,\n        })\n\n    def reject(self, rejector: str, reason: str):\n        \"\"\"Reject the access request.\"\"\"\n        self.status = AccessRequestStatus.REJECTED\n        self.audit_trail.append({\n            \"timestamp\": datetime.now().isoformat(),\n            \"action\": \"REJECTED\",\n            \"actor\": rejector,\n            \"reason\": reason,\n        })\n\n\nclass OTConduitManager:\n    \"\"\"Manages OT remote access conduit security.\"\"\"\n\n    def __init__(self):\n        self.access_requests: Dict[str, RemoteAccessRequest] = {}\n        self.active_sessions: Dict[str, dict] = {}\n        self.policy = self._load_policy()\n\n    def _load_policy(self) -> dict:\n        \"\"\"Load remote access policy.\"\"\"\n        return {\n            \"max_session_hours\": 4,\n            \"idle_timeout_minutes\": 15,\n            \"mfa_required\": True,\n            \"session_recording\": True,\n            \"clipboard_transfer\": False,\n            \"file_transfer\": \"scan_required\",\n            \"advance_notice_hours\": 24,\n            \"vendor_escort_required\": True,\n            \"prohibited_targets\": [\"SIS-*\", \"SAFETY-*\"],\n            \"allowed_protocols\": [\"RDP\", \"SSH\", \"VNC\"],\n            \"blocked_protocols\": [\"Telnet\", \"FTP\", \"SMB\"],\n        }\n\n    def submit_request(self, request: RemoteAccessRequest) -> str:\n        \"\"\"Submit a new remote access request.\"\"\"\n        # Validate against policy\n        violations = []\n\n        if request.duration_hours > self.policy[\"max_session_hours\"]:\n            violations.append(\n                f\"Duration {request.duration_hours}h exceeds maximum {self.policy['max_session_hours']}h\"\n            )\n\n        for target in request.target_systems:\n            for prohibited in self.policy[\"prohibited_targets\"]:\n                pattern = prohibited.replace(\"*\", \"\")\n                if target.startswith(pattern):\n                    violations.append(f\"Target {target} is in prohibited list (safety systems)\")\n\n        if violations:\n            print(f\"[!] Policy violations found:\")\n            for v in violations:\n                print(f\"    - {v}\")\n            return \"\"\n\n        self.access_requests[request.id] = request\n        print(f\"[+] Access request {request.id} submitted for approval\")\n        return request.id\n\n    def list_pending_requests(self):\n        \"\"\"List all pending access requests for approval.\"\"\"\n        pending = [r for r in self.access_requests.values()\n                   if r.status == AccessRequestStatus.PENDING]\n\n        print(f\"\\n{'='*65}\")\n        print(\"PENDING OT REMOTE ACCESS REQUESTS\")\n        print(f\"{'='*65}\")\n\n        if not pending:\n            print(\"  No pending requests\")\n            return\n\n        for req in pending:\n            print(f\"\\n  Request: {req.id}\")\n            print(f\"    Requestor: {req.requestor} ({req.requestor_type})\")\n            print(f\"    Purpose: {req.purpose}\")\n            print(f\"    Targets: {', '.join(req.target_systems)}\")\n            print(f\"    Duration: {req.duration_hours} hours\")\n            print(f\"    Start: {req.requested_start}\")\n            print(f\"    Submitted: {req.created}\")\n\n    def generate_audit_report(self):\n        \"\"\"Generate audit report of all remote access activity.\"\"\"\n        print(f\"\\n{'='*65}\")\n        print(\"OT REMOTE ACCESS AUDIT REPORT\")\n        print(f\"{'='*65}\")\n        print(f\"Report Date: {datetime.now().isoformat()}\")\n        print(f\"Total Requests: {len(self.access_requests)}\")\n\n        status_counts = {}\n        for req in self.access_requests.values():\n            status = req.status.value\n            status_counts[status] = status_counts.get(status, 0) + 1\n\n        print(f\"\\nRequest Status:\")\n        for status, count in status_counts.items():\n            print(f\"  {status}: {count}\")\n\n        print(f\"\\nDetailed Audit Trail:\")\n        