Using RBAC to Enforce the Principle of Least Privilege in Industrial Remote Maintenance Sessions

In recent years, digitalization is having a great impact on industry. Especially the rising degree of cross-linked machines is resulting in new business models and great economic advantages. One example is remote maintenance. It leads to less downtime and gained efficiency due to a quicker response time of highly qualified maintenance technicians. However, connecting industrial machines to WANs opens up new attack surfaces. In particular, machines with long lifetimes are often severely outdated since updates that might cause downtime stand in direct conflict to the central objective of availability. In case of remote maintenance, it additionally requires great trust in the external maintenance technician not to use the remote connection for wrong doing. On the market multiple solutions for securing remote maintenance sessions exist. However, these solutions mainly focus on network security and disregard system security entirely. Security doctrines such as the principle of least privilege should be used to enhance the system security. This paper focuses on system security of industrial machines and proposes the use of role based access control to confine users and attackers alike. This way, consequences of security breaches and wrong doing can be minimized. The scientific contribution is the development, implementation and assessment of a concept for the usage of RBAC on system level to solve current system security issues, with the focus on remote maintenance sessions.