With the explosion in the number of connected sensors, actuators, and gateways in production environments, industrial IoT network security has become a critical issue. Every unprotected node represents a potential entry point into the heart of the factory’s IT system. Yet, unlike traditional IT networks, an industrial IoT network must contend with strong constraints: limited bandwidth, legacy equipment, heterogeneous protocols, and long maintenance cycles. This article details the technical best practices for building a resilient architecture, without compromise between security and operations.
1. Understanding the attack surface of an industrial IoT network
A typical industrial IoT network consists of sensors, gateways, controllers (PLC/RTU), edge servers, and cloud platforms. Each of these elements exposes interfaces — APIs, serial ports, wireless protocols, field buses — which constitute as many attack vectors.
The most frequently exploited vulnerabilities are:
- Weak or absent authentication on connected devices (default passwords, lack of certificates).
- Unencrypted communications on radio links (LoRaWAN, NB-IoT, Wi-Fi) enabling passive eavesdropping or frame injection.
- Unsigned firmware opening the door to malicious updates.
- Insufficient network segmentation between the OT (operational technology) level and the IT level.
- Lack of anomaly detection on upstream traffic (data-in-flight) and API requests.
A preliminary risk analysis — even a basic one — helps prioritize hardening actions on the most exposed links in the chain.
2. Network architecture: segmentation and trust zones
The first line of defense consists of isolating flows by creating distinct network zones. The Purdue model (ISA-95), well known to automation engineers, provides a solid foundation: it defines hierarchical levels from sensors (level 0) to the enterprise network (level 4). Each level communicates with the next via industrial firewalls that strictly filter authorized protocols (Profinet, Modbus TCP, OPC UA, MQTT).
In an IoT deployment, it is recommended to add a dedicated IoT demilitarized zone (DMZ) for gateways and edge services. This DMZ isolates field equipment from application servers and the cloud. Filtering rules should be established in whitelist mode: anything not explicitly allowed is blocked.
- Create a dedicated IoT VLAN, separate from the office network and guest Wi-Fi.
- Apply ACLs (access control lists) on industrial switches.
- Use an application firewall capable of inspecting OT protocols (DPI for Modbus, Profinet, BACnet).
3. End-to-end encryption and strong authentication
Many legacy IoT protocols do not encrypt their exchanges by default. Yet, in an industrial context, an altered Modbus frame can cause a production line shutdown or a dangerous command. It is therefore imperative to superimpose a security layer on every flow.
Practical recommendations include:
- TLS 1.3 for all IP communications (MQTT over TLS, HTTPS for REST APIs).
- DTLS for UDP flows (CoAP, LwM2M) used in remote metering or remote maintenance.
- IPsec or WireGuard VPN between remote sites and the network core.
- X.509 certificates with an internal PKI for device authentication, rather than pre-shared keys (PSK) that are difficult to renew at scale.
The identity of each sensor or gateway must be unique, tied to a revocable certificate. A centralized directory (for example via an identity registry) facilitates rotation and revocation in case of compromise.
4. Continuous monitoring and anomaly detection
A secure network is never static. Implementing security supervision makes it possible to detect abnormal behaviors before they escalate into incidents. Network Detection and Response (NDR) solutions adapted to OT protocols analyze traffic in real time and flag deviations from the baseline (unusual traffic, unexpected requests, scanning attempts).
Teams can combine these tools with a SIEM (Security Information and Event Management) centralizing logs from gateways, firewalls, and edge servers. Key compromise indicators to monitor as a priority:
- Sudden spike in MQTT connections to an unknown destination.
- Modbus frames with rare function codes or out-of-range addresses.
- Repeated failed authentication attempts on a gateway.
- Firmware or configuration changes outside planned maintenance windows.
The key is to set realistic alert thresholds to avoid noise while ensuring sufficient responsiveness.
5. Secure updates and firmware lifecycle
Updating IoT equipment remains a pain point in industry: hundreds of nodes, sometimes difficult to access, narrow maintenance windows, and risks of regression. Yet, unmaintained firmware exposes known vulnerabilities (CVEs) that attackers do not hesitate to exploit.
To secure the update cycle without blocking production:
- Set up a local distribution server (edge repository) that replicates updates from the cloud, avoiding saturation of the uplink.
- Cryptographically sign each firmware image and verify the signature on the device side before installation.
- Use a staged rollout strategy: test on a pilot batch, then generalize.
- Provide a fallback mechanism (dual-bank) allowing a return to the previous version in case of failure.
A centralized registry of deployed versions facilitates traceability and compliance with regulatory requirements (NIS 2, GDPR for associated data).
6. Governance and processes: the human in the loop
Technology alone is not enough. Clear governance — security policy, incident response procedures, OT network access charter — is essential to provide a framework for technical actions. Operations managers must collaborate with IT teams to keep the flow mapping and access matrix up to date.
Among organizational best practices:
- Conduct regular security audits (penetration tests, configuration review).
- Train operators in basic procedures (reporting abnormal behavior, password management).
- Document incident response procedures specific to the IoT context (network shutdown, isolation of a compromised node).
The IEC 62443 standard (ISA/IEC 62443) provides a comprehensive framework covering both organizational and technical aspects of cybersecurity for industrial automation and control systems.
Conclusion: securing industrial IoT is an ongoing process
The security of an industrial IoT network cannot be bought off the shelf. It is built through a methodical approach combining network segmentation, robust encryption, active monitoring, and shared governance between IT and OT teams. Each installation is unique, but the fundamental principles remain the same: know your attack surface, reduce privileges, encrypt wherever possible, and never trust by default (zero trust principle adapted to industry).
Are you working on an industrial IoT project and wondering about the security of your infrastructure? At IOTINNOV, we integrate security from the design stage of our embedded solutions: encryption, secure boot, network segmentation, and signed updates are part of our DNA.
📩 Contact us to discuss your project — whether you are in the design phase or want to audit an existing deployment, we are here to help you.
And you, what security measures have you found most effective — or most difficult to implement — on your own industrial IoT networks?