Modern industrial enterprises can no longer afford to isolate operational technology (OT) from the corporate IT environment. The need for real-time analytics, predictive equipment maintenance, and integration with ERP systems forces businesses to open up industrial circuits. However, directly merging these worlds creates critical threats to security and stability.
The updated NIST SP 800-82 guide highlights the need to transition from traditional perimeter defense to granular Data Governance models and the implementation of Zero Trust principles for OT data. The main challenge for technical leaders is to ensure strict access control to sensor telemetry without violating requirements for the availability and continuity of technological processes.
NIST SP 800-82 requirements: Why OT network perimeter protection is no longer enough
Historically, the security of industrial control systems (ICS) was built at the network perimeter level. It was assumed that if controllers (PLC) and SCADA systems were located in a dedicated physical or virtual segment (VLAN), protected by an industrial firewall, the infrastructure was secure. However, this approach no longer provides adequate protection when integrating with IT platforms.
NIST SP 800-82 emphasizes that, unlike in IT, availability and integrity have a higher priority than confidentiality in OT environments. Simply blocking traffic or disconnecting a segment upon detecting an anomaly can lead to a halt in continuous production, which threatens significant financial losses. The ISA/IEC 62443 series of standards, which are applied in over 20 different industries using operational technology, also confirm the need for deep, layered defense.
When sensor data is transmitted to higher levels for analysis, traditional firewalls cannot distinguish who is requesting a specific metric and for what purpose. Opening ports for corporate systems creates a path for attackers into the technological network. Therefore, there is a need to transition from purely network-based segmentation to software-defined access control at the data level itself.
Conflict of priorities: Why IT security approaches disrupt the availability of OT systems
Attempting to transfer classic IT security methods into an OT environment almost always carries a risk to process functionality. Let's consider the key contradictions:
- System lifecycle: In the industrial sector, controllers operate for decades. Legacy systems do not support modern encryption methods, lack built-in authorization, and cannot be regularly updated (patched) without the risk of operational failure.
- Sensitivity to loads: Attempts to apply standard IT vulnerability scanners or excessive requests can overload the resources of an old controller, leading to its failure.
- Lack of user authentication: Many industrial protocols transmit data in plain text. Direct connection to such systems allows for unauthorized changes to their operating modes.
According to the AWS Well-Architected IoT Lens methodology, an effective architecture requires a clear separation of data processing at the edge and in the cloud to ensure system reliability. This means that the local control loop at the shop-floor level must remain autonomous, even if the connection to external systems is severed.
Architectural security layer: How to normalize and protect industrial data
To resolve this conflict, it is necessary to implement a Data Governance Layer. It is placed between industrial equipment and corporate systems, acting as a single secure gateway.
The primary task of this layer is data normalization. The OPC UA (OPC Unified Architecture) standard acts as a platform-independent architecture that normalizes machine data. This is a mandatory prerequisite for secure integration between SCADA/MES and corporate systems. Normalized data is converted into a semantically understandable format for secure processing.
The software-based data management layer does not replace physical firewalls or network segmentation required by the NIST SP 800-82 standard. It acts as a complementary layer. Instead of giving IT systems direct access to SCADA databases, all requests pass through a secure gateway. This prevents the corporate segment from having a reverse impact on physical controllers.
Practical implementation of Zero Trust: RLS, auditing, and Active Directory integration
Implementing the Zero Trust concept in OT requires the application of three key mechanisms at the integration layer level:
1. Granular access control (Row-Level Security)
Traditional database-level access is insufficient. It is necessary to apply Row-Level Security (RLS) to restrict access to specific data. For example, a maintenance engineer should have access to the telemetry of only those production lines they are responsible for and should not see the operating parameters of other workshops.
2. Centralization and completeness of audit
Security auditing must cover a significant portion of administrative access attempts to critical controllers and data requests. All events from disparate systems must be collected and recorded in a single secure audit log. This allows for the prompt detection of unauthorized configuration changes.
3. End-to-end identification without local accounts
Creating separate accounts on every industrial computer leads to the use of weak passwords. The solution is to map corporate Active Directory accounts to specific OT data access roles. The user authenticates in the corporate domain, and the gateway translates their rights into permissions to view specific industrial telemetry.
The role of the UnityBase platform in building a secure gateway between IT and OT
An example of a technological foundation for such an integration layer is the UnityBase platform — a full-stack JavaScript low-code solution developed by companies of the Intecracy Group alliance. Thanks to an architecture where a single metadata model (Domain metadata) combines data descriptions, APIs, and access rights, systems built on UnityBase effectively act as a secure gateway between industrial and corporate circuits. For high-load projects with strict security requirements, official documentation recommends using Enterprise (EE) or Defence (DE) editions of the platform.
The platform helps implement NIST SP 800-82 requirements through the following mechanisms:
- Sub-second authorization latency: The multi-threaded engine (SpiderMonkey) ensures that access rights verification happens instantly, without creating delays in telemetry transmission.
- Flexible security policies: The platform supports Role-Based Access Control (RBAC) and Row-Level Security (RLS), allowing for granular configuration of access to metrics.
- Integration with corporate infrastructure: Support for Active Directory, OpenID Connect, and other protocols allows users to gain access via existing corporate accounts.
- Reliable logging (Audit Trail): Automatic maintenance of a detailed log ensures compliance with requirements regarding a significant portion of data action audits.
In complex projects, this layer works in synergy with other solutions. The AZIOT Platform provides direct data collection from equipment (edge processing) via MQTT/Modbus protocols and transmits it to the gateway. At the same time, the expertise of Softengi in system integration, which complies with the ISO/IEC 42001 AI management standard, allows for the design of such cyber-physical architectures on a turnkey basis for critical infrastructure.
| NIST SP 800-82 requirement | Network-level solution (Firewalls/VLANs) | Governance-level solution (UnityBase) |
|---|---|---|
| Availability priority | Redundancy of physical communication channels, hardware equipment duplication. | Sub-second request authorization, complete isolation of controllers from direct load by IT network requests. |
| Granular access control | Network segmentation at the IP address or port level. | Row-Level Security (RLS) to restrict access to sensor metrics based on user roles. |
| Continuous audit and monitoring | Network traffic analysis (IDS/IPS), detection of anomalous packets. | End-to-end logging of a significant portion of all data requests and user actions via a unified Audit Trail. |
| Identity management (IAM) | Local passwords at the operator panel (HMI) level. | Integration with corporate Active Directory/LDAP. |
Implementing a software-based data management layer allows for meeting the strict requirements of modern cybersecurity standards, preserving investments in legacy equipment, and opening the path to secure digital integration without risking production continuity.
FAQ
How to implement Zero Trust in an OT environment without replacing legacy controllers (legacy PLC)?
To achieve this, a Data Governance Layer is deployed between legacy controllers and the corporate network. Data is normalized via OPC UA, and Zero Trust policies, authentication, and access control are applied at the gateway level, built, for example, on the UnityBase platform. Direct IT system access to PLCs is completely blocked.
Can a data management software layer replace firewalls according to the NIST SP 800-82 standard?
No, the software layer is a complementary solution. According to NIST SP 800-82, security must be layered. Firewalls and VLANs provide traffic isolation, while the Governance layer provides granular access control to the data itself and audits user operations.
How to ensure Row-Level Security for sensor telemetry in real-time without SCADA performance delays?
Requests from corporate systems are addressed not directly to SCADA, but to a high-performance intermediate integration gateway. Using asynchronous architectures allows for Row-Level Security (RLS) filtering with sub-second latency, eliminating additional load on industrial systems.
Expert comment