Traditional IPSec/OpenVPN vs. Zero Trust Architecture (Eziwan)
| Criterion | Traditional VPN (IPSec/OpenVPN) | Zero Trust (Eziwan) |
|---|---|---|
| Role Model | ✗ Implicit trust in the network | ✓ Never trust, always verify |
| Security Perimeter | ✗ Network Perimeter (Castle-and-Moat) | ✓ Identity + device + context |
| Authentification | — Pre-shared key / certificate | ✓ MFA + certificate + context |
| Rights Management | ✗ Global Access to the Subnet | ✓ Micro-segmentation by Resource |
| Audit trail | ✗ Basic login/logout logs. | ✓ Granular logging of actions |
| Ease of deployment | ✗ Complex (firewall, PKI, NAT rules) | ✓ Simple with a modern gateway (ZTP) |
| Legacy OT Compatibility | ✓ Excellent (transparent) | ✓ Works well with edge enforcement |
| NIS2 Compliance | ✗ Partial with offsets | ✓ Native Alignment |
| IEC 62443 Compliance | — Possible with configuration | ✓ Recommended Architecture |
| Initial cost | ✗ High (concentrator, firewall) | ✓ Moderate (cloud gateway) |
| Scalability | ✗ Limited (concentrator nozzle) | ✓ Horizontal, cloud-native |
| Risk of lateralization | ✗ High (full network access) | ✓ Low (micro-segmentation) |
| Deployment time | ✗ 2–4 weeks (typical site) | ✓ 1–3 days (with ZTP gateway) |
A traditional VPN is based on a perimeter model: once connected to the tunnel, the user has access to the entire network or a large subnet. This is the “castle-and-moat” model—difficult to penetrate from the outside, but once inside, lateral movement is virtually unrestricted. In an OT context, this means that a VPN technician can potentially access not only the PLC they are supposed to maintain, but also SCADA systems, HMIs, and other critical equipment. Zero Trust reverses this model: no connection is trusted by default, even from the internal network.
Zero Trust microsegmentation allows for the definition of precise policies: “Technician X can access PLC Y from 9 a.m. to 5 p.m. on business days, only from an approved device.” This level of granularity is impossible with a traditional VPN. For OT environments, where a cybersecurity incident can have physical consequences (production shutdowns, accidents), this level of precision is critical. Eziwan implements this policy at the gateway level, transparently for legacy industrial equipment.
The NIS2 Directive requires operators of critical infrastructure and significant entities to implement cybersecurity risk management measures, including access control, logging, and business continuity. IEC 62443 (an industrial cybersecurity standard) recommends segmentation by zones and conduits. The Zero Trust architecture natively meets both of these standards. An IPSec VPN can meet these requirements, but requires additional configurations (external logging, complex firewall rules, certificate management) that increase complexity and the risk of error.
This is the main weakness of a traditional VPN: a Siemens S7-300 PLC, a Schneider Magelis HMI, or a frequency inverter connected via Modbus TCP has no way to run a Zero Trust agent. The Eziwan solution addresses this issue through “edge enforcement”: the Zero Trust policy is enforced at the network gateway, and industrial devices simply see a standard local Ethernet network. This approach combines the universal compatibility of a VPN with the security of Zero Trust.
A traditional IPSec VPN deployment for an industrial site requires: a VPN concentrator (hardware or VM), a configured firewall, a PKI for certificates, user and key management, plus the maintenance of this entire infrastructure. Eziwan eliminates the gateway, the PKI, and much of the firewall configuration. Zero-touch provisioning (ZTP) allows a new gateway to be deployed in less than an hour, compared to days for a traditional VPN infrastructure.
These documented incidents illustrate why the traditional VPN model is insufficient for industrial networks
An attacker used TeamViewer access (remote access software without MFA) to attempt to increase the caustic soda concentration in drinking water to a dangerous level. The unsecured remote access was the direct vector for the attack.
