Securing remote access to wind and solar farms: access points, VPN and segmentation

By Wladimir Neuberger · Updated 27 Oct 2026

Why remote access is the central risk

Wind, solar and similar plants are monitored and maintained remotely, often through web interfaces, mobile routers or vendor portals. That saves trips but opens doors. In its notice of 13 October 2026 the German BSI urgently advises securing control systems that are reachable from the internet according to the state of the art. It addresses operators of small industrial or comparable plants in particular, naming among others plants for power generation. As its first measure it names preventing direct access from the internet to control systems.

The US agency CISA describes an example from the water sector: in July 2026 it observed attacks on internet-connected systems at more than 100 entities. The cases usually involved controllers (PLCs) attached directly to cellular modems. The attackers accessed them remotely and changed device IP addresses and passwords, which led to loss of monitoring and control and in some cases to disrupted operations. That is a different sector, but it shows the pattern: reachable, weakly protected, directly on the network.

Typical access points

The following list sorts common access paths that operators often do not fully know. It is a working basis for the inventory, not an exhaustive list.

• Web interfaces of inverters, park controllers and control units that are reachable from the internet directly or through port forwarding.
• Remote-maintenance access for manufacturers, service companies and integrators, including over extra mobile connections or devices nobody remembers.
• VPN gateways and routers on site, which themselves need updates and a clean configuration.
• Control systems and SCADA connections through which operating data flows and commands are issued.
• Credentials: default passwords, shared accounts, and access that nobody uses any more but nobody has switched off.

Basic principles for secure remote access

The principles come from BSI and CISA publications. The order and the wording of the implementation are our recommendation.

• Inventory: record all remote-maintenance access, including mobile connections and unknown devices (BSI, as reported). CISA also advises identifying third parties with remote access and checking whether they secure those connections.
• Make nothing directly reachable: CISA calls for removing OT connections to the public internet. Necessary access goes through a centrally managed gateway, firewall or VPN, not straight to controllers, operator interfaces or remote terminal units.
• Control access: individual user names, strong passwords and phishing-resistant multi-factor login for every remote connection, as few privileges as possible, and dormant accounts disabled.
• Replace default passwords immediately, especially on devices that can be reached from the internet.
• Separate networks: keep IT (office) and OT (plant) apart with a demilitarised zone in between. Limit outbound connections to what is necessary.
• Log: who connected when, from where, and what did they do? Without that trail nothing can be reconstructed after an incident (our recommendation).

Reducing internet exposure does not mean abolishing remote access. According to CISA it means removing unnecessary access and securing the necessary kind.

A patch strategy for plant technology

The BSI recommends keeping systems up to date, applying security updates and bug fixes promptly, and making these measures routine. In its guide to OT security NIST stresses that protective measures must take account of the performance, reliability and safety requirements of the plant. For plants that means: do not update blindly, but do not leave things unpatched either.

• Keep an asset list with devices, firmware versions and vendor contacts so that security notices can be matched to your equipment (our recommendation).
• Agree updates with the manufacturer and test them beforehand, where possible on a test device; set a maintenance window and a way back (our recommendation).
• Replace devices without vendor support or isolate them further. CISA names replacing end-of-support software for systems that must remain reachable.
• Routers, VPN gateways and access systems belong in the same patch routine as the controller.

Involving third parties and manufacturers

According to CISA, misconfigurations can come from operators, integrators and manufacturers alike; it therefore recommends regular coordination with service providers. The BSI also suggests checking whether connections to manufacturer clouds are needed permanently and operating the plant locally where possible. Settle this contractually: who may access when, how do they authenticate, and who revokes access when the project ends?

External testing: only with a written mandate

If you want to know what is visible from outside, you can have your own reachability checked regularly; CISA recommends routine checks of your own public address space because environments change. Salimov offers a Basic Scan and a Deep Scan (Tiefen-Scan) as a way of testing within its security packages. Only systems for which you as operator give a written mandate can be tested; neither we nor you may examine other people’s plants without permission.

Where to start

• List all sites and all remote access paths, including mobile routers and vendor portals.
• Find out which paths are reachable directly from the internet and close them or put them behind a VPN or gateway.
• Replace default passwords, set up multi-factor login and disable unused accounts.
• Have the office and plant networks separated and switch on logging of access.
• Agree update and access rules with the manufacturer and service company in writing and repeat the check every year.

Frequently asked questions

Sources

• BSI — Pressemitteilung „BSI rät dringend zur Absicherung vernetzter Steuerungssysteme“ (13.10.2026)
• pv magazine Deutschland — BSI empfiehlt Schutzmaßnahmen für mit dem Internet verbundene Photovoltaik-Anlagen (16.10.2026; Berichterstattung zur BSI-Empfehlung 154)
• CISA, FBI, EPA, DOE — Primary Mitigations to Reduce Cyber Threats to Operational Technology (6. Mai 2025)
• CISA — Internet Exposure Reduction Guidance
• NIST — SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security (September 2023)

This assessment rests on the publications listed. Check the original source before making decisions.

Keep reading

• Securing WordPress and PHP: a patch routine for website operators
• Cyber security in the age of agents: what changes when AI acts on its own