The short answer
Session Logging
Session logging captures every remote session at each layer it passes through: the VPN or remote access service logs the account, the source address, the time, and the factor used; the jump host logs the login and, on a jump host that supports it, records the session as video or a keystroke transcript; the SCADA audit trail logs what the user viewed, commanded, and changed; the controller programming software and the controller itself log downloads, online edits, and mode changes; and the firewall logs the connections the session made. All of it is forwarded to a log collector that the session cannot reach, retained for a period the policy sets, reviewed on a schedule for sessions that were not scheduled and actions that were not expected, and matched against change records. When a program change is detected or an incident occurs, the logs are the record of who was in the system and what they did.
Key points
- Every layer logs: VPN, jump host, SCADA, controller, firewall. Together they say who, from where, when, to what, and what happened.
- Session recording on the jump host turns a login entry into a replayable record of the work.
- Logs go to a collector the session cannot touch; a log on the machine being used is a log the intruder can edit.
- Review weekly for the unscheduled and the unexpected; every vendor session is checked against its change record.
- Retain long enough for an investigation to look back months; a year is common.
- Tell the people they are recorded; it is policy, it is in the contract, and it changes behavior.
The layers
| Layer | What it logs | Where it goes |
|---|---|---|
| VPN or remote access service | Account, source address, connection and disconnection time, authentication result, factor used, data volume | Collector |
| Jump host operating system | Logins and logouts, processes started, files transferred | Collector |
| Jump host session recording | A video or transcript of the session: every screen and keystroke, replayable | Recording store, indexed by account and time |
| SCADA audit trail | Displays opened, alarms acknowledged, commands issued, setpoints changed, configuration edited, with the account and the station | The audit database, forwarded to the collector |
| Controller programming software | Connections to controllers, downloads, online edits, mode changes, with the workstation account | Collector where the software supports it; otherwise the workstation log |
| Controller | Change counter, program signature, audit log on platforms that keep one, mode changes | Polled by the SCADA and alarmed; the log forwarded where supported |
| Firewall | Connections permitted and denied between the jump host and the control network, with ports and times | Collector |
| Vault | Credentials retrieved during the session window | Vault audit log |
Session recording
A login entry says that an account connected at a time; a session recording shows what they did. Jump hosts built for privileged access record every session as a video of the screen, a transcript of the commands, or both, indexed so that a reviewer can find the session for a given controller on a given day and watch it. The recording is what turns a detected program change into an answer in minutes: the change was made in this session, by this account, and here is the edit. It is also what makes vendor sessions reviewable by someone who was not watching in real time. Recording is announced to the user at login, written into the vendor contract and the staff policy, and stored where the user cannot reach it.
Off the box
A log that lives on the machine that produced it can be edited or deleted by anyone who controls that machine, and an intruder controls it. Logs are forwarded as they are written to a collector on a separate hardened server, in the supervisory zone or the DMZ with a one-way path, with its own accounts and its own backup. The collector is the record of last resort: when the jump host is rebuilt after an incident, the collector still has every session. It is also where review happens, in one place, across every layer.
Review
- 1
Weekly
A named person reads the sessions of the week: each against the schedule and the change records. Unscheduled sessions, sessions from unexpected addresses or hours, failed authentications in volume, and sessions by accounts that should be disabled are investigated.
- 2
Every vendor session
The recording is reviewed against the change record: did they do what was approved and nothing else. A review that takes ten minutes per session catches the undocumented change while it is fresh.
- 3
On every detection
A program change alarm, a firewall denial, or a new device is matched against the session logs for the window; the session that explains it closes the alert, and the absence of one opens an incident.
- 4
Quarterly
The accounts with remote access against the staff and vendor lists; the retention against the policy; the collector health.
- 5
Annually
A test that the logs from each layer actually arrive at the collector, that a recorded session can be replayed, and that a query across the layers for one account on one day produces a coherent story.
Retention and privacy
Logs are kept long enough for an investigation to look back to the beginning of an intrusion, which is often months; a year online and longer in archive is a common policy, with recordings of vendor sessions kept for the life of the change record. The logs and recordings contain what people typed, including mistakes and, sometimes, credentials; they are access-controlled, retained per policy, and destroyed per policy. Staff and vendors are told in writing that sessions are logged and recorded, which is required in some jurisdictions and is the right thing to do in all of them.
Frequently asked questions
- Our jump host is a plain remote desktop server. Can it record?
- Not natively, in most cases. Privileged access products and some remote access services add session recording; a plain server can at least forward its logins and process logs to the collector and the SCADA audit trail covers what was done in the SCADA. Recording is the upgrade to plan for; the collector and the review are the habit to start now.
- Do we log the operators in the control room too?
- The SCADA audit trail logs their actions by their individual account, which is the record that matters. Session recording is for remote and privileged access, where the person is not in the room and the actions are configuration rather than operation.
- What if the vendor objects to being recorded?
- It is a condition of remote access, written in the contract, and most vendors accept it because it protects them too: the recording shows they did what was agreed. A vendor that will not be recorded is escorted on site instead.
- How much storage do recordings need?
- Session video compresses well; a typical engineering session is tens of megabytes, and a year of vendor sessions at a small utility fits on a modest disk. Transcripts are smaller still. The collector for text logs needs more planning than the recordings.
Related topics
- Jump HostsThe one machine every remote session must pass through: what a jump host is, how it is hardened, what it may reach, session recording, the tools it carries, and why a vendor laptop never gets past it.
- Vendor Remote AccessIntegrators and equipment vendors need to get in. How to let them without leaving a permanent door open: utility-controlled sessions, named accounts, MFA, a jump host, session recording, and what to do about the modem you did not know was there.
- VPN DesignHow a VPN fits remote access for a control system: it terminates in the DMZ and lands on a jump host, never the control network; site-to-site tunnels carry telemetry; user tunnels require multi-factor and individual accounts; the concentrator is patched fast.
- Program Change DetectionKnowing when a controller program changed and whether it was supposed to: change counters and signatures the SCADA can alarm on, scheduled compares, audit logs, mode and network monitoring, what each catches, and what to do when one fires.
- Firewall Logging and ReviewMaking the firewall log useful: logging on every rule including sensitive permits, sending logs to a collector off the firewall, what denials and unexpected permits mean, a weekly review a small utility can sustain, and the alerts worth waking someone for.
- User Accounts and RolesWho can do what on the SCADA and how it is enforced: roles from view-only to administrator and their permission matrix, individual accounts including the operator console, service and vendor accounts, same-day offboarding, and the quarterly review.
Direct contact
Have a controls question?
Reach Eric Sullivan directly about anything on this site, a controls or automation topic, or one of his personal projects.