for req in self.access_requests.values():\n            print(f\"\\n  {req.id} - {req.requestor} ({req.requestor_type})\")\n            print(f\"    Status: {req.status.value}\")\n            print(f\"    Targets: {', '.join(req.target_systems)}\")\n            for entry in req.audit_trail:\n                print(f\"    [{entry['timestamp']}] {entry['action']} by {entry['actor']}\")\n\n\nif __name__ == \"__main__\":\n    manager = OTConduitManager()\n\n    # Vendor access request\n    vendor_req = RemoteAccessRequest(\n        requestor=\"John Smith - Siemens Field Service\",\n        requestor_type=\"vendor\",\n        purpose=\"Annual PLC firmware update for S7-1500 controllers\",\n        target_systems=[\"PLC-REACTOR-01\", \"PLC-REACTOR-02\"],\n        duration_hours=3,\n        requested_start=\"2025-03-15T08:00:00\",\n    )\n\n    req_id = manager.submit_request(vendor_req)\n    if req_id:\n        manager.list_pending_requests()\n\n    # Simulate approval\n    manager.access_requests[req_id].approve(\n        approver=\"Plant Manager - Jane Doe\",\n        conditions=\"OT engineer must shadow the vendor session\",\n    )\n\n    manager.generate_audit_report()\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Conduit | IEC 62443 controlled communication path between security zones with defined security policies |\n| Jump Server | Hardened intermediary server in the DMZ through which all remote OT access must transit |\n| Session Recording | Capture of all screen activity, keystrokes, and commands during a remote access session for audit |\n| Approval-Based Access | Workflow requiring plant operations manager authorization before remote access credentials are activated |\n| Vendor Escort | Practice of having an internal OT engineer monitor vendor remote sessions in real time |\n| Break-Glass Access | Emergency access procedure bypassing normal approval workflow for critical situations |\n\n## Output Format\n\n```\nOT REMOTE ACCESS CONDUIT REPORT\n==================================\nDate: YYYY-MM-DD\n\nCONDUIT STATUS:\n  Internal Access Conduit: [Active\u002FInactive]\n  Vendor Access Conduit: [Active\u002FInactive]\n\nACCESS REQUESTS (Last 30 Days):\n  Submitted: [count]\n  Approved: [count]\n  Rejected: [count]\n  Average Session Duration: [hours]\n\nPOLICY COMPLIANCE:\n  MFA Enforcement: [100%]\n  Session Recording: [100%]\n  Time-Limited Sessions: [compliance %]\n  Prohibited Target Attempts: [count blocked]\n```\n","# Implementing Conduit Security for OT Remote Access\n\n## When to Use\n\n- When replacing direct VPN connections from IT or vendors into OT control networks\n- When implementing IEC 62443-compliant conduit architecture for remote access paths\n- When deploying secure remote access for third-party vendor maintenance of ICS equipment\n- When building approval-based access workflows for privileged OT system access\n- When remediating audit findings about uncontrolled remote access to SCADA systems\n\n**Do not use** for designing the overall Purdue Model segmentation (see implementing-purdue-model-network-segmentation), for deploying IT-only remote access solutions, or for configuring local console access to PLCs.\n\n## Prerequisites\n\n- IT\u002FOT DMZ (Level 3.5) deployed with dual-firewall architecture\n- Jump server or privileged access management (PAM) platform (CyberArk, BeyondTrust)\n- Multi-factor authentication (MFA) infrastructure for OT remote access users\n- Session recording capability for compliance and forensic purposes\n- Approval workflow system (ServiceNow, ticketing) for access requests\n\n## Workflow\n\n### Step 1: Design Conduit Architecture for Remote Access\n\n```yaml\n# IEC 62443 Conduit Security Architecture for OT Remote Access\n# All remote access terminates in DMZ - never passes through to OT directly\n\nconduit_architecture:\n  remote_access_conduit:\n    conduit_id: \"RA-001\"\n    source_zone: \"Enterprise IT (Level 4)\"\n    destination_zone: \"OT DMZ (Level 3.5)\"\n    security_level_target: \"SL3\"\n\n    