ot-remote-access-auditlisted

## When to Use - Reviewing remote paths before an account hygiene pass. - Responding to a vendor remote session incident. - Validating that every remote path enforces MFA. - Change review for a new VPN headend or jump host. ## Prerequisites - VPN headend config exports, CA and AAA logs, jump host session logs. - Authorized vendor account and contact list. - Site modem and cellular router inventory. - Credentials: read-only to the VPN and jump host configs, or an evidence pack from the platform owner. - Authorization: IT and OT owner sign-off. Config inspection is passive. A live path test is gated. - Upstream skills: none. ### Safety This skill is passive by default. Active steps are gated in the Workflow section. - Passive. Config and log review. Sends no packets. Safe to run during normal operations. ## Workflow 1. Load the config exports and logs. 2. Enumerate every remote path into OT: site-to-site VPN, remote-access VPN, vendor tunnel, modem, cellular router. 3. For each path record: endpoints, protocol, owner, MFA status, session logging status, session duration limit. 4. Decision point: a path with no MFA is a High finding. Move it to the top of the findings list. 5. Check session logging. Jump host and VPN sessions must produce audit records readable for 90 days. Missing logs are findings. 6. Check the authorized user list against the accounts. An account that connects but appears in no authorization record is a finding. 7. Optional live verification of one ju