Datasheets, Interactive Tours, Documentation & Guides for best practice 3rd party access
Interactive Tours
Presentations & 2-pagers
Technical Documentation
Technical Requirements
Security Documentation
Datasheet / Technical Specifications
Remote Access best-practice Guides
OT Best-Practice Guide to 3rd Party Remote Access
The framework any defensible solution must satisfy: threat model, five core principles, four access scenarios, and a compliance crosswalk.
BifrostConnect Implementation Guide
The companion that maps each Part 1 control to a working architecture with Unified Out-of-Band Access™: product mapping, architecture and implementation hardening guidance.
Solution Matrix
BifrostConnect · Remote Access Types & Capabilities
| Remote Access Types | Direct Native Access | Clientless Tunnel Access | Direct Tunnel Access |
|---|---|---|---|
| Access Methods | KVM, Serial Terminal, SSH | IP, Serial | IP |
| Security & Control Coverage | |||
| Secure TransportEncrypted connection into the OT environment | Built-in = full KVM, Serial Terminal, and SSH control directly in the browser | Built-in | |
| Native Endpoint ControlDirect interaction with equipment (screen, keyboard, mouse, terminal) | Built-in = full KVM, Serial Terminal, and SSH control directly in the browser | When combined with AccessGuard provides remote desktop (browser-based local access with MFA and scoped application control) | |
| Session Accountability & Audit | |||
| Session AccountabilityProof of what happened: screen recording, keystroke logging, audit trail | Bifrost Manager audit log + SessionGuard operator-side screen recording and keystroke logging. | Bifrost Manager audit log + AccessGuard endpoint-side recording (H.264), local MFA, and scoped application access. | Bifrost Manager audit log + SessionGuard operator-side screen recording and keystroke logging. Add AccessGuard for dual-perspective forensic coverage (operator-side + endpoint-side recording). |
| Technical Description | |||
| What It Is | Browser-based hardware-level console access via WebRTC. Single Bifrost Unit connected to target equipment. No software installation on either side. | Hardware-to-hardware encrypted tunnel between two Bifrost Units. No software on either side. Pure hardware security boundary. | WireGuard-based IP tunnel via lightweight installed client application, connecting to a Bifrost Unit in the OT environment. Subnet mappings enable access to multiple endpoints, as well as enabling multiple operators/technicians to access the same endpoint in parallel. |
| Authorization | |||
| Authorization Methods |
Attended
Built-in TOTP in physical Bifrost unit, requiring on-site staff supervision. Unattended
Does not require on-site staff / no built-in TOTP in the hardware — still 2-factor when initiating access through Bifrost remote session interface. |
Unattended Does not require on-site staff / no built-in TOTP in the hardware — still 2-factor when initiating access through Bifrost remote session interface. |
|
| Advantages & Limitations | |||
| NB / Advantages & Limitations |
+ No software installations required + BIOS access + Out-of-the-box configuration (endpoint) + Production data stays on-prem + Physical view-only enforcement by removing USB cable + AD-HOC usability is very high – One-2-one access only – Requires video, mouse and keyboard I/O – Latency sensitive |
+ No software installations required / air-gapped tunnel + Extremely secure + Port-forwarding – One-2-one access only – Requires a Bifrost hardware unit in both ends – AD-HOC usability is medium to low due to dedicated hardware in both ends |
+ Time-based access if combined with Advanced Access Management Plan + One-2-one communication + One-2-many communication + Many-2-one communication + AD-HOC usability is high, after setting up subnet mapping and access rules in Manager – Currently no port-forwarding |
| Physical Installation | |||
| Physical Installation | Plugged directly into the equipment you need to control (e.g. computer, PC, tablet, smart screen, etc.) |
If the remote technician possesses the engineering licenses on their technician PC, then the Bifrost unit is plugged directly into the target equipment (e.g. PLC) or the same closed network. If the customer possesses the engineering licenses on-prem on an on-site engineering station or Virtual Machine license pool, then the Bifrost unit is connected to that or the same closed network. |
|
| Recommended Use Cases | |||
| The Best Option For | When you need native access and local control of the equipment, and/or you want physical assurance that no data leaves the premises, e.g. during: – Commissioning new equipment or sites (even installing a PC from remote) – Troubleshooting, rebooting or reinstalling operating systems – Incident response & recovery |
When you need IP or Serial based communication between the remote technician computer and the endpoint, and aren't allowed to install software neither client or agent side, AND the technician computer is not allowed to be online, e.g. when: – You need to use the software on the remote operator computer to interact with the endpoint – Or want to reach a remote desktop application on an engineering station or similar |
When you need IP based communication between the remote technician computer and the endpoint, and ARE allowed to install software on client side, the technician computer IS allowed to be online, and you need multi-user parallel access, e.g. when: – You need to use the software on the remote operator computer to interact with the endpoint – Or want to reach a remote desktop application on an engineering station or similar |
Access method: KVM, Serial Terminal, SSH
Security & Control Coverage
Secure Transport
Built-in = full KVM, Serial Terminal, and SSH control directly in the browser
Native Endpoint Control
Built-in = full KVM, Serial Terminal, and SSH control directly in the browser
Session Accountability & Audit
Session Accountability
Bifrost Manager audit log + SessionGuard operator-side screen recording and keystroke logging.
Technical Description
What It Is
Browser-based hardware-level console access via WebRTC. Single Bifrost Unit connected to target equipment. No software installation on either side.
Authorization
Authorization Methods
Attended
Built-in TOTP in physical Bifrost unit, requiring on-site staff supervision.
Built-in TOTP in physical Bifrost unit, requiring on-site staff supervision.
Unattended
Does not require on-site staff — still 2-factor through Bifrost remote session interface.
