Manufacturing reality. OT-IT convergence. NIS2-essential.

What we find

In its list of the ten most important threats to industrial control systems, the BSI names "intrusion via remote maintenance access" and "control components connected to the internet", and vulnerabilities in the supply chain. That is the view from outside. From inside it looks like this:

Designs that have stood for twenty years. In manufacturing businesses, often family-owned and grown over generations, we find constructions that were taught in vendor training two decades ago — still in operation, unchanged. Most recently in remote access: a model that was state of the art then and survives no scrutiny today.

MAB as access control. MAC Authentication Bypass is sold and understood as access control, at times even described as dot1x. The vendor's own documentation states that MAB is not a strong authentication method and that it can be defeated by spoofing a valid MAC address. Anyone who can reach a camera or a printer on the shop floor has a valid port.

One vendor for every layer. VPN, firewall, proxy, access control, data-centre network — the same brand, regardless of whether that product is the strongest one for that layer. Alongside it a statically routed legacy network, while modern fabric architectures are being built at the same time because the vendor and the integrator recommended them.

And then the new world, without a network. Kubernetes, Terraform, two hyperscalers and a CDN at once, introduced by teams neither trained nor staffed for it. The result is environments nobody fully oversees in operation — and that are connected to the plant network anyway.

You are advised by the company selling the hardware

That is the core of the problem, and it is not a question of competence on the customer side. Whoever recommends an architecture usually also sells the components it is made of. That is a legitimate business motivation, but it systematically produces the same outcomes: more boxes, more licences, one vendor across every layer, and a recommendation that never reads "you don't need to buy anything for this". That MPLS offers are still being put on tables as modernisation in 2026 follows the same logic.

In many companies, responsibility has also sat with the same people for decades, grown out of operations. That is not a weakness — these people know their plant better than any outsider. The problem is the training that never happened alongside it, and the advice that came from the vendor of all places. Anyone who has looked after the same architecture for twenty years never had cause to question the principles behind it. That is exactly what an outside party is brought in for — not to replace the people.

Our position on this is uncomfortable and simple: a concept is finalised so that it can be questioned afterwards. We do that with our own every six months. What has stood unchanged in a plant for twenty years has never been through that review.

How to get out of it

Zones first, products second. IEC 62443 provides the frame: zones and conduits, a security level per zone according to damage potential. That is architecture work and costs no licence. Only afterwards does the question arise of which product enforces a zone — and the answer differs per layer.

Terminate the crossings. Between office IT, the MES level and the field level sits a system that terminates the protocol, inspects it and passes on only what is permitted. Modbus, Profinet, S7 and OPC UA have a describable normal state; a crossing that understands this is worth more than a rule that forwards a network.

Access gets an end. Vendor remote maintenance runs through a PAM path: approval per assignment, a fixed time window, session recording, no permanently stored credentials. This addresses the threat the BSI lists in its top ten without making maintenance impossible.

One source of truth. Identities, rules and states live in one place and under version control. From there the network, servers, endpoints and applications are supplied. Without it, every zone architecture stays a drawing.

No agents at device level. Nothing of ours runs on PLCs or at station level. Control sits at the crossing: terminate, inspect, forward or reject — and on the process traffic a learned normal picture that reports deviations to a human.

Where it pays to start

A survey of the crossings and the remote access paths, before anything is procured. In this order: who comes in from outside today and by which route; which zone talks to which and about what; where access control hangs on a MAC address; and which of the running projects solve a problem you actually have.

Source: BSI-CS 005, "Industrial Control System Security — Top 10 Bedrohungen und Gegenmaßnahmen", version 1.50 of 03.05.2022. On the classification of MAB: Cisco, MAC Authentication Bypass Deployment Guide.