Legacy controllers, drives, overloads, and sensors may have no practical path to TLS or certificate-based identity. Keep their plaintext traffic local, bound the exposure to a controlled cell, and place the security transition at a plant-managed boundary.
Architecture options
Before anything else, decide whether the machine requires any connection beyond its local control domain. Connectivity is a process requirement, not a default feature.
| Approach | Best fit | Primary advantage | Primary limitation |
|---|---|---|---|
| Physical air gap | No production reporting, remote support, or external telemetry is required | Removes routed access paths | Also removes automatic reporting and remote operations; removable media and local maintenance still require controls |
| Firewall and tightly scoped conduit | A known server must exchange a small set of flows with the cell | Restricts source, destination, protocol, and port without changing the controller | Traffic remains plaintext wherever the legacy session exists |
| Industrial security gateway or software edge | IT integration requires encryption, identity verification, telemetry, or governed remote access | Terminates the local plaintext session and creates a protected upstream session | Adds configuration, certificates, patching, monitoring, and failure modes |
| Intermediate modern PLC | Protocol mediation also requires control logic or data conditioning | Can combine programmable logic, network separation, and protocol handling | Introduces another controller program, software toolchain, and lifecycle to maintain |
| Jump host | Interactive maintenance must enter through a controlled workstation | Concentrates authentication, tooling, and session monitoring | Does not by itself constrain machine-to-machine traffic or encrypt the final legacy hop |
| Rip and replace | Isolation cannot bound the risk, lifecycle support is unacceptable, or process-safety work already justifies replacement | Removes unsupported components and permits a redesigned architecture | Highest engineering, testing, downtime, and rollback burden |
An intermediary PLC is not automatically cheaper than a dedicated gateway. One cited M251 comparison used approximately €280 for the controller and €600 for its software license. Treat those figures as historical budget inputs only; obtain current quotations and include engineering, spares, updates, testing, and ownership of the application.
Selection criteria
- Confirm the required data flow. Name the report, telemetry stream, support function, or supervisory command that creates the connection requirement. If no flow has an operational owner, leave it disconnected.
- Map the plaintext span. Identify every switch port and cable over which the unprotected protocol can travel. Do not move on until that span is limited to a small trusted segment.
- Test isolation feasibility. Verify that the machine or cell can occupy its own Layer 2 boundary and that east-west paths to unrelated assets can be blocked locally.
- Assess boundary functions. Determine whether the interface needs simple filtering, protocol translation, encryption termination, interactive access, or programmable data handling.
- Review lifecycle and safety. Replace equipment when loss of support, inability to isolate it, or an existing process-safety project makes retention the larger risk.
- Assign operations ownership. Name the team responsible for gateway firmware, firewall rules, certificates, accounts, logs, backups, and revocation. A technically capable design without an operating owner becomes an unmanaged access path.
Recommended boundary architecture
For most connected brownfield cells, retain the legacy protocol inside an isolated Layer 2 segment and terminate it at a nearby industrial gateway or managed software edge. Permit only explicitly authorized communications across the boundary. Encrypt and identity-verify the upstream connection without presenting the legacy device as a directly routable IT asset.
Use a firewall when fixed endpoint filtering satisfies the requirement. Add a gateway when the boundary must translate protocols, terminate TLS, present certificates, buffer telemetry, or decouple the legacy session from the IT-facing session. Use an intermediate PLC only when programmable control or deterministic data handling is part of the requirement; otherwise its program and engineering software add avoidable lifecycle work.
Use an air gap when the process can operate without external data exchange. Air-gapping a reporting-dependent machine merely converts a cybersecurity decision into an availability problem. If production reports are mandatory, provide a controlled outbound path instead of repeatedly disconnecting and reconnecting the machine.
Reserve replacement for three breaking points: the device cannot be safely isolated, plaintext exposure cannot be bounded to the trusted cell, or lifecycle and process-safety risks already support migration. For simple processes, temporary intermediate controls can maintain operation while the replacement program is tested, but that method requires a documented rollback path and complete functional testing before cutover.
Commissioning prerequisites
| Item | Required definition | Confirmation before commissioning |
|---|---|---|
| Cell boundary | Legacy assets, local switches, boundary interface, and prohibited neighbors | Network drawing and physical port inspection agree |
| Flow inventory | Source, destination, protocol, port, direction, and business purpose | Each permitted flow has an operational owner |
| Access policy | identity → asset → protocol/port → duration |
No rule grants general subnet access when one asset is sufficient |
| Default state | North-south access denied unless explicitly permitted | Unlisted test traffic is blocked |
| East-west isolation | Legacy cell cannot initiate or receive unrelated lateral traffic | Tests from adjacent segments fail as designed |
| Management ownership | Firmware, certificates, firewall changes, logs, backups, and incident isolation | Named plant process accepts each responsibility |
| Recovery | Configuration backup, replacement method, and bypass or rollback decision | Recovery procedure is available without relying on the failed gateway |
Map applicable cybersecurity mandates, including any NIS2 or CRA obligations identified by the organization, to these controls through the responsible compliance function. Do not translate a general encryption mandate into an unsupported controller upgrade; document where plaintext terminates, where encryption begins, and which compensating controls bound the remaining exposure.
