The rise in cyber incidents within critical infrastructure necessitates a fundamental review of architectural approaches. According to the ENISA Threat Landscape 2025 report, organizations categorized as essential entities under the NIS2 directive accounted for 53.7% of all cyberattack victims between July 2024 and June 2025. This statistic clearly demonstrates that directly merging corporate IT systems with Operational Technology (OT) networks is an unacceptable risk. Businesses objectively require real-time data for analytics, but this cannot be achieved by compromising the security perimeter. Secure IT/OT convergence requires abandoning direct connections in favor of strict segmentation according to the ISA/IEC 62443 standard via industrial DMZs and gateways.
Why direct ERP and SCADA integration is a high-risk architectural error
Under pressure to provide end-to-end analytics, developers often choose the simplest path: synchronous point-to-point integration. Directly connecting an ERP system to SCADA databases or querying programmable logic controllers (PLCs) creates an end-to-end vector for transit attacks. If an attacker compromises a workstation in the corporate network, they gain the ability to directly interfere with technological processes. Such connections ignore the concept of level isolation (Purdue Model), turning any vulnerability in the business network into a threat of physical production shutdown.
The Zones and Conduits concept in ISA/IEC 62443: isolating critical processes
The ISA/IEC 62443 standard, which covers over 20 industrial automation sectors, offers a fundamental approach to protection: the Zones and Conduits concept. Infrastructure is divided into logical or physical asset zones with shared security requirements. For example, the PLC level and the SCADA level form separate trusted zones.
A conduit is the only authorized path for data exchange between zones. Any inter-zone traffic must pass exclusively through such a channel, utilizing filtering and access control. Direct packet transit between non-adjacent zones is strictly prohibited, which helps minimize the blast radius in the event of a node compromise.
Designing an industrial DMZ: a demilitarized zone for data exchange
To securely transfer information between IT and OT, an industrial DMZ (IDMZ) is created. Its primary rule: no network packet should pass directly from the corporate network to the technological one through both perimeters. Consider this implementation example:
- An OT system (e.g., Historian) replicates accumulated data to an intermediate server within the IDMZ.
- The connection is initiated exclusively from within the secure zone (OT) toward the IDMZ.
- The corporate ERP accesses only the server in the IDMZ to obtain the necessary analytics.
- Firewalls ensure session termination, completely blocking end-to-end packet transit.
Message brokers and API Gateways: securely transmitting telemetry to the IT level
To avoid the chaos of synchronous point-to-point connections, message-based integration patterns are used. OT systems publish telemetry to a message broker (MQTT or AMQP) located in the IDMZ, and IT systems subscribe to it without having access to controllers. However, transport protocols like Kafka or MQTT do not guarantee security on their own; their reliability depends entirely on TLS settings, authentication, and segmentation.
To process requests arriving from the corporate network to industrial services, an API gateway is used. It allows for centralized authentication, data integrity verification, observability, and rate limiting, which is critical for protecting the OT level from DoS overloads.
Integrity control and transaction auditing at the IT/OT boundary
At the network boundary, a robust software layer capable of validating data structure and ensuring strict access control is necessary. Specialized integration platforms are often used as the technological foundation for building such gateways. An example is the low-code platform UnityBase (a joint development of companies within the Intecracy Group, with InBase as the key developer). Thanks to a unified domain metadata model, the platform allows for the rapid deployment of integration services with generated REST APIs.
UnityBase can act as a secure intermediary: it accepts telemetry, validates it, and provides controlled access for corporate systems through role-based access control (RBAC) and record-level security (RLS). For critical infrastructure systems, the platform's official page recommends using Enterprise or Defence editions, as they support extended audit trails and strict authentication for every transaction. Specialists at Intecracy Group rely on this foundation when designing integration layers that isolate control processes from business applications.
It is important to realize that no API gateway or message broker automatically makes a system compliant with NIS2 requirements. Compliance is a comprehensive process of risk management, auditing, and personnel training, not the result of installing a single tool.
Secure data exchange matrix between IT and OT segments
| Integration method | Risk level | ISA/IEC 62443 application |
|---|---|---|
| Direct connection (Point-to-Point) | Maximum (transit attacks on PLC) | Prohibited by standard for critical systems |
| Industrial DMZ (IDMZ) | Low (full session separation) | Mandatory for file transfer and Historian replication |
| Asynchronous broker (MQTT/AMQP) | Minimal (initiation from OT only) | Real-time telemetry and event transmission |
| Secure API gateway | Low (authentication and Rate Limiting) | Controlled IT access to OT segment services |
FAQ
How can ISA/IEC 62443 segmentation requirements be implemented without stopping existing SCADA processes?
Implementation typically begins with passive data collection via port mirroring (SPAN) and the installation of unidirectional gateways. This allows for data replication into the IDMZ without interfering with active technological processes. Gradually, legacy synchronous connections are decommissioned and replaced with asynchronous channels.
Which protocols are secure for transmitting data from OT to IT through a DMZ?
No protocol is secure by default. Security is provided by a combination of transport encryption (TLS) and authentication. The ISA/IEC 62443 architectural rule requires that the network session initiator must always be a client from the more secure zone (OT) toward the less secure one (DMZ).
How can unidirectional data transmission be configured using message brokers?
To implement a data diode pattern at the broker level, a bridge is created. The broker in the OT segment is configured exclusively to publish topics to the channel, while the broker in the DMZ operates to receive them without permissions to initiate return control commands or access acknowledgments.