The convergence of information technology (IT) and operational technology (OT) is no longer optional for maintaining the competitiveness of industrial enterprises. Modern production requires a continuous flow of data to cloud platforms for predictive analysis and optimization. However, attempts to connect sensitive industrial networks (SCADA, MES) with corporate clouds often lead to the emergence of uncontrolled attack vectors. Technical leaders (CTO, CISO) face a complex task: building a secure connection between legacy equipment and cloud analytics while adhering to strict regulatory requirements and maintaining process continuity.
Why the air gap concept no longer protects modern production
The traditional strategy of protecting industrial systems through complete physical isolation (air gap) is becoming insufficient for the modern requirements of the industrial internet of things (IIoT). Absolute isolation is practically impossible: remote equipment maintenance by vendors, software updates, and the use of engineering devices create hidden penetration channels. Business also requires the integration of control systems with corporate ERP platforms for precise resource planning.
The conflict of convergence lies in the fundamental difference between IT and OT:
- Security priorities: In IT, confidentiality is key, whereas in OT, availability and physical safety are paramount.
- Legacy protocols: Industrial standards (Modbus, OPC DA) often lack built-in authentication mechanisms and transmit data in plain text.
- Equipment limitations: Industrial controllers (PLC) have long lifecycles and limited computing resources, making it impossible to deploy modern cryptographic modules directly on them.
NIS2 compliance: Regulatory requirements as a driver for modernization
Cybersecurity for industrial systems is a matter of business continuity and regulatory responsibility. The EU NIS2 directive imposes strict requirements for supply chain protection and risk management for critical sectors.
According to the ENISA Threat Landscape 2025, essential entities subject to the NIS2 directive accounted for 53.7% of all organizations affected by cyberattacks during the reporting period. This is a clear signal for enterprises to move away from "security through isolation" in favor of a Zero Trust concept and multi-layered protection.
The ISA/IEC 62443 architectural model: Zoning and protecting the industrial perimeter
The international ISA/IEC 62443 standard series is a fundamental guide for the secure integration of industrial control systems (ICS). The standard is based on the concept of defense-in-depth and micro-segmentation, dividing the network into logical zones and secure conduits.
This approach is based on an adapted Purdue model, which includes:
- Levels 0-2 (Production floor): Physical processes, sensors, and PLCs.
- Level 3 (Operations management): SCADA, report servers, MES.
- Level 3.5 (Industrial demilitarized zone - IDMZ): A buffer layer that separates OT and IT environments.
- Levels 4-5 (Corporate network): ERP, cloud applications, and analytics.
No device from the corporate network should have direct access to the production level. All data exchange must occur through intermediaries in the IDMZ to limit the lateral movement of potential threats.
The integration layer in practice: A secure bridge between PLCs and cloud analytics
To securely export telemetry to the cloud, the following architectural practices are used:
- Buffer in DMZ: Data is exported to an intermediate message broker (e.g., MQTT) within the IDMZ. The cloud platform receives information only from this buffer, which protects SCADA systems from direct requests.
- Secure API gateways: Edge gateways transform insecure traffic from local protocols into an encrypted format (JSON over HTTPS/TLS) and validate all incoming requests.
- Strict access control: The use of role-based (RBAC) and attribute-based (ABAC) access ensures that only authorized engineering personnel can interact with the data.
Implementing security without stopping the production line: A platform approach
Migration to a secure architecture requires the development of an integration layer that connects industrial data with corporate systems. Creating such a tool from scratch is a complex engineering task, which is why companies often rely on specialized platforms.
An example of a technological foundation for developing a secure integration layer is the full-stack low-code platform UnityBase (a joint development by companies within the Intecracy Group alliance; InBase is a key, but not the only, developer). Using Domain metadata as a unified model, the platform allows for the generation of secure REST API for data translation between IT and OT perimeters.
To ensure the manageability of convergence, architects can use the following platform mechanisms:
- Granular control: Built-in RBAC mechanisms and row-level security (RLS) policies restrict access to specific production telemetry for corporate users.
- Logging: The audit trail function ensures end-to-end recording of any access attempts to data, which is critical for passing NIS2 audits.
- Deployment flexibility: Support for on-premises installations allows for the deployment of integration modules directly within the secure industrial zone.
It is important to understand that no software platform is a "silver bullet." The tool serves to implement a defense-in-depth architecture rather than replacing the security policy itself. For projects with high loads or increased protection requirements, official documentation recommends using commercial Enterprise (EE) or Defence (DE) editions, which support advanced authentication and integration methods.
IT/OT integration maturity levels based on security criteria
| Maturity level | State description | Key technologies | Risk level |
|---|---|---|---|
| Level 0 (Chaotic) | Direct connection of PLC/SCADA to the corporate network without segmentation or encryption. | None | Critical (threat of shutdown) |
| Level 1 (Basic) | Presence of a simplified firewall, illusion of air gap, lack of traffic monitoring. | Simple firewalls | High |
| Level 2 (Regulated) | Segmentation according to the Purdue model (ISA/IEC 62443), dedicated DMZ, basic access control. | IDMZ, VLAN, VPN | Medium |
| Level 3 (Optimized) | Use of secure API gateways, encryption at the edge, integration with SOC. | API Gateway, TLS, SIEM | Low |
| Level 4 (Zero Trust OT) | End-to-end authentication of every request, micro-segmentation, continuous monitoring. | MFA, IAM, IDS for OT | Minimal |
The convergence of IT and OT is an evolutionary process. Moving from chaotic connections to a structured, multi-layered architecture allows for the secure use of cloud analytics power while simultaneously mitigating risks to the continuity of physical production.
FAQ
How to ensure secure data transmission from legacy PLCs (without encryption support) to the cloud?
Secure edge gateways in a demilitarized zone (DMZ) are used for this. The gateway locally reads data from controllers via an open protocol (e.g., Modbus TCP), then encrypts it using TLS and transmits it to the cloud via a secure API or authenticated MQTT.
Which NIS2 directive requirements are critical for industrial control systems (ICS)?
Key requirements include cybersecurity risk assessment, mandatory multi-factor authentication for remote access, supply chain protection, and timely response and reporting of incidents affecting critical processes.
How to configure a DMZ between IT and OT networks without reducing SCADA system performance?
An asynchronous model should be used. The SCADA system should push data one-way into an intermediate database or message broker within the DMZ. Cloud platforms read data only from this buffer, eliminating direct load on OT servers.