FireSight OT OT remote access

Security and audit

FireSight OT is built so that nothing on the plant floor accepts a connection from outside, and so that every access is limited, deliberate and recorded.

How the pieces trust each other

Outbound only. A Cloud Connector only ever connects out to the Hub. The site's firewall needs no inbound rules.
A certificate per device. Each connector makes its own key and gets a certificate from the Hub's own certificate authority when it enrolls. Every tunnel uses mutual TLS. Certificates renew automatically before they expire.
One-time enrollment codes that expire, with a check that the enrollment wasn't intercepted.
The site has the last word. A connector's local_allow list caps which machines the Hub may ask it to reach. The Hub can't widen it, and changes to the device's network from the Hub are off unless the site allows them.
Signed updates. Software updates are signed (Ed25519), and a connector refuses an update that isn't.
Granted access only. People see and reach only the resources granted to them. Even the full-network VPN is limited to granted networks.

Security settings

Under Security & settings, or fsot-hub policy set key=value. A connector can have its own overrides, but they can only make things stricter.

Setting	Meaning	Default
`min_tls`	TLS 1.3 only, or 1.2 and later with the cipher suites you choose (`cipher_suites`)	1.3
`require_totp`	Two-factor sign-in for everyone (vendors always need it)	off
`user_source_cidrs`	Networks people may sign in from	anywhere
`session_idle_min`	Sign out after this many idle minutes	30
`user_session_hours`	Longest sign-in	12
`max_conns_per_user`	Open tunnels per person	20
`cert_lifetime_days`, `rotate_before_days`	Device certificate lifetime, and when to renew	90, 30
`heartbeat_sec`	How often connectors check in	20
`enroll_code_hours`	How long an enrollment code works	72
`allow_static_forwards`, `allow_vpn`	Allow port forwards on the Hub, and the full-network VPN	off

Sign-in attempts are rate-limited, and the console is protected against cross-site request forgery.

From 0.4.0, the Hub blocks addresses that keep failing to sign in (console, single sign-on, API tokens and backup accounts), and fail2ban on the Hub server blocks persistent ones at the firewall, SSH included. See Sign-in protection and fail2ban.

Single sign-on

People can sign in with Microsoft Entra ID, Google Workspace, Okta, any OpenID Connect provider, ADFS or any SAML 2.0 provider (for example Aruba ClearPass). Each company can be set to require single sign-on.

We recommend turning require_totp on for every Hub, and setting user_source_cidrs where your people work from known networks.

Audit log

Every sign-in, session, grant, change, file transfer, remote command and alert email is in the Audit log, with who did it, from where, for how long and how much data, and their division or vendor.

Search it in the console, or export it:

fsot-hub audit --action access --csv > access.csv
fsot-hub sessions                 # who is connected now
fsot-hub sessions kill ses_…      # end a session

Session transcripts

Every browser terminal session (SSH, Telnet, serial) is recorded as a text transcript, kept for 90 days and linked from the audit log for administrators.

The browser terminal trusts a device's SSH key the first time it connects, and flags any change, as protection against interception.

If a device is lost or stolen

Open the connector on the Hub and choose Revoke. Its certificate stops working at once. To bring it (or a replacement) back, create a new enrollment code.

Reporting a security problem

Email support@firesightsystems.com with "Security" in the subject. Please don't include passwords, keys or enrollment codes.