components:\n      external_gateway:\n        type: \"VPN Concentrator\"\n        location: \"Enterprise DMZ\"\n        ip: \"10.200.1.10\"\n        protocols: [\"IPsec\", \"SSL-VPN\"]\n        authentication: \"MFA required (certificate + OTP)\"\n\n      dmz_jump_server:\n        type: \"Privileged Access Workstation\"\n        location: \"OT DMZ (Level 3.5)\"\n        ip: \"10.10.150.20\"\n        os: \"Windows Server 2022 (hardened)\"\n        controls:\n          - \"Local admin accounts disabled\"\n          - \"USB ports disabled\"\n          - \"Clipboard transfer disabled by default\"\n          - \"Session recording enabled (all keystrokes and screen)\"\n          - \"Maximum session duration: 4 hours\"\n          - \"Automatic logoff after 15 minutes idle\"\n          - \"Application whitelisting enforced\"\n\n      ot_access_gateway:\n        type: \"Industrial Remote Access Gateway\"\n        location: \"OT DMZ \u002F Level 3 boundary\"\n        ip: \"10.10.150.25\"\n        controls:\n          - \"Only pre-approved destination IPs reachable\"\n          - \"Protocol-level filtering (RDP, SSH, VNC only)\"\n          - \"Time-limited sessions with automatic expiry\"\n          - \"Approval-based access (plant manager must authorize)\"\n\n    data_flow:\n      - step: 1\n        description: \"User authenticates via enterprise VPN with MFA\"\n        source: \"Remote user\"\n        destination: \"VPN concentrator\"\n        protocol: \"IPsec\u002FSSL-VPN\"\n      - step: 2\n        description: \"User connects to jump server in OT DMZ\"\n        source: \"VPN tunnel\"\n        destination: \"DMZ jump server\"\n        protocol: \"RDP with NLA\"\n      - step: 3\n        description: \"From jump server, user accesses specific OT system\"\n        source: \"DMZ jump server\"\n        destination: \"Approved OT target\"\n        protocol: \"RDP\u002FSSH\u002FVNC\"\n        condition: \"Only after manager approval and within time window\"\n\n    prohibited_flows:\n      - \"Direct VPN tunnel from external to Level 1\u002F2 OT devices\"\n      - \"Split tunneling allowing internet access during OT session\"\n      - \"File transfer from jump server to OT without scanning\"\n      - \"Persistent VPN connections (auto-reconnect disabled)\"\n\n  vendor_access_conduit:\n    conduit_id: \"VA-001\"\n    source_zone: \"Vendor External Network\"\n    destination_zone: \"OT DMZ (Level 3.5)\"\n    security_level_target: \"SL3\"\n\n    workflow:\n      request:\n        - \"Vendor submits access request via portal (24h advance)\"\n        - \"Request includes: purpose, target systems, duration, personnel\"\n        - \"Plant operations manager reviews and approves\u002Frejects\"\n        - \"Time-limited credentials generated upon approval\"\n      session:\n        - \"Vendor connects via dedicated vendor VPN gateway\"\n        - \"MFA authentication (vendor receives OTP via SMS\u002Fapp)\"\n        - \"Session lands on vendor-specific jump server (isolated from internal jump)\"\n        - \"All actions recorded (video + keystroke logging)\"\n        - \"OT engineer monitors vendor session in real-time\"\n      termination:\n        - \"Session auto-terminates at approved end time\"\n        - \"Credentials automatically revoked\"\n        - \"Session recording archived for 90 days\"\n        - \"Access log forwarded to SIEM\"\n```\n\n### Step 2: Implement Access Control and Monitoring\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"OT Remote Access Conduit Manager.\n\nManages approval-based remote access to OT systems through\nsecure conduit architecture with session recording, MFA\nenforcement, and time-limited access windows.\n\"\"\"\n\nimport json\nimport sys\nfrom datetime import datetime, timedelta\nfrom typing import Dict, List, Optional\nfrom enum import Enum\n\n\nclass AccessRequestStatus(Enum):\n    PENDING = \"pending\"\n    APPROVED = \"approved\"\n    REJECTED = \"rejected\"\n    ACTIVE = \"active\"\n    EXPIRED = \"expired\"\n    REVOKED = \"revoked\"\n\n\nclass RemoteAccessRequest:\n    \"\"\"Represents an OT remote access request.