Remote Server Login
RDP · SSH · Jump hosts
Read more
Network · NetApp · Cisco ISE · OT
Device Administration MFA
Multi-factor authentication over network device administration, storage management, Cisco ISE policy administration and operational technology consoles — the accounts with the widest blast radius.
The challenge
Why this one is hard.
Network and infrastructure consoles are usually protected by a shared local credential that a handful of engineers know and nobody rotates. They rarely appear in identity projects because they are not user accounts in the usual sense.
They are also the accounts that let an attacker turn a foothold into control of the environment — changing routing, disabling logging, or opening a path into an operational network that was supposed to be segmented.
What changes
| Before | After |
|---|---|
| A shared console password known to several engineers. | Named identities, each with its own second factor. |
| No way to attribute a configuration change. | Every administrative action ties back to a person. |
| Consoles in signal-free plant areas are exempted. | Offline modes remove the need for an exception. |
How it works
Four steps from decision to evidence.
01
Front with RADIUS
Network devices, storage controllers and policy servers authenticate administrators against the platform.
02
Replace shared logins
Named administrator identities replace the shared local credential, so actions are attributable.
03
Add the second factor
Administrative access requires out-of-band approval, with offline modes for consoles in restricted areas.
04
Broker and record
Where privileged access management is in scope, the session itself is brokered and recorded.
Capabilities
What you get.
- MFA over network device and storage administration
- Cisco ISE policy administration protection
- Coverage for operational technology consoles
- Offline authentication for areas with no mobile signal
- Named identities in place of shared local credentials
- Optional session brokering and recording through PAM
Supported
- Network
- Cisco ISE · switches and routers supporting RADIUS · firewalls
- Storage
- NetApp and other RADIUS-capable controllers
- OT
- Operational technology consoles reachable over RADIUS or the REST API
- Auth modes
- Offline modes included for restricted and signal-free areas
Questions
What buyers ask about this.
If yours is not here, our team will answer it directly.
Ask usYes. Offline authentication modes — CR-OTP by display, TOTP, GRID and FIDO2 token passkeys — need no mobile internet, which is why they exist. This is one of the most common reasons manufacturing customers choose the platform.
In most cases the authentication decision happens outside the operational network, at the point of administrative access. We scope this carefully with your engineering team, because OT availability requirements are not negotiable.
MFA proves who the administrator is. Privileged access management governs what they may then do — vaulting the credential, granting elevation just in time and recording the session. Many customers deploy both over the same consoles.
See this working on your own systems.
Bring the system you are worried about and we will show you exactly how this control would be applied to it.