According to the ENISA Threat Landscape 2025, 4,875 cybersecurity incidents were recorded between July 1, 2024, and June 30, 2025. A significant portion of affected organizations fall into the "essential entities" category, highlighting the vulnerability of critical infrastructure. For manufacturing enterprises, attempting to apply standard IT practices—such as automated network scanning or mass software updates—to operational technology (OT) often creates unacceptable risks to production continuity.
Architectural security according to the ISA/IEC 62443 standard
The key conflict lies in diverging priorities: IT focuses on updateability, while OT prioritizes stability and safety. The ISA/IEC 62443 standard proposes the "Zones and Conduits" concept. Instead of a "flat" network where corporate and industrial segments are not separated, the architecture involves creating logical security zones and restricted channels (conduits) for data transmission.
Integration gateways as a secure perimeter
To transfer data from MES systems to corporate BI platforms, it is advisable to avoid direct connections. Following the Enterprise Integration Patterns methodology, it is practical to implement an intermediate integration layer. An API gateway acts as a reliable channel that centralizes authentication, implements rate limiting, and ensures comprehensive auditing of data flows, preventing direct access to controllers from the office network.
Managed architecture and data integrity protection
Building integration solutions requires a disciplined approach to access. The UnityBase platform, as a foundation for complex enterprise systems, provides mechanisms (RLS, RBAC, auditing) that allow for the implementation of integration gateways with controlled access to metadata. Using a managed environment helps minimize the risk of lateral threat movement while ensuring transparency for all data operations. This does not eliminate all cyber risks, but it allows them to be managed in a controlled manner in accordance with industry standard requirements.
| Maturity level | Description |
|---|---|
| Level 1 | Point-to-point (chaotic connection) |
| Level 2 | Basic segmentation (firewalls without flow control) |
| Level 3 | ISA/IEC 62443 (zones and managed conduits) |
| Level 4 | Managed Data Fabric (governance, audit, monitoring) |
FAQ
How to integrate data from MES to ERP without risking controller security?
It is necessary to implement an integration gateway (conduit) that acts as a mediator. It filters requests, performs authentication, and restricts corporate system access to only the necessary telemetry data.
Is it mandatory to implement ISA/IEC 62443 for small production lines?
ISA/IEC 62443 is a fundamental risk management standard. Even for small lines, network segmentation into zones significantly reduces the likelihood of threats spreading from the corporate segment to the industrial one.
Which tools allow for the separation of OT and IT traffic without losses?
An effective approach involves using managed API gateways and integration platforms (such as UnityBase), which provide access control and logging at the domain model level.