\"\"\"\n\n    def __init__(self, requestor: str, requestor_type: str, purpose: str,\n                 target_systems: List[str], duration_hours: int,\n                 requested_start: str):\n        self.id = f\"OT-RA-{datetime.now().strftime('%Y%m%d-%H%M%S')}\"\n        self.requestor = requestor\n        self.requestor_type = requestor_type  # \"internal_engineer\" or \"vendor\"\n        self.purpose = purpose\n        self.target_systems = target_systems\n        self.duration_hours = duration_hours\n        self.requested_start = requested_start\n        self.status = AccessRequestStatus.PENDING\n        self.created = datetime.now().isoformat()\n        self.approved_by = None\n        self.session_id = None\n        self.audit_trail = []\n\n    def approve(self, approver: str, conditions: str = \"\"):\n        \"\"\"Approve the access request.\"\"\"\n        self.status = AccessRequestStatus.APPROVED\n        self.approved_by = approver\n        self.audit_trail.append({\n            \"timestamp\": datetime.now().isoformat(),\n            \"action\": \"APPROVED\",\n            \"actor\": approver,\n            \"conditions\": conditions,\n        })\n\n    def reject(self, rejector: str, reason: str):\n        \"\"\"Reject the access request.\"\"\"\n        self.status = AccessRequestStatus.REJECTED\n        self.audit_trail.append({\n            \"timestamp\": datetime.now().isoformat(),\n            \"action\": \"REJECTED\",\n            \"actor\": rejector,\n            \"reason\": reason,\n        })\n\n\nclass OTConduitManager:\n    \"\"\"Manages OT remote access conduit security.\"\"\"\n\n    def __init__(self):\n        self.access_requests: Dict[str, RemoteAccessRequest] = {}\n        self.active_sessions: Dict[str, dict] = {}\n        self.policy = self._load_policy()\n\n    def _load_policy(self) -> dict:\n        \"\"\"Load remote access policy.\"\"\"\n        return {\n            \"max_session_hours\": 4,\n            \"idle_timeout_minutes\": 15,\n            \"mfa_required\": True,\n            \"session_recording\": True,\n            \"clipboard_transfer\": False,\n            \"file_transfer\": \"scan_required\",\n            \"advance_notice_hours\": 24,\n            \"vendor_escort_required\": True,\n            \"prohibited_targets\": [\"SIS-*\", \"SAFETY-*\"],\n            \"allowed_protocols\": [\"RDP\", \"SSH\", \"VNC\"],\n            \"blocked_protocols\": [\"Telnet\", \"FTP\", \"SMB\"],\n        }\n\n    def submit_request(self, request: RemoteAccessRequest) -> str:\n        \"\"\"Submit a new remote access request.\"\"\"\n        # Validate against policy\n        violations = []\n\n        if request.duration_hours > self.policy[\"max_session_hours\"]:\n            violations.append(\n                f\"Duration {request.duration_hours}h exceeds maximum {self.policy['max_session_hours']}h\"\n            )\n\n        for target in request.target_systems:\n            for prohibited in self.policy[\"prohibited_targets\"]:\n                pattern = prohibited.replace(\"*\", \"\")\n                if target.startswith(pattern):\n                    violations.append(f\"Target {target} is in prohibited list (safety systems)\")\n\n        if violations:\n            print(f\"[!] Policy violations found:\")\n            for v in violations:\n                print(f\"    - {v}\")\n            return \"\"\n\n        self.access_requests[request.id] = request\n        print(f\"[+] Access request {request.id} submitted for approval\")\n        return request.id\n\n    def list_pending_requests(self):\n        \"\"\"List all pending access requests for approval.