In today’s Operational Technology (OT) landscape, modernization and digital transformation promise significant operational gains, but they also introduce new safety and security challenges. From the perspective of the OT ecosystem - people, processes, and technology, modernization delivers measurable business value.
Tighter OT/IT integration improves data sharing, accelerates decision-making, and better aligns business operations with the plant floor. Zero Trust architectures and attack surface reduction strengthen security by enforcing least-privilege access and limiting lateral movement. AI- and IoT-driven analytics enable predictive maintenance, reduce downtime, and provide real-time operational insight. Stronger access management streamlines and audits user and vendor access, while comprehensive asset management provides visibility into connected devices and their associated risk. Enhanced cyber-physical monitoring and incident response improve detection and containment, giving security and operations teams greater visibility across the environment.
But each of these benefits depends on greater connectivity. Every new cloud service, remote connection, third-party partner, connected asset, and data source expands the OT ecosystem. As organizations modernize, the Electronic Security Perimeter (ESP) and Physical Security Perimeter (PSP) increasingly extend to include enterprise IT systems, cloud platforms, remote users, partners, applications, and data sources.
The result is an attack surface that can grow faster than traditional security controls can adapt. More connections create more trust relationships. More identities require greater governance. More assets, information, and applications create more opportunities for attackers to exploit and more potential points of operational failure.
This is the paradox of OT modernization. The technologies that improve operational efficiency can also increase exposure if they are not secured by design. Yet delaying modernization is not a viable alternative. Aging, end-of-life OT systems with limited visibility and outdated controls are becoming increasingly difficult to defend, maintain, and integrate with modern operational requirements.
The question is no longer whether to modernize, but how to modernize while managing the risks that come with greater connectivity.
That requires more than securing individual systems. It requires a way to create a controlled point of access between an increasingly connected outside world and the critical systems within OT. This idea forms the foundation of the Control Tower Model: a centralized architecture for governing access, protecting data, and maintaining visibility as OT environments evolve.
The Expanding Attack Surface
As the IT-OT ecosystem expands, security teams must secure more facilities, users, devices, and third-party connections, often without additional resources or specialized expertise. At the same time, organizations frequently deploy new technologies before fully understanding their operational impact or completing capacity planning, comprehensive risk assessments, clearly defined business and cybersecurity ownership, and data governance requirements such as privacy and retention policies.
Operations and security teams are then expected to manage unfamiliar technologies and increasingly interconnected environments with reduced visibility, inconsistent security controls, and a growing number of access paths.
Historically, limited external connectivity reduced opportunities for cyber threats to reach OT environments. Modernization changes that equation. As remote access, cloud services, enterprise integration, and third-party connectivity become standard, the consequences of a cyber incident extend beyond data loss to operational disruption, equipment damage, and risks to human safety.
Connectivity in OT is also rarely binary. Many critical infrastructure environments operate with low-bandwidth, high-latency, intermittent, or scheduled connectivity for maintenance, diagnostics, and operational support. The Control Tower Model is not built on an assumption of persistent, high-quality internet connectivity. Its value is in providing a resilient, controlled architecture that can operate across constrained and non-traditional connections.
Truly air-gapped environments with no external connectivity present a different scenario. Where an OT environment is permanently disconnected and has no requirement for external access, a remote access architecture is not intended to replace that isolation. In practice, however, many environments described as isolated still require controlled, periodic access for maintenance, diagnostics, vendors, or operational support. In these environments, the objective is not to eliminate isolation, but to preserve it while establishing a controlled path when connectivity is required.
A more effective strategy, therefore, is to control connectivity rather than eliminate it. Establishing a governed Secure Remote Access (SRA) gateway through a secure Industrial Demilitarized Zone (IDMZ) centralizes access to OT resources. By routing remote users, vendors, and data flows through a hardened control point, organizations can eliminate ad hoc connectivity, enforce consistent access policies, improve auditability, and gain greater operational visibility.
This architecture does not, however, solve every challenge associated with modernization. Technology cannot replace sound governance, risk management, clearly defined ownership, or workforce training. Those organizational controls remain essential to a secure OT program.
What a centralized architecture can provide is the visibility and evidence needed to support those processes. Access policies, session controls, and audit logs can give organizations a consistent record of who accessed what, when, and how. This information can support governance and provide evidence for frameworks such as NIST, IEC 62443, Zero Trust, and CMMC. The architecture complements organizational governance; it does not replace it.
Secure Remote Access alone is also not enough. In many environments, authenticated users are still placed directly onto engineering workstations or other high-value assets, where excessive privileges and limited monitoring can enable unauthorized activity or lateral movement. Securing the connection is only the first step. Organizations must also control what users can access, what actions they can perform, and how those activities are monitored throughout the session.
Secure Remote Access and the Bastion Host Model
Addressing these challenges requires more than adding another remote access tool. Organizations need an access architecture that limits exposure by design—one that secures not only how users connect to OT environments, but also what they can access once connected.
This is where the Control Tower Model takes shape. The model establishes a secure, centralized point of control between external users and the OT environment, allowing organizations to govern access, enforce policy, and maintain visibility without creating direct connections to critical assets.
Rather than relying on traditional SRA point products or shared jump boxes that connect users directly to engineering workstations, organizations can deploy a secure, highly resilient intermediary platform. Built on Zero Trust principles (NIST SP 800-207), next-generation bastion hosts deliver isolated, zero-persistence workspaces that broker user sessions, eliminate direct endpoint connectivity to OT assets, and centralize security, governance, and visibility.
