Why the network perimeter is no longer enough
The traditional security model for OT networks is based on the perimeter: “what’s inside the firewall is safe.” This model is undermined by several current realities:
- Technicians access OT networks from outside the network (remote maintenance, VPN access).
- Service providers and integrators access PLCs via shared accounts.
- Connected IoT devices introduce attack vectors from the inside.
- Internal threats (sabotage, negligence) are not stopped by an external perimeter.
Zero Trust replaces "trust, then verify" with "never trust, always verify" — for every access attempt, every user, every device, at all times.
The 5 Pillars of Zero Trust Applied to OT
1. Strong Identity Each human user authenticates using MFA (password + TOTP or certificate). Each IoT device authenticates using a unique X.509 certificate. No shared identities, no generic passwords.
2. Limited Access A maintenance technician on Line A has access only to the PLCs on Line A, not to the entire OT network. An external contractor has access only to the equipment they are responsible for maintaining, for the specified duration.
3. Continuous Verification Access is not binary (logged in/logged out). Security posture is continuously monitored: a PC that has not received a security update in 30 days has its privileges restricted. A session that has been inactive for 15 minutes is logged out.
4. Microsegmentation The OT network is divided into zones: each production line and each subsystem (pumping, power, ventilation) is in a separate zone. A compromise in one zone does not spread to the others.
5. Comprehensive Logging Every connection, every command sent to a PLC, and every register read is logged with the following details: who, from where, when, duration, and actions. This audit log is tamper-proof and can be exported for NIS2 audits.
Zero Trust vs. Traditional VPN: A Comparison
| Criterion | Traditional VPN | Zero Trust (ZTNA) |
|---|---|---|
| Access granularity | Full network access | Access by specific resource |
| Authentication | One-time upon connection | Continuous (periodic re-evaluation) |
| Least privilege | Not native | Yes (via policy) |
| Vendor access | Often shared accounts | Temporary individual accounts |
| Access visibility | Partial (VPN logs) | Full (all actions) |
| Access revocation | Disables the VPN | Immediate granular revocation |
| Suitable for legacy OT networks | ★★★★ | ★★★ (initial complexity) |
Phased Implementation: The Steps
Full Zero Trust is a goal to be achieved gradually. Here are the recommended steps for industrial OT networks:
Step 1 — Solid Foundation (3 months)
- Outbound VPN on all gateways.
- MFA for all remote access.
- Session logging.
- Removal of direct access (open ports).
Step 2 — Least Privilege (6 months)
- Access rights per user and per device.
- Temporary access for service providers.
- Immediate revocation.
Step 3 — Microsegmentation (12 months)
- VLANs by OT zone.
- Inter-zone firewall rules.
- Behavioral monitoring.
The Eziwan Approach
The Eziwan Gateway and the Eziwan Cloud natively implement steps 1 and 2: outbound VPN, MFA, comprehensive session logging, per-user permissions, and temporary access for service providers. Microsegmentation (Step 3) is supported via configurable VLANs on the gateway.
For more information: Secure Industrial VPN, Remote Access to Industrial PLCs, and IoT Cybersecurity.