In an era where the boundary between operational technology (OT) and corporate IT networks is blurring, technical leaders face a complex challenge. Businesses require data: real-time telemetry, ERP integration, and cloud analytics. However, connecting industrial control systems (ICS) directly to external networks exposes critical infrastructure to cyber threats. The traditional reactive patching approach is ineffective in industrial environments. Secure IIoT integration requires a shift to security by design, aligned with global industry standards.
Why IT security methods disrupt OT: prioritizing availability over confidentiality
In classic IT systems, security focuses primarily on data confidentiality. In operational technology (OT), priorities differ: as noted in the NIST SP 800-82 guidelines, availability and process continuity are paramount. A false positive from an antivirus or an unexpected controller reboot due to an update can lead to production downtime or even industrial accidents.
OT security strategies must account for legacy OT equipment. Many industrial controllers were designed without modern threats in mind and physically cannot support contemporary patching cycles or complex security protocols. Therefore, protection must be built around network segmentation, which is a fundamental cybersecurity control tool in industry.
ISA/IEC 62443 architecture: how zones and conduits isolate critical nodes
The ISA/IEC 62443 standard provides a comprehensive series of standards specifically designed for the security of industrial automation and control systems, covering over 20 different industrial sectors. Its key architectural concept is the division of infrastructure into "Zones" and "Conduits".
A zone groups logical or physical assets that share common security requirements. For example, sensors and programmable logic controllers (PLC) are isolated from corporate servers. A conduit is a single, controlled path for data exchange between these zones. All traffic must pass exclusively through authorized conduits, making direct access from the corporate IT network to industrial equipment impossible.
OPC UA as a security standard: protocol-level encryption and authentication
Traditional industrial protocols often transmit data in plain text. For secure integration, OPC Unified Architecture (OPC UA) is used. It is a platform-independent architecture that ensures secure and reliable interoperability between industrial equipment, SCADA/MES systems, and corporate applications.
OPC UA includes protocol-level security mechanisms, including application and user authentication, as well as message encryption. While no standard provides "absolute" protection against hackers, implementing OPC UA significantly reduces the risk of data manipulation and prevents unauthorized telemetry reading when information is transmitted from the shop floor to IT systems.
Practical scenario: secure telemetry transfer from shop floor to ERP via industrial gateway
According to practices described in the AWS Well-Architected IoT Lens, robust IoT solutions require treating device provisioning, updates, and monitoring as separate, managed processes. In practice, an edge-to-cloud architecture looks like this:
- Local aggregation and edge processing: Telemetry is collected locally. Edge processing allows for data filtering, reducing volume and minimizing the attack surface before sending it to the cloud.
- Normalization via OPC UA: An industrial gateway normalizes raw data from machines, converting it into OPC UA format with appropriate encryption.
- Demilitarized zone (DMZ): A DMZ is implemented between OT and IT. Instead of direct access from IT to the PLC, the normalization gateway transfers data to an intermediate server in the DMZ. Corporate systems retrieve information from there, keeping the production loop isolated.
Security by design: Softengi's approach to industrial IoT integration
Implementing secure IIoT solutions requires a deep understanding of OT environment specifics. The Softengi team (a member of the Intecracy Group alliance) provides custom IoT solution development, integration with industrial systems (SCADA/MES), and the design of secure edge-to-cloud architectures based on the Zones and Conduits concept.
For data collection and sensor network management at the physical level, the AZIOT Platform is used—a specialized solution from the Intecracy Group portfolio that processes events in real-time and supports industrial protocols at the edge.
For integrating normalized data into the corporate perimeter and ERP systems, the low-code platform UnityBase (a joint development of Intecracy Group companies) is used. Thanks to built-in security mechanisms such as role-based access control (RBAC), row-level security (RLS), and detailed audit trails, UnityBase allows for the secure ingestion of data from OPC UA gateways. This ensures that production telemetry reaches only authorized users, completely eliminating the risk of unauthorized reverse interference with critical infrastructure.
| Integration approach | Architectural features | Result and risk level |
|---|---|---|
| Direct connection (Unsafe) | Direct access from IT/cloud to PLC | No isolation. High risk of process compromise and production downtime. |
| Basic segmentation (Medium) | Network separation via firewall | Protection against accidental corporate traffic, but remains vulnerable to targeted attacks via shared ports. |
| ISA/IEC 62443 + OPC UA (Target state) | Isolation via DMZ, normalization gateways, edge filtering, and OPC UA encryption | Risk minimization: direct access to OT devices is impossible; corporate systems receive only validated and secure data. |
FAQ
How does the ISA/IEC 62443 standard help protect legacy industrial equipment?
The standard introduces the concept of dividing the network into Zones and Conduits. Legacy equipment that does not support modern patching cycles is isolated in a secure zone. Access is granted exclusively through strictly controlled conduits, eliminating the need for direct updates or modifications to the controllers themselves for basic protection against external threats.
Why is OPC UA a better choice for secure shop floor data transmission compared to older protocols?
Unlike many traditional protocols that transmit data in plain text without access verification, OPC UA is a platform-independent architecture that supports reliable interoperability. It offers protocol-level security through authentication and message encryption mechanisms, significantly reducing the risk of telemetry interception or manipulation.
How can a DMZ be correctly configured between IT and OT networks without sacrificing efficiency?
Implementing a demilitarized zone (DMZ) involves placing intermediate servers (e.g., industrial gateways). Data from the OT environment is normalized and filtered using edge processing to reduce volume, then transferred to the DMZ. Corporate IT systems retrieve data from the DMZ, which blocks direct external requests to critical industrial controllers.