Battery energy storage sites are high-value, safety-critical and increasingly targeted. They also need frequent remote access — operators watching state of charge, and OEM engineers logging into controllers to diagnose and tune. The tension is obvious: how do you let the right people in remotely without exposing operational technology to the internet? Get this wrong and a convenient remote-access shortcut becomes the way in for an attacker.
The wrong way (and why it's common)
The quickest fix — port-forwarding straight to a PLC or HMI, or leaving a vendor's remote-access tool wide open — is also the most dangerous. It puts control systems one weak password or unpatched vulnerability away from the open internet. On a grid-connected, safety-critical asset, that's not a risk worth taking for the sake of convenience.
The principle: separate, then control access
Good OT security starts with segmentation — the control network is kept firmly apart from CCTV, corporate and guest traffic, so a problem in one can't spread to another. Remote access is then granted through a controlled path, not around it.
What a secure BESS setup looks like
- Network segmentation isolating OT from everything else, with strict rules on what can talk to what.
- A managed firewall at the boundary — OT-aware, patched and monitored, not a consumer router.
- Encrypted VPN access for engineers and vendors, so nothing sits exposed — see SD-WAN & VPN.
- Least-privilege access — people and vendors reach only the systems they need, and access is logged.
- A cyber security assessment to find the gaps before someone else does, with a remediation plan.
- Resilient, monitored connectivity underneath it all, so the site stays reachable and visible.
Convenience and security aren't opposites
Done properly, secure access is also better access: engineers get a reliable, logged way in from anywhere, vendors are boxed into just what they need, and you get a clean audit trail — all without your controllers ever facing the internet. That's the standard any grid-connected BESS should be held to.