{"id":3859,"date":"2026-11-06T23:51:18","date_gmt":"2026-11-06T15:51:18","guid":{"rendered":"https:\/\/cnbygele.com\/?p=3859"},"modified":"2026-11-06T23:51:19","modified_gmt":"2026-11-06T15:51:19","slug":"meter-change-access-revocation","status":"publish","type":"post","link":"https:\/\/cnbygele.com\/pt\/blog\/meter-change-access-revocation\/","title":{"rendered":"Acesso Tempor\u00e1rio \u00e0 Manuten\u00e7\u00e3o do Medidor: Revoga\u00e7\u00e3o e Verifica\u00e7\u00f5es de Encerramento"},"content":{"rendered":"

Power meter temporary maintenance access revocation is the controlled removal of the accounts, sessions, network paths, and permissions created for a specific maintenance task. Close the work with the local operating owner, confirm any running activity has reached a known state, remove the approved temporary access, and verify that it cannot be used again. Closing a remote desktop window alone does not prove that an account, session, token, firewall exception, or background service has lost access.<\/p>\n

The relevant controls usually belong to an external gateway, maintenance host, remote-access service, or site network. They should not be assumed to exist inside a panel meter. For a CNBYG installation, document the actual instrument and communication arrangement, then identify which system grants maintenance authority. This guide describes a closeout workflow, not commands for interrupting a live industrial process.<\/p>\n

Start with a task-specific access record<\/h2>\n

A good closeout starts before access is granted. Record the named maintainer, organization, task, approved target, permitted actions, operating window, local contact, and planned termination method. Avoid an open-ended authorization such as support access to the plant. The person approving the work should understand which assets and functions the permission covers.<\/p>\n

Distinguish instrument communications from administrative access. A serial connection used by a gateway to read documented measurements is not the same as an engineer signing into that gateway. The meter communication setup guide<\/a> explains the measurement-side context, while the gateway and access-service documentation define their own administrative controls.<\/p>\n

The BY194 family<\/a> includes product context for the installation. Confirm the exact supplied variant and options separately. Do not infer that it has a user-account system, VPN, remote desktop, audit log, or remotely revocable credentials. Label each access control with the system that actually implements it.<\/p>\n

Separate the layers that need to be closed<\/h2>\n

An access path can contain several independent permissions. A vendor identity may authenticate to a remote-access broker, open a network connection, log into a maintenance host, and then use an application account. Removing one layer can leave another available. Conversely, disabling a shared infrastructure account can affect unrelated operating work.<\/p>\n

Build a short path diagram or list from the approved entry point to the target. Identify who owns each layer and how its removal will be verified. Include temporary firewall rules, local users, service credentials, shared folders, uploaded tools, and any scheduled tasks created for the work. Only include items actually used or approved; do not invent an architecture from a generic example.<\/p>\n

NIST’s Guide to OT Security<\/a> recommends limiting remote access to justified business needs and removing it when no longer required. It also treats reliability and safety as essential constraints. Therefore, access removal must be planned with the operating owner rather than performed as an unreviewed network interruption.<\/p>\n

Agree the operational stopping point<\/h2>\n

Ask the maintainer to identify what is currently running before ending the session. A file transfer, configuration application, database operation, or firmware task may continue after a window closes. Determine whether the work is complete, needs a supported cancellation, or requires an approved extension. Do not assume disconnecting a channel reverses changes already made.<\/p>\n

The local owner should confirm the current condition of the acquisition chain and any affected process. Where the work concerns monitoring only, verify expected collection and displays through the normal operating procedure. Where it affects control or protective functions, use the site’s stricter authorization and safety process. This article does not authorize operating electrical equipment or changing protection settings.<\/p>\n

If a task is incomplete, record the remaining scope and a responsible decision. Extending access should be an explicit new approval with a defined limit. Quietly leaving an account enabled for convenience converts temporary access into an undocumented standing arrangement, making later closeout much harder to verify.<\/p>\n