\"\"\"\n        pending = [r for r in self.access_requests.values()\n                   if r.status == AccessRequestStatus.PENDING]\n\n        print(f\"\\n{'='*65}\")\n        print(\"PENDING OT REMOTE ACCESS REQUESTS\")\n        print(f\"{'='*65}\")\n\n        if not pending:\n            print(\"  No pending requests\")\n            return\n\n        for req in pending:\n            print(f\"\\n  Request: {req.id}\")\n            print(f\"    Requestor: {req.requestor} ({req.requestor_type})\")\n            print(f\"    Purpose: {req.purpose}\")\n            print(f\"    Targets: {', '.join(req.target_systems)}\")\n            print(f\"    Duration: {req.duration_hours} hours\")\n            print(f\"    Start: {req.requested_start}\")\n            print(f\"    Submitted: {req.created}\")\n\n    def generate_audit_report(self):\n        \"\"\"Generate audit report of all remote access activity.\"\"\"\n        print(f\"\\n{'='*65}\")\n        print(\"OT REMOTE ACCESS AUDIT REPORT\")\n        print(f\"{'='*65}\")\n        print(f\"Report Date: {datetime.now().isoformat()}\")\n        print(f\"Total Requests: {len(self.access_requests)}\")\n\n        status_counts = {}\n        for req in self.access_requests.values():\n            status = req.status.value\n            status_counts[status] = status_counts.get(status, 0) + 1\n\n        print(f\"\\nRequest Status:\")\n        for status, count in status_counts.items():\n            print(f\"  {status}: {count}\")\n\n        print(f\"\\nDetailed Audit Trail:\")\n        for req in self.access_requests.values():\n            print(f\"\\n  {req.id} - {req.requestor} ({req.requestor_type})\")\n            print(f\"    Status: {req.status.value}\")\n            print(f\"    Targets: {', '.join(req.target_systems)}\")\n            for entry in req.audit_trail:\n                print(f\"    [{entry['timestamp']}] {entry['action']} by {entry['actor']}\")\n\n\nif __name__ == \"__main__\":\n    manager = OTConduitManager()\n\n    # Vendor access request\n    vendor_req = RemoteAccessRequest(\n        requestor=\"John Smith - Siemens Field Service\",\n        requestor_type=\"vendor\",\n        purpose=\"Annual PLC firmware update for S7-1500 controllers\",\n        target_systems=[\"PLC-REACTOR-01\", \"PLC-REACTOR-02\"],\n        duration_hours=3,\n        requested_start=\"2025-03-15T08:00:00\",\n    )\n\n    req_id = manager.submit_request(vendor_req)\n    if req_id:\n        manager.list_pending_requests()\n\n    # Simulate approval\n    manager.access_requests[req_id].approve(\n        approver=\"Plant Manager - Jane Doe\",\n        conditions=\"OT engineer must shadow the vendor session\",\n    )\n\n    manager.generate_audit_report()\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Conduit | IEC 62443 controlled communication path between security zones with defined security policies |\n| Jump Server | Hardened intermediary server in the DMZ through which all remote OT access must transit |\n| Session Recording | Capture of all screen activity, keystrokes, and commands during a remote access session for audit |\n| Approval-Based Access | Workflow requiring plant operations manager authorization before remote access credentials are activated |\n| Vendor Escort | Practice of having an internal OT engineer monitor vendor remote sessions in real time |\n| Break-Glass Access | Emergency access procedure bypassing normal approval workflow for critical situations |\n\n## Output Format\n\n```\nOT REMOTE ACCESS CONDUIT REPORT\n==================================\nDate: YYYY-MM-DD\n\nCONDUIT STATUS:\n  Internal Access Conduit: [Active\u002FInactive]\n  Vendor Access Conduit: [Active\u002FInactive]\n\nACCESS REQUESTS (Last 30 Days):\n  Submitted: [count]\n  Approved: [count]\n  Rejected: [count]\n  Average Session Duration: [hours]\n\nPOLICY COMPLIANCE:\n  MFA Enforcement: [100%]\n  Session Recording: [100%]\n  Time-Limited Sessions: [compliance %]\n  Prohibited Target Attempts: [count blocked]\n```\n",{"name":5,"tags":49,"author":56,"domain":43,"license":15,"version":57,"nist_csf":58,"subdomain":63,"description":64,"mitre_attack":65},[50,51,52,53,54,31,28,55],"ot-security","ics","remote-access","iec62443","jump-server","mfa","mahipal","1.0",[59,60,61,62],"PR.IR-01","DE.CM-01","ID.AM-05","GV.OC-02","ot-ics-security","Implement secure conduit architecture for OT remote access following IEC 62443 zones and conduits model, deploying jump servers, MFA-enabled gateways, session recording, and approval-based workflows to control vendor and engineer access to industrial control systems without exposing OT networks directly.