Implementing digital twins in critical infrastructure requires combining operational technology (OT) security standards with robust data exchange architectures. The key challenge in industrial automation for 2025–2026 is securely connecting legacy equipment to analytical platforms without creating attack vectors on physical assets.
Security priorities in the OT environment
According to the NIST SP 800-82 guidelines, system availability takes precedence over data confidentiality in operational technologies. Any delay in control signals can halt production, which is why digital twin architectures must be built on the principle of non-interference with primary processes.
To securely integrate legacy devices, which often transmit data without encryption, network segmentation is applied. Data is read via intermediate Edge gateways connected to monitoring ports, preventing any reverse impact on programmable logic controllers (PLCs).
Architectural layers and data standardization
In accordance with the AWS Well-Architected IoT Lens recommendations, the architecture is divided into three layers:
- Device layer: isolated sensors and controllers.
- Edge layer: gateways for data collection, preprocessing, and aggregation.
- Cloud or enterprise layer: the analytical environment of the digital twin.
To ensure interoperability of equipment from different vendors, the OPC UA standard is used to normalize telemetry before transmission. Designing in compliance with the ISA/IEC 62443 standard involves isolating the twin platform into a separate security zone based on the Zones and Conduits concept.
Practical enterprise integration
An example of implementing such solutions is the approach of Softengi (a member of the Intecracy Group consortium), which develops IoT gateways in compliance with the ISO/IEC 42001:2023 AI management standard. To build the upper enterprise layer and integrate data into the business environment, the UnityBase low-code platform is utilized. It provides access control (RBAC, Row-Level Security) and detailed action auditing, which are critical for infrastructure facilities.
Implications for business
Integrating legacy equipment without proper security measures exposes critical infrastructure to cyber threats and operational halts. Conversely, successful secure integration allows enterprises to leverage advanced analytics and digital twins, driving efficiency and modernization without risking physical assets or violating strict availability requirements.
Recommendations
- Apply network segmentation and use intermediate Edge gateways to read data, preventing reverse impact on programmable logic controllers (PLCs).
- Structure the architecture into distinct device, edge, and cloud layers in compliance with AWS Well-Architected IoT Lens.
- Standardize telemetry using the OPC UA standard and isolate the digital twin platform into a separate security zone based on ISA/IEC 62443.
- Deploy robust enterprise-layer platforms like UnityBase to enforce access control (RBAC, Row-Level Security) and detailed action auditing.
Prepared by a Software Ukraine member. Original publication.