When OT Meets IT: Securing Your Legacy PLCs Without Stalling Production

Imagine you're an automation engineer at a mid-sized food-and-beverage plant. One morning, your maintenance manager pulls you aside: the corporate IT team wants to connect your packaging line's PLCs to the new MES system for real-time OEE tracking. They've heard about Industry 4.0 and the IIoT market growing at a 12.2% CAGR (Maximize Market Research) — they're excited. But you know your line runs on a mix of EtherNet/IP and Modbus TCP, with a couple of aging PLCs that have no security features at all. If you open them up to the IT network, you're inviting trouble.

Here's the blunt truth: you can't just bolt on a firewall and hope for the best. The ISA/IEC 62443 series isn't just a nice-to-have—it's the benchmark for industrial control system security, and it's recognized as a horizontal standard by the IEC (ISA/IEC 62443). It bridges the gap between OT and IT, and between process safety and cybersecurity. If you ignore it, you're gambling with your production line. But if you apply it smartly, you can get the data visibility your IT team wants without turning your plant into a hacker's playground.

The Legacy Trap: Why Old Protocols Are a Liability

Your legacy PLCs probably speak Modbus or maybe even PROFIBUS. Modbus, developed in the late 1970s, uses a master-slave model and supports serial and Ethernet transport (OPC Foundation). It's simple, but it has zero built-in security. Same with PROFIBUS—it's a standardized digital communication system, but it predates modern security concerns. When CISA warns that many legacy ICS devices use outdated protocols lacking encryption or authentication, they're talking about these (CISA Industrial Control Systems). You can't just patch that with a software update; you need to isolate them.

Segment Your Network: The First Line of Defense

Here's where you start: network segmentation. Don't give your MES system direct access to the PLCs. Instead, put the PLCs on their own OT network segment, and let only a gateway—like an OPC UA server—communicate with the MES. OPC UA is a vendor-neutral standard with built-in encryption and authentication, and it's designed to carry data securely to MES/ERP systems (EtherCAT Technology Group). It's the backbone for IT/OT integration (OPC Foundation). By using OPC UA as a translation layer, you're not exposing the raw Modbus or EtherNet/IP traffic to the IT network. You're creating a controlled interface.

Follow the Standards: ISA/IEC 62443 and NIST SP 800-82

Now, you might be thinking, "This sounds like a lot of work." But there's a roadmap. The ISA/IEC 62443 series defines requirements for asset owners, product suppliers, integrators, and service suppliers (ISA/IEC 62443). For you as an asset owner, it tells you how to zone and conduit your network. Meanwhile, NIST SP 800-82 Rev. 3 is the Guide to OT Security, covering industrial control systems, SCADA, DCS, and PLCs (NIST SP 800-82 Rev. 3). Both emphasize the same principle: know what you have, segment it, and control who can talk to what.

Real-World Scenario: A Packaging Line Upgrade

Let's make this concrete. Say your packaging line has 12 EtherNet/IP-enabled sensors and four PLCs, all controlled by a Rockwell system. You want to send production data to an MES on the corporate network. Rather than bridging the networks, you install a DMZ with an OPC UA server and an MQTT broker. The PLCs talk EtherNet/IP to the OPC UA server, which translates to OPC UA. The OPC UA server then publishes data to the MQTT broker over TLS, which the MES subscribes to. MQTT is a lightweight publish/subscribe protocol standardized as ISO/IEC 20922 (ISO/IEC 20922 MQTT Standard). It's designed for constrained environments, and it supports encryption with TLS (MQTT.org). This keeps your OT network isolated—the MES only ever sees the OPC UA server, never the PLCs directly.

Don't Forget the Physical Layer

While you're at it, consider your field-level devices. If you're upgrading, look at protocols with built-in safety. EtherCAT, for instance, supports Safety over EtherCAT (FSoE) up to SIL 3 (EtherCAT Technology Group). Sercos also offers CIP Safety up to SIL 3 (Sercos International). These are great for motion control, but they're not necessarily for everyone. For sensors, IO-Link is a standardized point-to-point I/O technology (IO-Link Consortium). But remember, these are all Ethernet-based or fieldbus protocols—they still need the same network segmentation and security layers. The key is to choose protocols that fit your application, not just the latest trend.

The Human Factor: Training and Awareness

You can have the best technical controls, but if your operators don't know why they can't plug a USB drive into a PLC, you're still vulnerable. CISA offers ICS training online and in-person in partnership with Idaho National Laboratories (CISA Industrial Control Systems). Encourage your team to take it. Also, make sure you're monitoring your network. CISA's Known Exploited Vulnerabilities catalog is a great resource for prioritizing patches (CISA Industrial Control Systems). But don't just patch blindly—test in a lab first.

What I'd Actually Do

Here's my blunt recommendation: Start small. Pick one line or piece of equipment, and build a pilot network that uses OPC UA and MQTT to feed data to a single application. Use the ISA/IEC 62443 zones and conduits to map out exactly what's allowed. Then, once you've proven it works, expand. But don't try to connect everything at once—that's how you get a mess. And don't forget to involve your IT department early; they might not understand OT constraints, but they can help with the corporate side. The goal is to get the data you need without compromising uptime. Because in the end, a secure plant is a productive plant.

Sources

• OPC Foundation - https://opcfoundation.org/
• ISA/IEC 62443 - https://www.isa.org/standards-and-publications/isa-standards/isa-iec-62443-series-of-standards
• NIST SP 800-82 Rev. 3 - https://csrc.nist.gov/pubs/sp/800/82/r3/final
• CISA Industrial Control Systems - https://www.cisa.gov/topics/industrial-control-systems
• MQTT.org - https://mqtt.org/
• EtherCAT Technology Group - https://www.ethercat.org/en/technology.html