OT
Define the access boundary of an OT AI pilot
A starting architecture that separates reading, recommendations and control authority.
OPC UA security: modes, certificates and trust lists
Do not leave an OPC UA connection at “it works”. Treat security mode, certificate trust and user authentication as separate decisions.
In short
- A connection can be encrypted and still be opened by an anonymous user, so security mode and user authentication must be checked separately.
- The “none” security mode is useful in a lab trial, but on a production network it leaves messages readable and modifiable.
- Adding a certificate to a trust list grants that application access, so certificates should not be accepted automatically without verifying their owner.
Three separate decisions
In OPC UA, communication security (signing and encrypting the channel), application identity (certificates) and user authentication are different concepts. A connection can be encrypted and still be opened by an anonymous user. Give each its own checklist.
Security mode
The security mode takes one of three values: none, sign only, sign and encrypt. “None” is useful in a lab trial, but on a production network it leaves messages readable and modifiable. Document that the security policy (algorithm suite) you use is supported by both server and client and that old, weak policies are disabled.
Manage certificates
Every application instance carries a certificate. Adding a certificate to a trust list grants that application access. Do not auto-accept a certificate without verifying its owner. Track expiry dates; an expired certificate can become an unexpected data outage on a production line.
A read account for AI work
Give the data science team a separate, read-only user and, if possible, a separate application certificate. A read account without write permission prevents a faulty model from changing a setting in the field. This guide is a suggested security practice and makes no certification or compliance claim.
Frequently asked
What are the OPC UA security modes?
The security mode is none, sign only, or sign and encrypt. None is useful in a lab trial, but on a production network it leaves messages readable and modifiable. Confirm that the security policy is supported by both server and client, and that old, weak policies are disabled.
How should a data science team connect to an OPC UA server?
Give the data science team a separate, read-only user and, if possible, a separate application certificate. A read account without write permission prevents a faulty model from changing a setting in the field. Track certificate expiry dates, since an expired certificate can become an unexpected data outage on a production line.
Sources and further reading
Pilot steps in this guide are proposed engineering workflows. Examples do not constitute measured field performance.
Questions on this topic
Keep reading.
Full library
OT
IEC 62443 and OT Security: Zones, Conduits, and Best Practices
IEC 62443 is the reference standard for industrial automation and control system security. Here is how its zone and conduit model translates into concrete network decisions.
Reliability
Remaining useful life (RUL): report an interval, not one number
Learn how RUL is defined, what each of three common approaches needs as data, and how to report P10, P50 and P90 values with a worked trend calculation.