Cell boundary commissioning
- Capture the working baseline. Record the communicating endpoints, required protocols and ports, normal traffic direction, and current production behavior. Confirm that the machine operates correctly before inserting a new boundary device.
- Create the cell boundary. Place the legacy equipment on its dedicated Layer 2 segment. Remove routes and switch paths to unrelated production or IT networks. Confirm local control still operates with the upstream connection disabled.
- Install the boundary function. Connect the local plaintext side only to the legacy segment and the upstream side only to the controlled network. Do not bridge the networks transparently unless the approved design explicitly depends on that behavior.
- Define the local session. Configure only the legacy endpoint, protocol, and port required by the application. Confirm the gateway can exchange the required data locally before enabling upstream access.
- Define the protected upstream session. Configure the approved encrypted transport and identity mechanism at the gateway or software edge. Validate the certificate and trust configuration using the organization’s managed process.
- Apply default-deny policy. Permit only documented sources, destinations, protocols, ports, and directions. Confirm that an unlisted host cannot enter the cell.
- Enable the required application. Start the report, telemetry stream, supervisory link, or remote-support session. Confirm the intended data reaches its destination without exposing a route to other cell assets.
- Test loss states. Interrupt the upstream link and boundary service separately. Confirm that local control responds according to the machine’s approved failure behavior and that reconnection does not create duplicate sessions or uncontrolled traffic.
- Save the accepted state. Back up gateway, firewall, and intermediary-controller configurations. Record certificate ownership, renewal responsibility, firmware maintenance, and the process for emergency conduit revocation.
Plaintext containment mechanism
A gateway does not make the legacy protocol encrypted. It limits that protocol to the local segment, terminates its session, and creates a separate protected session upstream. The security claim therefore depends on the physical and logical boundary: if another routed interface can reach the controller directly, the protected overlay can be bypassed.
Layer 2 isolation bounds local exposure, while the boundary policy controls north-south traffic. Local east-west controls prevent one compromised machine or maintenance port from reaching neighboring cells. Together, these measures make tightly contained plaintext a managed residual risk rather than broadly routable plant traffic.
A firewall filters traffic but may pass the original application session unchanged. A proxy or protocol-aware gateway can terminate one session and originate another, which prevents a remote endpoint from addressing the controller directly. Select the function according to the required data path; adding protocol translation where filtering is sufficient increases testing and maintenance.
Access governance and recurring maintenance
Every OEM tunnel, VPN, certificate set, firewall rule, and support path creates another control model to operate and audit. A plant-owned overlay provides one policy model for internal users, vendors, and machine-to-machine traffic while retaining local authority to revoke a conduit.
Grant access to a specific identity, asset, protocol or port, and duration. Avoid granting a remote user general connectivity to an OT subnet. Keep north-south access default-deny, enforce east-west isolation close to the cell, and carry only planned communications across the overlay. This supports IEC 62443 zone-and-conduit design and least-privilege operation without requiring the legacy endpoint to implement modern cryptography.
Put certificate renewal, firmware review, firewall-rule recertification, account removal, and log review on maintained schedules. Monitor requests to the cell as well as successful sessions. An allow-listed connection to a supervisory server is useful only while its endpoints, port, direction, and owner remain accurate.
Keep routable OT networks out of broad VPNs and Layer 3 jump-server designs. Interactive access may pass through a controlled jump host, but the final conduit still needs asset- and protocol-level restrictions. Adding telemetry or remote support should become a policy change against the overlay, not an undocumented collection of VLAN, NAT, and firewall exceptions.
Acceptance verification
- Disconnect the upstream interface and confirm the machine retains approved local operation.
- From an unauthorized network, attempt the documented protocol and port; confirm the boundary blocks and logs the attempt.
- From the authorized endpoint, run the required transaction; confirm the application succeeds and the upstream session uses the configured encryption and identity checks.
- Attempt access to a second asset, protocol, or port not listed in the conduit; confirm default-deny behavior.
- Test east-west access from an adjacent cell or maintenance connection; confirm unrelated assets remain unreachable.
- Revoke the authorized identity or conduit and confirm access stops without changing the legacy controller.
- Restore the accepted configuration from backup in the approved test context and confirm the same allow and deny results.
- Review boundary and monitoring records; confirm successful sessions and rejected requests identify the expected source, destination, service, and time.
FAQ
Why does a legacy PLC not need to run TLS itself?
The protected boundary can terminate the PLC’s local plaintext session and create a separate encrypted, identity-verified upstream session. The plaintext span must remain confined to the isolated cell.
Why does a firewall not automatically secure a plaintext protocol?
A firewall can restrict endpoints and ports while still passing the original plaintext session. Use a proxy or protocol-aware gateway when the design requires session termination, encryption, or protocol translation.
Why does an air gap stop production reports?
An air gap removes the network path used by both attackers and legitimate reporting systems. If reports are operationally required, configure a default-deny conduit carrying only the approved reporting flow.
Why does a VPN not provide sufficient OT segmentation?
A VPN protects transport but can still give a user broad routed access. Define access as identity → asset → protocol/port → duration and block unapproved north-south and east-west paths.
How do I verify a legacy OT security gateway is working?
Prove the required transaction succeeds from the authorized endpoint, then confirm unauthorized sources, assets, protocols, and ports are blocked and logged. Finally, revoke the approved conduit and verify access stops while local machine control remains operational.