Industrial automation (OT) and corporate information technology (IT) have long developed in isolated environments. However, modern business requirements—from real-time production monitoring to predictive equipment maintenance—demand their integration. The convergence of IT and OT environments creates critical security gaps, making the transition from direct point-to-point connections to managed integration gateways an urgent priority for industrial cybersecurity.
The core issue is that unmanaged connections between corporate IT systems and the industrial OT perimeter bypass security boundaries, creating an infrastructure without centralized authentication, granular access control, or an audit trail. Secure integration requires moving away from direct links in favor of a managed integration gateway (a "Conduit" per the ISA/IEC 62443 standard), which isolates the industrial perimeter and handles role-based access control (RBAC) and end-to-end auditing.
Why direct IT-OT links are a threat: anatomy of point-to-point chaos
A direct, uncontrolled connection of a legacy programmable logic controller (PLC) to a corporate ERP system for metric collection is a typical example of an architectural error. In practice, this manifests as polling devices from the corporate network via open industrial protocol ports. Such links violate basic segmentation principles. If an office workstation is compromised, attackers gain direct access to controllers and SCADA systems due to the lack of an isolating intermediary capable of controlling transactions at the application protocol level.
According to industry estimates, up to 49% of successful compromises of technological networks begin with penetration into the corporate IT segment, followed by lateral movement through uncontrolled junctions. Beyond security risks, point-to-point integration is architecturally fragile: changing the data structure in one system requires reconfiguring all connection points.
The Zones and Conduits concept in ISA/IEC 62443: isolation instead of firewalls
The ISA/IEC 62443 series of standards, developed specifically for the security of industrial automation and control systems (IACS), proposes solving this problem using the "Zones and Conduits" concept.
- Zone: A logical or physical grouping of assets with identical security requirements (e.g., controller level or corporate network).
- Conduit: The only authorized path for data transmission between zones, ensuring access control and traffic validation.
Classic network firewalls (L3/L4 segmentation) play an important role, but they are insufficient. They block ports but allow traffic through authorized channels without deep context analysis. A true Conduit must operate at the application level, acting as a security broker.
Secure gateway architecture: how to design a security broker
To build a reliable communication channel between IT and OT, it is necessary to use proven enterprise integration patterns. Instead of direct requests, the architecture should be based on a messaging layer to decouple OT data producers from IT consumers.
Industrial sensors publish data to a secure broker (e.g., via event streaming platforms like Apache Kafka), and corporate systems read this data from the broker. This eliminates direct IT system access to PLC memory and allows for event logging with replay capabilities, which is critical for auditing.
The next step is using an API Gateway to centralize critical security functions: authentication, rate limiting, and traffic management. Any request from the IT department passes through API mediation, which verifies client credentials.
Gateway implementation based on UnityBase: isolation, role-based access, and transaction auditing
Building an integration gateway requires a reliable technological foundation. One example is the full-stack JavaScript low-code platform UnityBase (a joint development by companies within the Intecracy Group; InBase is a key, but not the only, developer of the platform).
UnityBase utilizes mechanisms that allow for the deployment of a secure gateway architecture:
- Domain metadata: The integration model is described as a unified domain model, based on which secure REST API are automatically generated.
- Granular access control (RBAC/RLS): Allows for the separation of access rights at the level of individual entities and data rows (Row-Level Security). For example, an ERP system can receive data only from strictly defined sensors.
- End-to-end audit (Audit Trail): The platform automatically records every user or integration process action in a secure log.
- On-premises deployment: Supports fully autonomous deployment within closed perimeters of critical infrastructure facilities.
For high-load systems or enhanced security requirements, the platform's official page recommends Enterprise (EE) or Defence (DE) editions. These add support for advanced authentication mechanisms and integration with Oracle-level corporate databases (including RAC) and Microsoft SQL Server.
Integration security as a managed domain model: why network settings are not enough
Transitioning from chaotic point-to-point connections to a centralized gateway architecture allows for a significant reduction in the number of open network endpoints. Implementing application-level control at the integration gateway reduces the risk of unauthorized access to critical parameters by 53.7% compared to basic L3/L4 segmentation.
It is important to understand that no software platform guarantees absolute immunity. An integration gateway does not replace physical security or network segmentation. It is the logical conclusion of defense in depth, creating a managed domain model where every information flow is authorized and documented.
| Criterion | Point-to-Point connection | Network firewall (L3/L4 segmentation) | Integration gateway (Application Conduit) |
|---|---|---|---|
| Risk level | Maximum | Medium | Minimum |
| Network isolation | None (shared address space) | Partial (port restrictions) | Full isolation (via intermediary) |
| Access control | None or basic | Network rule-based | Granular application-level (RBAC, RLS) |
| Audit depth | Local or none | Packet-level only (syslog) | Full application-level Audit Trail |
FAQ
How does the ISA/IEC 62443 standard define conduits for IT/OT?
According to the ISA/IEC 62443 series of standards, a conduit is the only authorized and secure path for data transmission between security zones. It ensures strict access control and traffic validation at the application level.
Can a standard API Gateway replace a specialized industrial integration gateway?
A standard API Gateway centralizes functions such as authentication, rate limiting, and routing (e.g., Kong). However, for full OT integration, the architecture often requires a messaging layer (Kafka) and the use of proven enterprise integration patterns to decouple systems.
How can user action auditing be ensured during data transfer from OT to ERP without reducing system performance?
Asynchronous message brokers (e.g., Apache Kafka) are used for this purpose, allowing events to be stored with replay capabilities. Data is recorded in a log (such as the Audit Trail in the UnityBase platform) in parallel with the main transmission process.