Does not require on-site staff — still 2-factor through Bifrost remote session interface.
Advantages & Limitations
NB / Advantages & Limitations
+ No software installations required
+ BIOS access
+ Out-of-the-box configuration (endpoint)
+ Production data stays on-prem
+ Physical view-only enforcement by removing USB cable
+ AD-HOC usability is very high
– One-2-one access only
– Requires video, mouse and keyboard I/O
– Latency sensitive
+ BIOS access
+ Out-of-the-box configuration (endpoint)
+ Production data stays on-prem
+ Physical view-only enforcement by removing USB cable
+ AD-HOC usability is very high
– One-2-one access only
– Requires video, mouse and keyboard I/O
– Latency sensitive
Physical Installation
Physical Installation
Plugged directly into the equipment you need to control (e.g. computer, PC, tablet, smart screen, etc.)
Recommended Use Cases
The Best Option For
When you need native access and local control, and/or you want physical assurance that no data leaves the premises, e.g. during:
– Commissioning new equipment or sites (even installing a PC from remote)
– Troubleshooting, rebooting or reinstalling operating systems
– Incident response & recovery
– Commissioning new equipment or sites (even installing a PC from remote)
– Troubleshooting, rebooting or reinstalling operating systems
– Incident response & recovery
Access method: IP, Serial
Security & Control Coverage
Secure Transport
Built-in
Native Endpoint Control
When combined with AccessGuard provides remote desktop (browser-based local access with MFA and scoped application control)
Session Accountability & Audit
Session Accountability
Bifrost Manager audit log + AccessGuard endpoint-side recording (H.264), local MFA, and scoped application access.
Technical Description
What It Is
Hardware-to-hardware encrypted tunnel between two Bifrost Units. No software on either side. Pure hardware security boundary.
Authorization
Authorization Methods
Attended
Built-in TOTP in physical Bifrost unit, requiring on-site staff supervision.
Built-in TOTP in physical Bifrost unit, requiring on-site staff supervision.
Unattended
Does not require on-site staff — still 2-factor through Bifrost remote session interface.
Does not require on-site staff — still 2-factor through Bifrost remote session interface.
Advantages & Limitations
NB / Advantages & Limitations
+ No software installations required / air-gapped tunnel
+ Extremely secure
+ Port-forwarding
– One-2-one access only
– Requires a Bifrost hardware unit in both ends
– AD-HOC usability is medium to low due to dedicated hardware in both ends
+ Extremely secure
+ Port-forwarding
– One-2-one access only
– Requires a Bifrost hardware unit in both ends
– AD-HOC usability is medium to low due to dedicated hardware in both ends
Physical Installation
Physical Installation
If the remote technician possesses the engineering licenses on their technician PC, then the Bifrost unit is plugged directly into the target equipment (e.g. PLC) or the same closed network.
If the customer possesses the engineering licenses on-prem, the Bifrost unit is connected to the on-site engineering station or the same closed network.
If the customer possesses the engineering licenses on-prem, the Bifrost unit is connected to the on-site engineering station or the same closed network.
Recommended Use Cases
The Best Option For
When you need IP or Serial based communication and aren't allowed to install software neither client or agent side, AND the technician computer is not allowed to be online, e.g. when:
– You need to use the software on the remote operator computer to interact with the endpoint
– Or want to reach a remote desktop application on an engineering station or similar
– You need to use the software on the remote operator computer to interact with the endpoint
– Or want to reach a remote desktop application on an engineering station or similar
Access method: IP
Security & Control Coverage
Secure Transport
Built-in
Native Endpoint Control
When combined with AccessGuard provides remote desktop (browser-based local access with MFA and scoped application control)
Session Accountability & Audit
Session Accountability
Bifrost Manager audit log + SessionGuard operator-side screen recording and keystroke logging. Add AccessGuard for dual-perspective forensic coverage (operator-side + endpoint-side recording).
Technical Description
What It Is
WireGuard-based IP tunnel via lightweight installed client application, connecting to a Bifrost Unit in the OT environment. Subnet mappings enable access to multiple endpoints, as well as enabling multiple operators/technicians to access the same endpoint in parallel.
Authorization
Authorization Methods
Unattended
Does not require on-site staff / no built-in TOTP in the hardware — still 2-factor when initiating access through Bifrost remote session interface.
Does not require on-site staff / no built-in TOTP in the hardware — still 2-factor when initiating access through Bifrost remote session interface.
Advantages & Limitations
NB / Advantages & Limitations
+ Time-based access if combined with Advanced Access Management Plan
+ One-2-one communication
+ One-2-many communication
+ Many-2-one communication
+ AD-HOC usability is high, after setting up subnet mapping and access rules in Manager
– Currently no port-forwarding
+ One-2-one communication
+ One-2-many communication
+ Many-2-one communication
+ AD-HOC usability is high, after setting up subnet mapping and access rules in Manager
– Currently no port-forwarding
Physical Installation
Physical Installation
If the remote technician possesses the engineering licenses on their technician PC, then the Bifrost unit is plugged directly into the target equipment (e.g. PLC) or the same closed network.
If the customer possesses the engineering licenses on-prem, the Bifrost unit is connected to the on-site engineering station or the same closed network.
If the customer possesses the engineering licenses on-prem, the Bifrost unit is connected to the on-site engineering station or the same closed network.
Recommended Use Cases
The Best Option For
When you need IP based communication, ARE allowed to install software on client side, the technician computer IS allowed to be online, and you need multi-user parallel access, e.g. when:
– You need to use the software on the remote operator computer to interact with the endpoint
– Or want to reach a remote desktop application on an engineering station or similar
– You need to use the software on the remote operator computer to interact with the endpoint
– Or want to reach a remote desktop application on an engineering station or similar
+ Advantage
– Limitation