FireSight OT · comparing remote access
Choosing remote access for machine networks
If you're choosing how engineers and machine builders reach your plants, you're probably comparing several kinds of tool. Here's how the common approaches differ, and eleven questions worth asking any product, with FireSight OT's answers.
The options
Three ways plants usually do it
A VPN into the plant network
Familiar and often already there. But a VPN usually lands people on a whole network rather than one machine, needs an inbound port or a firewall change at each site, and struggles when several sites use the same addresses. Vendor accounts tend to be shared and long-lived.
A remote-control app on a PC
Quick to set up for one support call, which is why they spread. They reach whatever that PC can reach, are hard to restrict to working hours, and are easy to forget about once installed. Many IT teams ban them in OT for those reasons.
Brokered, per-machine access
A device at each site connects out to a central server, and people are brokered through to the machines they're allowed. This is the category FireSight OT is in. Others you may be looking at include Secomea, HMS Ewon Talk2M, Tosibox, Siemens SINEMA Remote Connect and Cisco Secure Equipment Access. The questions below help tell them apart.
Ask every vendor
Eleven questions, and FireSight OT's answers
Ask each product you shortlist the same questions, and ask to see the answer in a demo rather than on a slide.
| Question | FireSight OT |
|---|---|
| 1. Does anything at the site accept connections from outside? | No. The Cloud Connector only dials out, over TLS on 443, a fallback port, or through the site's HTTP proxy. No inbound firewall rules or public addresses. |
| 2. What happens when two sites use the same addresses? | Each site's subnet gets its own range on the Hub (1:1 mapping), so identical lines need no renumbering. People can use the real or the Hub address. |
| 3. Is access per machine, or to the whole network? | Per machine by default: a web page, RDP, VNC, SSH, Telnet or any TCP port. A whole network can be granted where it's allowed, still limited to what's granted. |
| 4. How do outside vendors get in, and when does it stop? | Vendor accounts with two-factor sign-in, an end date and working hours. Sign-in is refused outside those hours, and open sessions are closed when time is up. |
| 5. Can the site cap what can be reached, whatever the server says? | Yes. A list on the Cloud Connector itself caps which machines it will reach, and the Hub can't widen it. |
| 6. Where does the server run, and who holds the data? | On a server you control: your own Debian server or VM, or your machine builder's or integrator's Hub. Sessions, users and logs stay there. |
| 7. What's recorded, and can you export it? | Every sign-in, session, grant, change, file transfer and remote command, with the person's division or vendor. Searchable, and exportable as CSV. |
| 8. What do engineers need to install? | Nothing for web HMIs: they open in the browser. For other tools, a client for Windows, macOS and Linux tunnels them to a local port; Remote Desktop and VNC open by themselves. |
| 9. How are devices identified and updated? | Each Cloud Connector gets its own certificate from the Hub, with mutual TLS, TLS 1.3 by default. Software updates are signed and sent from the Hub. |
| 10. Can you get files off the machines safely? | Yes. Upload-only storage on each Cloud Connector, over SFTP or FTP; copies on the Hub; and collection by your backup software over SFTP or S3. |
| 11. How is it licensed, and what happens if a license lapses? | Per Cloud Connector: a Hub license for a number of them, or a device license for one machine. A 30-day evaluation for up to 3 Cloud Connectors. If a license lapses, FireSight OT keeps working in a restricted mode, and security updates continue. |
Where FireSight OT fits best
Built for duplicated lines and outside vendors
- Manufacturers whose lines are copies of each other, with the same addresses at every plant.
- Plants that rely on machine builders and integrators, and want them limited to their own machines and hours.
- Machine builders who want remote support in every machine they ship, licensed per machine.
- Organisations that want the server on their own infrastructure, for example for NIS2.
Comparing specific products
FireSight OT as an alternative
Or download the feature comparison (PDF): fifteen features across six products, from public documentation.
TeamViewer alternative
Brokered, per-machine access instead of software on plant PCs.
OT platformSecomea alternative
Where the two are alike, and where they differ.
OT platformEwon Talk2M alternative
A Hub you host yourself, and no hardware lock-in.
OT platformTosibox alternative
Per-machine grants, vendor hours and browser access.
Put it to the test
Ask us the same eleven questions on a call, and we'll answer each one live in a demo Hub.
