Robust Zero Trust Architecture to improve Industrial Cyber Security

Historically, industrial control systems operated in a disconnected, air-gapped, and isolated manner. For a variety of reasons, these systems are being connected to provide remote support, feed data to enterprise systems, analytics platforms and more recently, cloud solutions. In many cases, operating companies are becoming increasingly reliant on a pool of suppliers to provide the remote support and analytics capabilities. While this connectivity delivers enormous operational value, it also exposes control systems to cyber threats they were never designed to withstand.

The recent Hellcat attack on Jaguar Land Rover is simply the latest in a series of high-profile disruptions to production. While no information has been provided on whether Hellcat got into the OT or ICS environment, production was suspended at great expense as a precaution. A similar situation occurred during the Colonial Pipeline attack in May 2021.

Most industrial control systems (ICS) and operational technology (OT) assets were engineered decades ago, in an era when the concept of “cybersecurity” simply didn’t apply. Protocols such as Modbus, Profibus, and even early implementations of OPC were designed for deterministic communication, not authentication or encryption. As a result, many plants today still rely on infrastructure that assumes everything on the network is trustworthy – a dangerous assumption in the modern threat landscape.

The bulk of industrial cybersecurity is to protect the perimeter, primarily through the use of firewalls. While this is generally effective for unknown sources, it is ineffective if the bad actor gains access through a trusted source. For example, vendor A is trusted and has access to your control environment. For example, if vendor A gets compromised, then by virtue of the fact that you trusted vendor A, you have been compromised or, at the very least, are at risk.

There’s no single control or tool that can “solve” cybersecurity. Industrial systems require a defence-in-depth approach – multiple, overlapping layers of security that protect against failures at any one level.

This strategy includes:

• Network segmentation between IT and OT domains to limit lateral movement.
• Access control and least privilege principles to reduce unnecessary exposure.
• Continuous monitoring for anomalous activity on control networks.
• Patch management and system hardening – even when legacy systems make this challenging.
• Physical security and supply chain integrity are often overlooked in industrial settings.
• Cyber response plan, what do you do when a cyber incident does occur? While no plan survives first contact with the enemy, to paraphrase Helmuth von Moltke, it is essential to have a plan. Figuring out a plan while under attack is never a good idea.

Defence-in-depth acknowledges that attacks are inevitable. The objective is to limit the blast radius - detect early, contain quickly, provide clear boundaries between systems and maintain operational continuity.

Zero Trust is an architectural philosophy that provides a valuable approach to achieving the defence-in-depth requirements. Traditional security models rely on controlling access to the control environment, but once you are on the “trusted internal network”, you can do pretty much anything. That paradigm no longer holds. Remote access, cloud integration, and IoT expansion have blurred those boundaries.

A Zero Trust Architecture (ZTA) assumes no implicit trust – every device, user, and process must continuously prove its legitimacy. In practice, this means:

• Micro-segmentation of control networks so that even within OT, systems communicate only when necessary. With each function or vendor/supplier being separated.
• Identity-based access instead of static IP-based trust.
• Encryption and authentication for all data paths, even between legacy systems, where possible via gateways or proxies.
• Real-time policy enforcement and behavioural baselining to detect deviations early.
• Defined communication paths for all communications. The device should only communicate using known protocols to defined endpoints. Providing a means of monitoring for abnormal behaviour and the means to quickly isolate potential bad actors.

Zero Trust doesn’t replace defence-in-depth; it strengthens it by embedding verification into every layer of the system.

The advent of more modern industrial communication protocols like OPC UA (Unified Architecture) or MQTT does facilitate the implementation of a strong Zero Trust Architecture. These protocols are firewall-friendly and are less reliant on Windows authentication methods. This provides a practical means to segment the control system into zones.

ZTA is well aligned with the IEC-62443 (Industrial Cyber Security) standard. IEC-62443 highlights the need for a defence-in-depth strategy. IEC-62443 specifies the need for security zones and conduits, exactly what a ZTA aims to achieve.