Applications and desktops run within the protected environment and are streamed to users through browser isolation or Virtual Desktop Infrastructure (VDI). No applications, files, credentials, or sensitive data are stored on the endpoint, significantly reducing the risk posed by unmanaged devices, third-party vendors, or compromised user systems.
Zero-persistence applies to the workspace and session layer, not to authentication itself. Users still authenticate to the platform’s front door using the organization’s configured authentication controls, including strong authentication such as multi-factor authentication (MFA). Once authenticated, users launch disposable workspaces to reach authorized OT resources. When the workspace ends, the session and its contents are destroyed, while the underlying user identity and authentication layer remain persistent.
This distinction is central to the architecture. Zero-persistence does not eliminate the need to establish and govern identity; it prevents the workspace, applications, files, credentials, and session data from leaving a controlled environment and persisting on the requesting endpoint.
Because sessions remain within the Electronic Security Perimeter (ESP) or Physical Security Perimeter (PSP), organizations can improve security without sacrificing the flexibility required for remote operations.
The architecture also addresses operational challenges common in distributed OT environments. By streaming the user interface rather than the entire desktop, organizations can provide reliable access across high-latency or bandwidth-constrained connections, making the approach well suited for remote facilities such as offshore platforms, ships, substations, and water treatment plants where connectivity may be limited, intermittent, or otherwise constrained.
Additional controls, including Data Loss Prevention (DLP), session supervision, recording, collaboration, browser kiosk mode, and dynamic watermarking, further strengthen safety, security, and governance by improving visibility, supporting compliance requirements, and reducing the risk of intentional or accidental data or asset exposure.
Kasm Workspaces for OT is one example of a platform built around this architecture. Rather than granting users direct access to persistent engineering workstations, it delivers disposable, browser-isolated workspaces that terminate when the session ends, providing centralized policy enforcement, auditing, and containment.
The important distinction is architectural: the bastion is not simply another destination users connect to. It becomes the controlled intermediary through which access, sessions, data, and policy are governed. That is what transforms a traditional jump box into the foundation of the Control Tower Model.
From Secure Access to Operational Intelligence: Building a Trusted Foundation for AI
A secure access architecture does more than reduce cyber risk. It creates a trusted foundation for the next phase of OT modernization.
As organizations adopt AI to improve operations, they face a new challenge: how to leverage operational data without exposing sensitive information to external AI services or creating additional attack paths. For many OT environments, data sovereignty, intellectual property, regulatory requirements, and operational safety demand that AI workloads remain under organizational control.
The Control Tower Model provides a natural foundation for this capability. By hosting AI services within the same secure, isolated environment that brokers user access, organizations can keep operational data within their security perimeter while making it available for analysis.
At this point, the bastion host evolves from a secure access point into a centralized control plane. It can govern user access, protect against data exfiltration, enforce policy, and provide a trusted location for AI-driven analytics.
In other words, the bastion is no longer simply a gateway into the OT environment. It becomes the control tower from which organizations can securely coordinate access, data, intelligence, and operational activity.
This architecture also enables operational context that isolated tools cannot provide. Cybersecurity events, asset inventories, operational telemetry, and user activity can be correlated within a single environment, allowing AI to identify anomalies, surface actionable insights, and support faster decision-making.
The result is more than secure remote access. It is an architecture that securely connects people, systems, and operational data, enabling real-time visibility, predictive maintenance, change management, and informed operational decisions without unnecessarily expanding the organization’s attack surface.
The Future of Secure OT Operations
The value of the Control Tower Model extends beyond day-to-day operations. It can also provide the foundation for a more effective incident response capability. When a cyber or operational event occurs, organizations can rapidly provision secure access for internal responders and external experts, restrict access to affected systems, establish a centralized command environment, and begin forensic analysis—all without exposing sensitive OT resources or moving data outside the Electronic Security Perimeter (ESP) or Physical Security Perimeter (PSP).
Rather than relying on disconnected tools and ad hoc processes, organizations can respond from a single, governed environment that brings secure access, collaboration, visibility, and operational intelligence together. The result is faster response, stronger containment, and greater confidence when every minute matters.
Modernization is no longer optional. Organizations must increase connectivity to improve efficiency, resilience, and competitiveness, but they cannot afford to expand their attack surface without the controls to manage it.
The future of OT security is not built on more point products. It is built on an architectural approach that centralizes access, protects critical systems and data, enables secure collaboration, and creates a trusted foundation for emerging capabilities such as AI and advanced operational analytics.
This is the promise of the Control Tower Model: not eliminating connectivity, but making connectivity more deliberate, visible, and controllable. It gives organizations a centralized point from which to govern access, protect data, support operations, and adapt to the technologies shaping the future of OT.
Just as OT organizations standardized on platforms for SCADA, manufacturing operations management (MOM), and industrial automation, they now need an architecture for secure access and operational control that can support the next generation of OT environments.
Secure modernization is not about choosing between innovation and security. It is about building an architecture that enables both.
Explore the Control Tower Model
Learn more about how Kasm Workspaces for OT applies the Control Tower Model to secure remote access, zero-persistence workspaces, and modern OT environments.
For those who want to explore the model firsthand, Kasm Community Edition provides a no-cost way to experiment with zero-persistence workspaces in a lab or test environment.
About Kasm Workspaces
Kasm Technologies delivers a modern platform for secure, containerized desktop and application access. Kasm Workspaces streams browsers, desktops, and applications directly to users through ephemeral, policy-controlled sessions — eliminating the cost, rigidity, and risk of traditional VDI. Built by a team with deep roots in federal cybersecurity and offensive/defensive operations, Kasm is used by organizations ranging from government agencies to Fortune 500 companies to deliver secure, scalable developer and end-user environments.
Learn more at kasm.com.
