Part 2 of 5 in our Security in plain words series. Many plants keep their control network off the internet, and they have good reason to. An edge controller has to work, and stay secure, on those terms.
Why the plant network stays offline
Ask an IT manager what worries them about a new device on the plant floor and the answer is rarely the device itself. It is what the device talks to. A unit that needs a vendor's server to start, to log someone in or to check a licence has opened a path between the plant and the internet, and someone has to defend that path for the life of the machine.
So many sites simply say no. The control network has no route to the internet, and anything that needs one does not go in. It is a reasonable rule, and an edge controller should be designed to live within it, not argue with it.
The questions IT will ask
When a new controller arrives for sign-off, an IT or security team tends to ask the same handful of questions. They are good questions to ask of any controller:
- What calls in from the internet? The answer should be nothing.
- What goes out, and who decides? Every outbound connection should be one the site switched on, to a destination it chose, carrying data it selected.
- What does the unit need from beyond the site to do its job? For control, data and identity, the answer should be nothing more than the site's own network.
- How is the unit proven genuine? By a certificate the site can check against an authority it trusts - ideally its own.
- How do people log in? With credentials the site issues and controls, not ones that depend on a vendor's cloud.
- What must the site provide in return? A short and honest list.
The rest of this post is how we answer them in CATIM Nimbus.
Nothing on the internet calls in
The work happens on the unit itself. Control, the data flows, the console, the data interfaces and the CATIMi Advisor all run there, and the plant's own systems reach them across the site's network. The control logic is designed never to wait on the network, and the only plant systems that reach the controller itself are ones the site has named and let in.
Where a site wants its data in the cloud, the link to an industrial cloud platform is switched on from its own page in the console, and the site chooses which values it sends. Cloud connections go outbound only, and nothing on the internet calls in.
As we put it in Sense, Decide, Act, every way in is a named, deliberate door. That is the language IT security teams already use when they divide a plant into zones joined by controlled conduits: each door can be matched to a rule and justified on its own.
Trust that is made on site
The unit proves it is genuine with a certificate, and the authority that signs it can be the site's own; part 1 of this series covers how. Nothing about that needs the internet. The unit makes its own key, the request leaves as a file, the signed certificate comes back as a file, and the site's authority does the signing in between.
A public certificate authority could not do this job anyway. Its rules do not let it certify a private plant address or a local network name, which is exactly how plant devices are reached.
Identity for people follows the same principle in the way we design it. A person's credential is issued by the site's own authority, and each unit trusts that authority and checks the credential itself. Nothing is looked up on the internet, and no vendor server has to be reachable for someone to log in. Part 3 of this series goes into identity by role.
The one thing the site provides: the right time
There is one thing an offline site must still give its units, and it is easy to overlook: the right time. Every certificate is valid between two dates. A unit that does not know the date cannot tell a good certificate from an expired one, so it either refuses people it should let in or accepts credentials that have ended.
On a site with no internet, that means a time server on the site's own network. Many plants already run one, often in a domain controller or a firewall, so this is usually a setting rather than a purchase. Our design treats the clock as part of security: each unit is given the site's time source when it is prepared, and a clock that cannot be trusted is shown, not hidden.
Sign-off without a leap of faith
An IT department signs off what it can understand: what comes in, what goes out, who signs, who logs in, and what the site must provide. Answered plainly, those questions turn an edge controller from an exception to the security policy into a device that fits it.
If your site keeps its plant network off the internet and you need an edge controller that respects that, get in touch. We are happy to take your IT team through the questions above.
About CATIM. CATIM - Creating Automation Technology In Motion - empowers people to engineer automation solutions that solve hard technical problems. CATIM Nimbus, the CODESYS edge controller with advisory AI, is the next generation of the Nimbus platform it has built since 2019.