The convergence of industrial operational technology (OT) and corporate IT is inevitable, yet it presents unprecedented challenges for technical leaders. Attempting to integrate industrial Internet of Things (IIoT) telemetry into cloud or ERP systems often provides external access to legacy and vulnerable technological systems. In critical infrastructure, this necessitates a shift from reactive patching to security by design based on international standards.
Traditional industrial equipment was designed with a priority on process continuity rather than confidentiality. It lacks built-in security features and cannot be updated quickly. Therefore, secure IIoT integration requires architectural network segmentation according to the ISA/IEC 62443 standard and the use of the OPC UA protocol as a native authentication tool at the IT/OT boundary.
Why the classic IT security approach fails in operational technology
In corporate IT, security is built around data confidentiality. However, in operational technology, according to NIST SP 800-82 guidelines, this priority shifts: availability and physical process safety come first. Stopping a controller for vulnerability scanning or automatic updates can lead to production shutdowns or industrial accidents.
Most existing programmable logic controllers (PLC) and remote terminal units (RTU) use industrial protocols without encryption. Replacing such legacy equipment is technically complex and often economically unfeasible. Therefore, the only correct approach is not to try to "install antivirus on a PLC," but to strictly isolate these systems at the network architecture level, making direct connections from the corporate network or the internet impossible.
Anatomy of the ISA/IEC 62443 standard: designing security zones and data channels
The ISA/IEC 62443 standards were developed specifically for industrial automation and control systems (IACS) and are currently used successfully in over 20 different industries. Their fundamental principle is security by design.
The foundation of the standard is the concept of Zones and Conduits:
- Zone: A logical or physical grouping of assets that share common security requirements (e.g., a safety instrumented system zone or a plant-wide controller zone).
- Conduit: The only permitted path for data exchange between zones, where strict firewall, filtering, and encryption rules are applied.
Such segmentation prevents the lateral movement of threats. If an attacker gains access to the corporate IT segment, ISA/IEC 62443 zones block their path to the industrial equipment.
OPC UA as the foundation for secure data transport: encryption and authentication without compromise
Secure transport is required to transmit telemetry between isolated zones. The OPC UA protocol has become the de facto industrial standard. However, it is a mistake to assume that OPC UA solves all security problems on its own. It is effective only when integrated into a broader security zone architecture.
OPC UA provides security at several levels:
- Transport layer encryption to ensure data integrity and confidentiality.
- Mutual authentication (mTLS) of clients and servers using X.509 certificates, ensuring access only for verified devices.
- Authorization at the level of individual data tags.
Architectural scenario: secure telemetry extraction from the shop floor to the cloud via an edge gateway
In accordance with AWS Well-Architected IoT Lens recommendations, reliable IoT solutions require a clear distinction between edge processing and cloud processing. To extract data without compromising the OT network, an industrial edge gateway is used.
The gateway is installed at the boundary of a zone (within a Conduit). It locally collects data from controllers via insecure protocols (Modbus, Profinet) and converts it into a secure stream. The golden rule: the gateway must use outbound-only connections. It initiates the session to the cloud broker (e.g., via MQTT) itself. All inbound ports on the firewall from the global network remain closed.
If the collected data is subsequently used for artificial intelligence algorithms, the architecture must comply with risk management requirements, such as NIST AI RMF 1.0, ensuring that AI analytics cannot gain unauthorized reverse access to control critical physical processes.
To implement such projects, Softengi provides custom development of IoT/embedded solutions, designing architecture based on security by design principles and integrating secure edge gateways. The Intecracy Group, an alliance of independent companies linked by partner agreements and share exchanges, also offers the AZIOT Platform—a specialized industrial IoT platform that supports MQTT and Modbus, ensures data collection at the edge level, and integrates easily with SCADA without violating critical infrastructure security perimeters.
Practical steps for auditing and preparing the OT segment for IIoT integration
- Asset inventory: Identification of all existing L1-L2 devices, communication protocols, and their criticality (availability).
- Network zoning: Dividing the infrastructure into isolated segments (Zones) based on ISA/IEC 62443 criteria.
- Conduit design: Installation of edge gateways with outbound-only configuration.
- Secure initialization implementation: Using strict provisioning protocols for a large fleet of IIoT sensors to ensure a uniform security state (certificate lifecycle management).
Matrix of secure IT/OT integration according to ISA/IEC 62443 and OPC UA standards
| Infrastructure level | Typical risk | Architectural solution |
|---|---|---|
| Field device level (L1-L2) | Direct external access to controllers; interception or spoofing of unencrypted local traffic. | Complete isolation of devices into a separate zone. Data collection only via a local Edge gateway or OPC UA server with certificate-based authorization. |
| Edge gateway | Compromise of the gateway from the external network for lateral movement into the OT segment. | Use of strict firewall rules (Conduits). Implementation of unidirectional gateways (data diodes) and blocking of all inbound connections. |
| Cloud / ERP level (L4-L5) | Leakage of production telemetry or attempts to send malicious commands in the reverse direction. | Data transmission initiated exclusively from within the OT network (outbound-only). Use of TLS 1.3 and mTLS mechanisms for data exchange. |
Secure IIoT integration is primarily a matter of engineering discipline that protects critical processes from cyber threats while maintaining the benefits of digital transformation for the business.
FAQ
How does the ISA/IEC 62443 standard help protect legacy equipment that cannot be updated?
The standard shifts the focus from updating each individual device to isolating vulnerable assets. Legacy equipment is placed in a secure 'Zone,' and any communication with it from the outside is conducted exclusively through a strictly controlled 'Conduit,' which eliminates the need for direct connections between legacy devices and the enterprise network.
What is the difference between security at the OPC UA protocol level and general network architectural security?
OPC UA is a transport layer technology. It provides data encryption and client-server authentication during information transfer. However, the protocol itself cannot protect the network from lateral threat movement or DoS attacks. General architectural security (ISA/IEC 62443) is responsible for segmentation and access control at the entire infrastructure level.
How can data transmission from an industrial gateway to the cloud be configured correctly without violating critical infrastructure security requirements?
The key approach is an outbound-only configuration. The industrial edge gateway must independently initiate the connection to the cloud. At the same time, the firewall protecting the OT segment must completely block any inbound requests from the IT network or the internet, making the gateway invisible to external scanning.