Privileged remote access for operational technology (OT)/internet of things (IOT)/industrial IOT (IIOT)/industrial control system (ICS) infrastructure

A non-transitory computer-readable medium comprising instructions for privileged remote access to Operational Technology (OT)/Internet of Things (IOT)/Industrial IOT (IIOT)Industrial Control System (ICS) infrastructure, the instructions are executable by a cloud-based system to perform steps of:

• responsive to determining a user can access a specific application associated with the OT/IOT/IIOT/ICS infrastructure, determining a user's security and access policies and creating a session for the user;
• establishing a secure connection to the application via a lightweight connector associated with the specific application;
• and
• brokering a connection between a user's device and the application through the lightweight connector, enabling the user to interact with the application for the OT/IOT/IIOT/ICS infrastructure, based on the user's security and access policies, wherein the connection only provides access to the specific application allowed by a central authority and does not place the user's device on a network associated with the application, wherein the central authority maintains-independent of any user session, mutually authenticated persistent control-plane connections with each of a plurality of cloud-based enforcement nodes distributed across a cloud service, wherein the persistent control-plane connections are used to distribute tenant-specific access policies and certificate-based tokens to the enforcement nodes in real time, and wherein each enforcement node, distinct from the user's device and distinct from the lightweight connector, brokers and enforces secure access control for user sessions to the specific application by terminating a first secure session from the user's device at the enforcement node and establishing, based on at least one of the tenant-specific access policies or the certificate-based tokens, a second secure session from the enforcement node toward the lightweight connector.