Why OT is different
Everything that makes IT security tractable is weaker or absent in an industrial environment:
- Patching is constrained by physics. A maintenance window may come once a year, and a reboot may mean stopping production or a treatment process.
- Lifetimes are measured in decades. Controllers commissioned in 2004 are still in service and will outlive several IT refresh cycles.
- Agents are not an option. You cannot install endpoint software on a PLC, and vendor warranties often forbid touching the HMI at all.
- Protocols assume a trusted network. Modbus, DNP3, and their contemporaries were designed without authentication because the wire was physically protected.
- Safety outranks security. A control that could delay an operator response during an upset condition will be removed, correctly.
The consequence is that the defensible boundary is the only place control can be applied — and a brokered gateway is what makes that boundary enforceable rather than aspirational.
Where the gateway sits
The Purdue model puts a demilitarised zone between enterprise IT (Levels 4–5) and process control (Levels 0–3). The jump server belongs in that DMZ, and the rule that gives it meaning is the same one as everywhere else, stated more strictly:
Vendor access is the real driver
Most OT access programmes are built because of vendors, not staff. The integrator who commissioned the system needs to reach it for diagnostics, and the historical answer — a cellular modem on the panel, or a permanently installed remote support tool — is an unmonitored route into the process network that your security team frequently does not know exists.
A brokered gateway replaces it with something reviewable:
- The vendor engineer authenticates as a named individual with MFA, not as a shared support account.
- Access is requested against a work order, with a stated reason and a duration.
- A plant engineer approves it, granting only the target and only the capabilities the task needs.
- The session is recorded in full and expires on the approved clock.
- The recording is available to the plant, not only to the vendor.
See vendor and third-party access for the wider pattern.
Configuration is the asset
For network and control equipment, "what did they do" is answered by the configuration, not only by the transcript. A gateway that captures the running configuration before and after each session, masks secrets, and diffs against an approved baseline turns a session record into a change record.
Rollback belongs in the same place — but it must never be automatic. Writing a stored configuration back to live equipment deserves re-authentication, an explicit written reason, and a pre-flight check that refuses to proceed if the restore would drop the management address or the route the gateway itself depends on.
Design for the upset condition
Every control you add will eventually be present during an emergency. Ask, before deployment: if the process is in an abnormal state at 3am and the WAN is down, how does an engineer reach the HMI?
- Gateways local to the site, so wide-area failure does not sever plant access
- Local authentication fallback that does not require a distant directory
- A documented, drilled break-glass path with heavy alerting on use
- Explicit agreement with safety and operations on what the gateway will never block
A control that operations trusts during an incident survives. One that gets in the way is bypassed permanently after the first bad night.