\n",[66,67,68,69,70],"T1078","T1190","T1059","T0816","T0836","main","7925716f065257435fdb12e97f7e52842147d5ad",".claude\u002Fskills\u002Fimplementing-conduit-security-for-ot-remote-access","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude","https:\u002F\u002Fclaude.com\u002Fclaude-code","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho","Software · Applied AI · Quantitative Modeling · Building with Claude.","2026-06-10 12:24:46",{"source":8,"skillName":5,"commands":80,"prompt":90,"zipAvailable":91},[81,84,87],{"tool":82,"command":83},"npx","npx skills add henriquescastilho\u002Fmy-claude --skill implementing-conduit-security-for-ot-remote-access",{"tool":85,"command":86},"bunx","bunx skills add henriquescastilho\u002Fmy-claude --skill implementing-conduit-security-for-ot-remote-access",{"tool":88,"command":89},"pnpm","pnpm dlx skills add henriquescastilho\u002Fmy-claude --skill implementing-conduit-security-for-ot-remote-access","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-conduit-security-for-ot-remote-access\u002FSKILL.md",true,[93,98,104],{"path":94,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":96,"sourceHtmlUrl":97},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-conduit-security-for-ot-remote-access\u002FLICENSE",{"path":99,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":102,"sourceHtmlUrl":103},"references\u002Fapi-reference.md","REFERENCE","参考文档",1609,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-conduit-security-for-ot-remote-access\u002Freferences\u002Fapi-reference.md",{"path":105,"resourceType":106,"resourceTypeDesc":107,"sizeBytes":108,"sourceHtmlUrl":109},"scripts\u002Fagent.py","SCRIPT","脚本",5298,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-conduit-security-for-ot-remote-access\u002Fscripts\u002Fagent.py",[111,152,161,170,192,218],{"skillNo":112,"name":113,"nameZh":6,"description":114,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":115,"licenseFileUrl":6,"sourceHtmlUrl":116,"categories":117,"keywords":132,"publishedAt":44},"01M6F0B6XPQ65AX2X0DWK8KT3E","markitdown","Convert files and office documents to Markdown. Supports PDF, DOCX, PPTX, XLSX, images (with OCR), audio (with transcription), HTML, CSV, JSON, XML, ZIP, YouTube URLs, EPubs and more.","MIT","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[118,121,124,127],{"categoryNo":119,"categoryName":120,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000002","文档处理",{"categoryNo":122,"categoryName":123,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":125,"categoryName":126,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000004","电子表格",{"categoryNo":128,"categoryName":129,"taxonomyType":130,"taxonomyTypeDesc":131},"01JBSEEDCAT000000000000034","行政与办公人员","PROFESSION","适用职业",[113,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151],"docx","PDF","pptx","xlsx","documents","csv","ocr","Audio","Bash","markdown","convert","read","write","edit","html","images","files","youtube","with",{"skillNo":153,"name":113,"nameZh":6,"description":114,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":115,"licenseFileUrl":6,"sourceHtmlUrl":154,"categories":155,"keywords":160,"publishedAt":44},"01M6F06SBHR9F0SDWE282Y8075","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fscientific_writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[156,157,158,159],{"categoryNo":119,"categoryName":120,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":122,"categoryName":123,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":125,"categoryName":126,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":128,"categoryName":129,"taxonomyType":130,"taxonomyTypeDesc":131},[113,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