\n\n\n\n\n\n\n\n\n\n\n
Layer<\/th>\nCloseout evidence<\/th>\nWhat a single action does not prove<\/th>\n<\/tr>\n<\/thead>\n
Work authorization<\/td>\nTask completed, cancelled, or explicitly extended<\/td>\nA closed ticket does not disable technical access<\/td>\n<\/tr>\n
Remote identity<\/td>\nTemporary account disabled or expired as approved<\/td>\nAccount removal may not end an existing session<\/td>\n<\/tr>\n
Connection path<\/td>\nApproved temporary route or exception removed<\/td>\nOne blocked route does not exclude other routes<\/td>\n<\/tr>\n
Host or application session<\/td>\nSession ended using the supported method<\/td>\nEnding a window does not necessarily stop background work<\/td>\n<\/tr>\n
Temporary tools and files<\/td>\nApproved removal or retained-file record<\/td>\nDeleting a shortcut does not remove installed services<\/td>\n<\/tr>\n
Operating condition<\/td>\nLocal owner confirms expected acquisition or process state<\/td>\nSuccessful login denial does not prove the plant is normal<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

The matrix is a review aid. The site’s approved system procedure determines the actual sequence, especially when disabling one component could affect another service.<\/p>\n

\"CNBYG
Conceptual external system review with the reference BY194 appearance; surrounding props do not establish built-in meter functions.<\/figcaption><\/figure>\n<\/p>\n

Remove access using supported controls<\/h2>\n

Have the responsible administrator apply the approved account and route changes. Use documented service controls rather than deleting files or killing processes without understanding their role. Preserve the change record and relevant audit evidence. Avoid publishing literal usernames, internal addresses, or credential material in a general closeout report.<\/p>\n

Where a shared account was used, the owner must assess how to retire or restrict the temporary authority without disrupting other authorized users. A password change can have consequences for services and scheduled jobs. Treat it as a controlled change with dependency checks, not a universal one-step fix. Prefer individually attributable access in future work where the system supports it.<\/p>\n

Review any alternate path created during troubleshooting. A temporary local account, emergency tunnel, modem, or uploaded remote tool can remain after the primary route closes. Check against the original access record and the maintainer’s change list. Do not scan or probe unrelated industrial assets outside the approved scope to demonstrate thoroughness.<\/p>\n

Verify denial and verify continued operation separately<\/h2>\n

Use an approved test to establish that the removed identity or route can no longer perform the previously authorized action. Record the test scope, time, operator, and observed result without exposing secrets. If the platform distinguishes new connections from existing sessions, verify both through its supported administration tools. A failed new login alone is not evidence that an old session ended.<\/p>\n

Then verify the normal operating path. Confirm that the intended gateway continues collecting the documented measurements and that expected users retain their approved access. If a gap occurred, preserve it in the maintenance data-gap record<\/a>. Do not fill or delete missing intervals merely to make the closeout look uneventful.<\/p>\n

NIST’s remote access guidance for operational environments<\/a> provides broader context for access architecture. A reference architecture is not proof that your installed arrangement is secure or that a specific removal test is sufficient. Record the actual controls and limitations observed on site.<\/p>\n

Preserve evidence without oversharing<\/h2>\n

A closeout package should contain the task reference, approved access window, systems affected, administrator actions, test results, operating confirmation, and outstanding items. Reference protected logs rather than attaching unrestricted raw exports. Use the diagnostic capture guide<\/a> to preserve a traceable link between observations and the case.<\/p>\n

Keep the distinction between a configured expiry and a verified expiry. A screenshot showing an intended expiration time documents configuration; a later check documents whether the permission actually ended. If automatic expiry failed, correct the control and investigate according to local policy. Do not silently adjust the report to imply that automation worked.<\/p>\n

If access cannot be removed safely at the planned time, escalate to the named operating and security owners. Record the reason, temporary restrictions, monitoring arrangement, and next decision time. This is a controlled exception, not a completed closeout. The person receiving the report should see the remaining exposure and who is responsible for resolving it.<\/p>\n

Understand asynchronous work before disconnecting<\/h2>\n

Maintenance software can launch operations that outlive an interactive session. That is why a channel, an account, and a running job need separate attention. A file copied through a session can remain on disk; a scheduled job can run later; a configuration change can persist indefinitely. Ending communication does not automatically undo these effects.<\/p>\n

The following neutral computing lesson explains race conditions and shared state. It helps illustrate why timing and independent activity matter during closeout. It is conceptual learning rather than a demonstration of the installed gateway, an access-control recommendation for every site, or a procedure for interrupting equipment.<\/p>\n