Ransomware attacks on industrial facilities are surging, and manufacturers are paying dearly. Attackers know that shutting down a production line is far more painful than shutting down an office. When operations stop, every minute costs money.
To protect high-value assets and still access OT data, network segmentation is a must. Here’s why this is harder than it sounds – and where most implementations go wrong.
The DMZ Problem Nobody Talks About
The best way to separate your operational technology (OT) network from your IT systems and the outside world is to use a DMZ (Demilitarized Zone). The principle is sound but the execution has a problem.
OPC UA and MQTT—the two most common protocols in modern industrial environments—were not designed to traverse a DMZ. The literature on these protocols mentions DMZ support, but it is actually difficult to implement.
OPC UA is too complex to make multiple hops through a DMZ architecture without introducing high latency or risk of data loss. And MQTT configurations that require multiple broker/client connections lack data consistency and reliable quality-of-service indicators across nodes, leaving users unaware of stale data.
How Tunnel/Mirroring Software Changes the Equation
The right solution is software specifically designed for multi-hop, cross-network data movement. This software can initiate outbound connections from inside the OT network, carry data across the DMZ, and deliver it to IT or cloud systems without requiring any inbound firewall openings on OT or IT. The data gets updated in real time, and remains consistent system-wide.
Cogent DataHub software from Skkynet was built precisely for this scenario. It provides:
- Outbound-only connections from the OT network, so no inbound firewall ports are ever opened
- Support for OPC DA, OPC UA, and MQTT
- Encrypted data tunneling via the DMZ
- Real-time data mirroring to IT systems, historians, and cloud platforms
- Secure remote data access for OEM partners and service vendors
The result is a network architecture that is genuinely segmented, not just nominally segmented with holes punched through it. Your OT network stays isolated and your data still flows where it needs to go.