151],{"skillNo":162,"name":113,"nameZh":6,"description":114,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":115,"licenseFileUrl":6,"sourceHtmlUrl":163,"categories":164,"keywords":169,"publishedAt":44},"01M6F02D4R14EJAPBWVDF9J9VQ","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[165,166,167,168],{"categoryNo":119,"categoryName":120,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":122,"categoryName":123,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":125,"categoryName":126,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":128,"categoryName":129,"taxonomyType":130,"taxonomyTypeDesc":131},[113,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151],{"skillNo":171,"name":172,"nameZh":6,"description":173,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":115,"licenseFileUrl":6,"sourceHtmlUrl":174,"categories":175,"keywords":176,"publishedAt":44},"01M6F000KS6YB4MKS774G4R8ND","zarr-python","Chunked N-D arrays for cloud storage. Compressed arrays, parallel I\u002FO, S3\u002FGCS integration, NumPy\u002FDask\u002FXarray compatible, for large-scale scientific computing pipelines.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fzarr-python\u002FSKILL.md",[],[177,178,179,180,181,182,183,184,185,186,187,188,189,190,191],"python","zarr python","storage","integration","s3","gcs","cloud","dask","parallel","pipelines","arrays","numpy","scientific computing","scale","scientific",{"skillNo":193,"name":194,"nameZh":6,"description":195,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":115,"licenseFileUrl":6,"sourceHtmlUrl":196,"categories":197,"keywords":199,"publishedAt":44},"01M6EZZJWFXM1GR78KTW6J0DN8","what-if-oracle","Run structured What-If scenario analysis with multi-branch possibility exploration. Use this skill when the user asks speculative questions like \"what if...\", \"what would happen if...\", \"what are the possibilities\", \"explore scenarios\", \"scenario analysis\", \"possibility space\", \"what could go wrong\", \"best case \u002F worst case\", \"risk analysis\", \"contingency planning\", \"strategic options\", or any question about uncertain futures. Also trigger when the user faces a fork-in-the-road decision, wants to stress-test an idea, or needs to think through consequences before committing.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fwhat-if-oracle\u002FSKILL.md",[198],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[200,201,202,203,204,205,206,207,208,209,210,144,145,211,212,213,214,215,216,217],"oracle","what if oracle","go","run","ux","futures","analysis","explore","decision","branch","question","idea","exploration","options","stress-test","strategies","scenario","stress",{"skillNo":219,"name":220,"nameZh":6,"description":221,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":115,"licenseFileUrl":6,"sourceHtmlUrl":222,"categories":223,"keywords":234,"publishedAt":44},"01M6EZZCXAEB49RXGQCJX5E8GB","venue-templates","Access comprehensive LaTeX templates, formatting requirements, and submission guidelines for major scientific publication venues (Nature, Science, PLOS, IEEE, ACM), academic conferences (NeurIPS, ICML, CVPR, CHI), research posters, and grant proposals (NSF, NIH, DOE, DARPA). This skill should be used when preparing manuscripts for journal submission, conference papers, research posters, or grant proposals and need venue-specific formatting requirements and templates.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fvenue-templates\u002FSKILL.md",[224,227,230,231],{"categoryNo":225,"categoryName":226,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":228,"categoryName":229,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":232,"categoryName":233,"taxonomyType":130,"taxonomyTypeDesc":131},"01JBSEEDCAT000000000000036","内容创作者",[235,236,237,238,239,240,241,242,141,26,144,145,146,243,244,245,246,247,191,248],"templates","venue templates","research","guidelines","NeurIPS","ICML","LaTeX","science","proposals","Academic","requirements","formatting","journal","chi"]