Lesson: Without MFA and without logging remote access, it is impossible to distinguish a legitimate connection from an attack.
The Industroyer2 group gained access to an energy provider’s OT network using VPN credentials stolen during a phishing attack on a subcontractor. The result: 3 days of production downtime and €4.2 million in losses.
Lesson: VPN credentials shared with a contractor are the single point of failure. A Zero Trust approach would have limited the contractor's access to the network perimeter.
An incorrect NAT rule on an IPsec VPN concentrator accidentally exposed Siemens SCADA HMIs directly to the Internet. Indexed by Shodan, they were compromised in less than 48 hours. No incoming ports are open with Eziwan’s outbound-only architecture.
Lesson: The complexity of IPsec/NAT configurations leads to human errors. The "outbound-only" configuration eliminates this attack vector.
Dragos 2024 Report: 60% of OT devices exposed to the Internet were still using default credentials. A municipal water network was compromised by a basic brute-force attack on an open VPN port—detected during an NIS2 compliance audit.
Lesson: Default credentials on outbound-only VPNs are the most commonly exploited vulnerability in the industry. An outbound-only architecture eliminates this attack vector.
Migration without downtime — typical duration: 1 to 3 weeks
List all active remote access connections: IPSec VPN, OpenVPN, TeamViewer, and direct RDP. Identify the users, the devices they can access, and how often they use these connections. Duration: 1–2 days.
Install the Eziwan gateway on the OT network without affecting the existing VPN. Automatic ZTP configuration in less than an hour. The two systems coexist without conflict. Duration: 30 minutes.
Define the policies: which users can access which equipment, during which time periods, and from which devices. Import the list of existing users, if available. Duration: 1–2 days.
Migrate users one by one to the Eziwan OpenVPN client. The old VPN will remain active as a fallback for 2 weeks. Verify critical access before shutting down the VPN. Duration: 1–2 weeks.
Once all users have been migrated and validated, close the incoming VPN ports on your firewall. Use an external Shodan scan to verify that nothing is exposed anymore. Duration: 30 minutes.
A site-to-site VPN extends the network and assumes trust once the tunnel is established. The industrial Zero Trust model reverses this logic: no implicit trust, access verified by identity and by resource, and an outbound tunnel with no inbound port. Here is the regulatory framework and the target architecture.
Benchmark Zero Trust Architecture: continuous verification, least privilege, microsegmentation, and access decisions based on policy and session.
OT security requirements: zones and channels, strong authentication, data encryption, and logging—the foundation of industrial remote access.
Require access management, traceability, and incident notification for critical entities; remote access must be auditable from end to end.
Recommends flow separation, the absence of an incoming port on the OT network, and strict IT/OT segmentation via a controlled gateway.
Proven encrypted tunnels. In a Zero Trust architecture, they become outbound channels to a broker, not permanent network bridges.
Mutual authentication using X.509 certificates: each device and each operator verifies its identity before any access is granted.
Reverse-tunnel model: The gateway initiates the connection to the broker (no incoming ports are open on the site). The operator can access only explicitly authorized devices for the duration of a logged session—not the entire subnet.
| Criterion | Traditional VPN | Zero Trust OT |
|---|---|---|
| Incoming port on the OT | Frequently required | None (outgoing tunnel) |
| Access Area | Entire subnet | Unit resource |
| Confiance | Implicit after the tunnel | Continuously verified |
| Authentification | Shared key/ID | Identity + MFA + mTLS |
| Traceability | Raw network logs | Audit by Session/Resource |
| Revocation of Access | Overall (key) | Granular, immediate |
VPNs are not obsolete: they are becoming a building block for encrypted data transmission within a Zero Trust policy, rather than the security perimeter.
Replacing heterogeneous VPN clients with a Zero Trust broker: no firewall ports opened on the client side; access is granted on a per-machine and per-technician basis.
Industrial 4G/LTE gateway with OpenVPN/IPSec VPN and zero-inbound-port. Deploys in less than an hour; NIS2-compliant.