The convergence of operational technology (OT) and corporate IT environments offers immense potential for analytics, process optimization, and predictive maintenance. However, integrating factory-floor equipment into general IoT networks introduces significant security risks. As these connections grow, architectural segmentation based on the ISA/IEC 62443 standard becomes a critical requirement for ensuring production continuity.
The primary challenge for CTOs and automation leads is connecting legacy equipment (PLC, SCADA) to modern cloud platforms without risking production line shutdowns due to cyberattacks. Traditional security methods, such as installing antivirus agents, are often impossible in these environments due to the limitations of legacy systems and strict requirements for continuous technological processes.
Why classic IT security fails in OT environments: the priority of availability
In traditional corporate IT, the primary goal of security is often data confidentiality. In operational technology and industrial control systems, the priorities are fundamentally different. According to the NIST SP 800-82 (Guide to OT Security), availability and integrity are the absolute priorities over confidentiality in an OT environment.
Any network packet delay of even a few milliseconds or the accidental blocking of legitimate traffic by a security system can lead to the emergency shutdown of a turbine, conveyor, or compressor. Furthermore, it is physically impossible to install traditional security software on older industrial controllers (PLC) because they lack the necessary computing resources, and real-time operating systems do not support such software.
Directly connecting a controller to the corporate network for telemetry collection creates an ideal vector for lateral movement by attackers. This is why the protection of the industrial segment is built not at the endpoint level, but at the level of network architecture and deep segmentation.
The Zones and Conduits concept: designing security boundaries per IEC 62443
The ISA/IEC 62443 standard, which covers over 20 industries using operational technology, offers a fundamental approach to industrial cybersecurity: the concept of Zones and Conduits.
- Zone: A logical or physical grouping of assets (e.g., PLC, SCADA servers, sensors) that share common security requirements and a unified risk profile.
- Conduit: A single authorized path for data exchange between zones. Traffic crossing a zone boundary must be strictly controlled.
Instead of building a flat network, architects divide the production site into isolated segments. For example, critical safety instrumented system (SIS) controllers are placed in a separate zone with the highest level of trust, while auxiliary IoT temperature sensors used for monitoring are placed in a different zone. This ensures that the compromise of the auxiliary sensor network does not affect the primary production line.
The bridge between SCADA and the cloud: the role of OPC UA and edge computing
How can data be safely transferred from an isolated OT zone to the cloud or a corporate system? Connecting SCADA directly to the internet is dangerous. According to the AWS Well-Architected IoT Lens, the reliability and security of a solution are established during the three-tier architecture phase: device → edge → cloud.
Edge computing allows for local collection, filtering, and normalization of telemetry. Instead of a direct connection, an industrial edge gateway is installed. It polls the PLC using legacy, insecure protocols (e.g., Modbus) within an isolated local zone. The gateway then converts this data and transmits it to a higher level via the OPC UA protocol.
OPC UA provides a platform-independent architecture for reliable interoperability between SCADA, manufacturing execution systems (MES), and corporate systems. However, it is important to understand that the mere presence of OPC UA does not automatically secure the system. For secure inter-system exchange, it is mandatory to activate mutual authentication via X.509 certificates and traffic encryption at the gateway level.
A step-by-step algorithm for network segmentation without production downtime
Segmenting an active industrial network requires caution to avoid interrupting the technological process. The basic algorithm includes the following steps:
- Passive audit: Use port mirroring (SPAN) to collect and analyze network packets without interfering with device operation. This allows for mapping the actual interdependencies of assets.
- Zone design: Distribute systems into logical levels (according to the Purdue model) and define security boundaries.
- Isolation via gateways: Implement edge gateways to connect legacy equipment that does not support modern encryption protocols.
- Gradual activation of filtering: Configure firewall rules in logging mode. Once it is confirmed that legitimate technological traffic is not being blocked, the rules are switched to active blocking mode for unauthorized connections.
Integrating security into the enterprise ecosystem: the technological foundation
Implementing an architecture that complies with IEC 62443 requirements requires experts with a deep understanding of IoT and embedded systems. Softengi, a member of the Intecracy Group—an alliance of independent companies linked by partner agreements and share exchanges—has extensive experience in designing secure edge architectures, integrating industrial protocols, and developing local gateways for isolating legacy equipment.
To create reliable data collection systems at the network edge, enterprises can utilize the capabilities of the AZIOT Platform (from AZIOT, also a member of the Intecracy Group). The platform ensures telemetry collection from sensors via MQTT and Modbus, local event processing, and secure integration with SCADA, minimizing the attack surface.
When there is a need to aggregate this technological data at the corporate level, manage incidents, and create secure analytical dashboards, solutions are often built on the UnityBase platform. This is a full-stack JavaScript low-code platform, which is a joint development of Intecracy Group companies (where InBase acts as a key, but not the only, developer). Thanks to built-in access control mechanisms (RBAC, RLS) and detailed audit trails, UnityBase allows for the creation of a reliable management layer over the isolated OT perimeter, ensuring that access to sensitive production analytics remains strictly controlled.
Architectural audit checklist for the IoT/OT segment before IEC 62443 certification
- Asset identification: A complete map of all PLCs, SCADA nodes, and IoT sensors has been compiled, including firmware versions.
- Zone boundaries: Critical safety systems (SIS) are isolated into separate physical or logical zones, separated from general IoT sensors.
- Conduit control: All traffic between zones passes through firewalls with deep packet inspection (DPI) for industrial protocols.
- Legacy device isolation: Legacy controllers that do not support encryption are connected exclusively through local edge gateways.
- OPC UA level authentication: Mutual authentication via X.509 certificates is activated for inter-system exchange, rather than relying solely on passwords.
FAQ
How can IT and OT networks be separated according to the IEC 62443 standard?
Separation is achieved by creating isolated logical or physical zones based on process criticality and configuring strictly controlled communication channels (conduits). All inter-network traffic must undergo inspection and filtering, which prevents direct, uncontrolled communication between corporate and factory-floor segments.
Is it possible to connect SCADA directly to the cloud via OPC UA?
Connecting SCADA systems directly to the internet environment creates high risks. According to best practices, a three-tier architecture (device-edge-cloud) is used, where data is first collected by a local edge gateway, normalized, and only then transmitted to a higher level via the OPC UA protocol with mutual certificate-based authentication.
How can old PLC controllers be protected from cyberattacks without installing software?
Legacy equipment protection is implemented through network isolation. Data collection is performed via local industrial gateways that poll controllers using legacy protocols within a secure zone and then safely transmit the data externally, acting as a barrier against external threats.